High severity · published Mar 14, 2025
CVE-2024-8176
Libexpat: expat: improper restriction of xml entity expansion depth in libexpat
7.5
CVSS
1.4%
EPSS
No
On KEV
Description
A stack overflow vulnerability exists in the libexpat library due to the way it handles recursive entity expansion in XML documents. When parsing an XML document with deeply nested entity references, libexpat can be forced to recurse indefinitely, exhausting the stack space and causing a crash. This issue could lead to denial of service (DoS) or, in some cases, exploitable memory corruption, depending on the environment and library usage.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 71% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DO
DevWorkspace Operator 0.33 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Discovery 1.14 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Enterprise Linux 10 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Enterprise Linux 6 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Enterprise Linux 7 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Enterprise Linux 8 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Enterprise Linux 8.2 Advanced Update Support · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Enterprise Linux 8.4 Telecommunications Update Service · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support · Red Hat
All versions, or not specified · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-8176
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-8176
access.redhat.com
https://access.redhat.com/errata/RHSA-2025:13681
access.redhat.com
https://access.redhat.com/errata/RHSA-2025:22033
access.redhat.com
https://access.redhat.com/errata/RHSA-2025:22034
access.redhat.com
https://access.redhat.com/errata/RHSA-2025:22035
access.redhat.com
https://access.redhat.com/errata/RHSA-2025:22607
access.redhat.com
https://access.redhat.com/errata/RHSA-2025:22785
