CVE-2024-8176

Highest-risk unexploited with PoCs

Exploit code exists, no confirmed in-the-wild activity, ranked by EPSS

Actively Exploited

Confirmed exploited in the wild, sorted by most recently updated

CVSS 7.5EPSS 1%

Published 2025-03-14Updated 2025-03-14

Media 3484

Vulnerability details

A stack overflow vulnerability exists in the libexpat library due to the way it handles recursive entity expansion in XML documents. When parsing an XML document with deeply nested entity references, libexpat can be forced to recurse indefinitely, exhausting the stack space and causing a crash. This issue could lead to denial of service (DoS) or, in some cases, exploitable memory corruption, depending on the environment and library usage.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CNAredhat

EPSS score history

Sources

4 links

PoC links are not available for guest users. Login to view them.

CVEShield The Hacker News CVE Organization RedHat Vuln DB

Profile

CVSS

7.5

EPSS

Published

2025-03-14

Updated

2025-03-14

CNA

redhat

Vendors

No vendors listed.

CPEs

cpe:/o:redhat:enterprise_linux:10.0

cpe:/o:redhat:enterprise_linux:8::baseos

cpe:/a:redhat:enterprise_linux:8::crb

cpe:/o:redhat:rhel_aus:8.2::baseos

cpe:/o:redhat:rhel_aus:8.4::baseos

cpe:/o:redhat:rhel_eus_long_life:8.4::baseos

cpe:/o:redhat:rhel_tus:8.4::baseos

cpe:/o:redhat:rhel_e4s:8.4::baseos

cpe:/o:redhat:rhel_aus:8.6::baseos

cpe:/o:redhat:rhel_e4s:8.6::baseos

cpe:/o:redhat:rhel_tus:8.6::baseos

cpe:/a:redhat:rhel_eus:8.8::crb

cpe:/o:redhat:rhel_eus:8.8::baseos

cpe:/o:redhat:rhel_tus:8.8::baseos

cpe:/o:redhat:rhel_e4s:8.8::baseos

cpe:/a:redhat:enterprise_linux:9::appstream

cpe:/o:redhat:enterprise_linux:9::baseos

cpe:/o:redhat:rhel_e4s:9.0::baseos

cpe:/a:redhat:rhel_e4s:9.0::appstream

cpe:/o:redhat:rhel_e4s:9.2::baseos

cpe:/a:redhat:rhel_e4s:9.2::appstream

cpe:/o:redhat:rhel_eus:9.4::baseos

cpe:/a:redhat:rhel_eus:9.4::appstream

cpe:/a:redhat:jboss_core_services:1

cpe:/a:redhat:devworkspace:0.33::el9

cpe:/a:redhat:discovery:1.14::el9

cpe:/o:redhat:enterprise_linux:6

cpe:/o:redhat:enterprise_linux:7

cpe:/o:redhat:enterprise_linux:8

cpe:/o:redhat:enterprise_linux:9

cpe:/a:redhat:openshift:4

cpe:/o:redhat:rhivos:1

cpe:/a:redhat:jboss_core_services:1.0

Vulnerability dashboard

Highest-risk unexploited with PoCs

Actively Exploited

Recently Updated