libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in the case of a large token for which multiple buffer fills are needed.
libexpat hasta 2.5.0 permite una denegación de servicio (consumo de recursos) porque se requieren muchos análisis completos en el caso de un token grande para el cual se necesitan múltiples rellenos de búfer.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
| Attack Vector | NETWORK |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | NONE |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | NONE |
| Integrity Impact | NONE |
| Availability Impact | HIGH |
| Source | Type | Description |
|---|---|---|
| [email protected] | Primary |
en
CWE-400
|
| 134c704f-9b21-4f2e-91b3-4a467353bcc0 | Secondary |
en
CWE-400
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| libexpat_project | libexpat | * | <built-in method update of dict object at 0x7fd37038e5c0> | Application |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:libexpat_project:libexpat:*:*:*:*:*:*:*:* |