CVE record · CVE-2024-8176

Libexpat: expat: improper restriction of xml entity expansion depth in libexpat

CVSS 7.5 HighEPSS 0.014 · 71st percentile

Published by the CVE Program (CNA: redhat) at 14 Mar 2025, 08:19 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

Affected products, as the CNA wrote them
Vendor	Product	Versions
Not given	Not given Package name: libexpat https://github.com/libexpat/libexpat/	affected before 2.7.0 semver Other versions: unaffected
Red Hat	Red Hat Enterprise Linux 10 Package name: expat https://access.redhat.com/downloads/content/package-browser/	unaffected 0:2.7.1-1.el10_0 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8 Package name: expat https://access.redhat.com/downloads/content/package-browser/	unaffected 0:2.2.5-17.el8_10 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8 Package name: xmlrpc-c https://access.redhat.com/downloads/content/package-browser/	unaffected 0:1.51.0-11.el8_10 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.2 Advanced Update Support Package name: expat https://access.redhat.com/downloads/content/package-browser/	unaffected 0:2.2.10-1.el8_2 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.2 Advanced Update Support Package name: xmlrpc-c https://access.redhat.com/downloads/content/package-browser/	unaffected 0:1.51.0-5.el8_2.2 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Package name: expat https://access.redhat.com/downloads/content/package-browser/	unaffected 0:2.2.10-1.el8_4 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Package name: xmlrpc-c https://access.redhat.com/downloads/content/package-browser/	unaffected 0:1.51.0-5.el8_4.2 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On Package name: expat https://access.redhat.com/downloads/content/package-browser/	unaffected 0:2.2.10-1.el8_4 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.4 Telecommunications Update Service Package name: xmlrpc-c https://access.redhat.com/downloads/content/package-browser/	unaffected 0:1.51.0-5.el8_4.2 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions Package name: xmlrpc-c https://access.redhat.com/downloads/content/package-browser/	unaffected 0:1.51.0-5.el8_4.2 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support Package name: expat https://access.redhat.com/downloads/content/package-browser/	unaffected 0:2.2.10-1.el8_6 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support Package name: xmlrpc-c https://access.redhat.com/downloads/content/package-browser/	unaffected 0:1.51.0-6.el8_6.1 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.6 Telecommunications Update Service Package name: expat https://access.redhat.com/downloads/content/package-browser/	unaffected 0:2.2.10-1.el8_6 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.6 Telecommunications Update Service Package name: xmlrpc-c https://access.redhat.com/downloads/content/package-browser/	unaffected 0:1.51.0-6.el8_6.1 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions Package name: expat https://access.redhat.com/downloads/content/package-browser/	unaffected 0:2.2.10-1.el8_6 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions Package name: xmlrpc-c https://access.redhat.com/downloads/content/package-browser/	unaffected 0:1.51.0-6.el8_6.1 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.8 Extended Update Support Package name: xmlrpc-c https://access.redhat.com/downloads/content/package-browser/	unaffected 0:1.51.0-8.el8_8.1 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service Package name: expat https://access.redhat.com/downloads/content/package-browser/	unaffected 0:2.2.10-1.el8_8 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions Package name: expat https://access.redhat.com/downloads/content/package-browser/	unaffected 0:2.2.10-1.el8_8 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 9 Package name: expat https://access.redhat.com/downloads/content/package-browser/	unaffected 0:2.5.0-3.el9_5.3 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 9 Package name: expat https://access.redhat.com/downloads/content/package-browser/	unaffected 0:2.5.0-5.el9_6 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 9 Package name: expat https://access.redhat.com/downloads/content/package-browser/	unaffected 0:2.5.0-3.el9_5.3 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 9 Package name: expat https://access.redhat.com/downloads/content/package-browser/	unaffected 0:2.5.0-5.el9_6 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions Package name: expat https://access.redhat.com/downloads/content/package-browser/	unaffected 0:2.2.10-12.el9_0.4 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Package name: expat https://access.redhat.com/downloads/content/package-browser/	unaffected 0:2.5.0-1.el9_2.3 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 9.4 Extended Update Support Package name: expat https://access.redhat.com/downloads/content/package-browser/	unaffected 0:2.5.0-2.el9_4.3 to before * rpm Other versions: affected
Red Hat	Red Hat JBoss Core Services 2.4.62.SP1 Package name: expat https://access.redhat.com/downloads/content/package-browser/	No versions given Other versions: unaffected
Red Hat	DevWorkspace Operator 0.33 Package name: devworkspace/devworkspace-project-clone-rhel9 https://catalog.redhat.com/software/containers/	unaffected 0.33-1744075017 to before * rpm Other versions: affected
Red Hat	Red Hat Discovery 1.14 Package name: discovery/discovery-server-rhel9 https://catalog.redhat.com/software/containers/	unaffected 1.14.3-1748529279 to before * rpm Other versions: affected
Red Hat	Red Hat Discovery 1.14 Package name: discovery/discovery-ui-rhel9 https://catalog.redhat.com/software/containers/	unaffected 1.14.2-1748467619 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 6 Package name: compat-expat1 https://access.redhat.com/downloads/content/package-browser/	No versions given Other versions: unknown
Red Hat	Red Hat Enterprise Linux 6 Package name: expat https://access.redhat.com/downloads/content/package-browser/	No versions given Other versions: unknown
Red Hat	Red Hat Enterprise Linux 7 Package name: expat https://access.redhat.com/downloads/content/package-browser/	No versions given Other versions: unknown
Red Hat	Red Hat Enterprise Linux 7 Package name: firefox https://access.redhat.com/downloads/content/package-browser/	No versions given Other versions: unknown
Red Hat	Red Hat Enterprise Linux 7 Package name: thunderbird https://access.redhat.com/downloads/content/package-browser/	No versions given Other versions: unknown
Red Hat	Red Hat Enterprise Linux 8 Package name: firefox https://access.redhat.com/downloads/content/package-browser/	No versions given Other versions: affected
Red Hat	Red Hat Enterprise Linux 8 Package name: lua-expat https://access.redhat.com/downloads/content/package-browser/	No versions given Other versions: unaffected
Red Hat	Red Hat Enterprise Linux 8 Package name: mingw-expat https://access.redhat.com/downloads/content/package-browser/	No versions given Other versions: affected
Red Hat	Red Hat Enterprise Linux 8 Package name: thunderbird https://access.redhat.com/downloads/content/package-browser/	No versions given Other versions: affected

And 6 more products. The full list is on the CVE record.

Identifiers: CVE-2024-8176
CNA: redhat
Weakness (CWE): CWE-674
Tags: Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 8
Red Hat Enterprise Linux 8.2 Advanced Update Support
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On
Red Hat Enterprise Linux 8.4 Telecommunications Update Service
Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
Denial of service
Published: 14 Mar 2025
Updated: 5 Nov 2026

Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

Severity and exploitation

Score	Rating	CVSS	Vector	Source
7.5	High	3.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	CNA (redhat)

CISA KEV Not listed.
EPSS 0.014, the 71st percentile, on 5 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

14 Mar 2025, 08:19 UTC Confirmed by the CVE List
14 Mar 2025, 09:15 UTC Confirmed by NVD

Sources

References from the CNA

access.redhat.com/errata/RHSA-2025:13681 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2025:22033 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2025:22034 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2025:22035 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2025:22607 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2025:22785 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2025:22842 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2025:22871 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2025:3531 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2025:3734 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2025:3913 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2025:4048 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2025:4446 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2025:4447 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2025:4448 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2025:4449 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2025:7444 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2025:7512 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2025:8385 vendor-advisoryredhat
access.redhat.com/security/cve/CVE-2024-8176 vdb-entryredhat
bugzilla.redhat.com/show_bug.cgi?id=2310137 issue-trackingredhat
github.com/libexpat/libexpat/issues/893
github.com/libexpat/libexpat/pull/973

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.