CVE-2018-20843
HighCVSS 7.5Exploitation Probability (EPSS)
Very high risk94th percentile - higher than 94% of all known CVEs
Summary
In libexpat (Expat before 2.2.7), XML input including XML names with a large number of colons could make the parser consume high amounts of RAM and CPU resources, enough for denial-of-service attacks.
Risk Assessment
An attacker can send a specially crafted XML document, causing excessive resource consumption and denial of service for applications using Expat.
Recommendation
Update Expat to version 2.2.7 or later. Limit processing of untrusted XML documents.
Other vulnerabilities in Expat
See all- CVE-2016-4472High
The overflow protection in Expat is removed by compilers with certain optimization settings, allowing remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via crafted XML data.
- CVE-2016-0718Critical
Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers a buffer overflow.
- CVE-2013-0340Medium
expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function. This allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue.
- CVE-2009-3720Medium
The updatePosition function in libexpat (Expat 2.0.1) has a buffer over-read vulnerability. Crafted UTF-8 sequences in an XML document can cause an application crash.
- CVE-2026-93990High
Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16 sequences to be accepted. Attackers can supply UTF-16 encoded XML containing lone high surrogates that consume the following code unit, causing Expat to pass unpaired surrogates to applications built with XML_UNICODE and to silently replace input characters in other builds.
- CVE-2026-76641High
Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory corruption by processing XML with external entity parsers created via XML_ExternalEntityParserCreate. A struct size mismatch between ELEMENT_TYPE members causes storeAtts to read the attIndex member past allocated memory boundaries, resulting in failure to normalize whitespace in non-CDATA attributes or a wild pointer dereference causing a segfault. This vulnerability was introduced by the fix for CVE-2026-66046.
- CVE-2026-66046High
Denial of service vulnerability in Expat through 2.8.3. The storeAtts() function in xmlparse.c has quadratic complexity, causing excessive CPU consumption when processing an XML document with many attributes with non-normalized values.
Original NVD description (English source)
In libexpat in Expat before 2.2.7, XML input including XML names that contain a large number of colons could make the XML parser consume a high amount of RAM and CPU resources while processing (enough to be usable for denial-of-service attacks).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS