Resource exhaustion in expat - CVE-2025-59375

Vulnerability identifier: #VU115751

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-59375

CWE-ID: CWE-400

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources. A remote attacker can trigger large dynamic memory allocations via a small document and perform a denial of service (DoS) attack.

expat
SUSE Linux Enterprise Server 15 SP3
Debian Linux
SUSE Linux Enterprise Server 15 SP5
SUSE Manager Retail Branch Server 4.3
SUSE Linux Enterprise Server 12 SP5 LTSS Extended
SUSE Linux Enterprise Server 12 SP5
SUSE Manager Server 4.3
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise Server 15 SP6
SUSE Manager Proxy 4.3
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Workstation Extension 15
visionOS
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
SUSE Enterprise Storage
OpenBSD
Red Hat CodeReady Linux Builder for x86_64
Red Hat Enterprise Linux for ARM 64
Anolis OS
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux Server - TUS
watchOS
macOS
Ubuntu
Basesystem Module
SUSE Package Hub 15
Desktop Applications Module
openSUSE Leap
tvOS
iPadOS
Apple iOS
openEuler
Fedora
Netezza Appliance
Financial Transaction Manager for RedHat OpenShift
IBM Enterprise Content Management Text Search
CICS Transaction Gateway for Multiplatforms
DevOps Code ClearCase
IBM OpenPages with Watson
IBM Observability with Instana
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
Red Hat Advanced Cluster Security for Kubernetes
IBM Sterling Connect:Direct Web Services
Oracle Communications Unified Inventory Management
Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition
Oracle Financial Services Behavior Detection Platform
WebSphere Remote Server
IBM Rational ClearQuest
IBM Rational ClearCase
Tenable Nessus
App Connect Enterprise Certified Container
Oracle HTTP Server
IBM Business Automation Workflow
Oracle Communications Network Analytics Data Director
AppDynamics NodeJS Agent
AI Inference Server
AI Inference Server Model Optimization Tools
IBM Power Hardware Management Console (HMC)
Quay
Red Hat OpenShift Serverless
OpenShift Virtualization
Nessus Network Monitor
Red Hat OpenShift Container Platform
Communications Unified Assurance
LANTIME Operating System Firmware (LTOS)
IBM Qradar SIEM
Oracle Outside In Technology
Encryption Admin Utilities
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
expat (Ubuntu package)
expat-debugsource
expat-devel
expat-help
expat-debuginfo
expat
expat (Red Hat package)
mingw32-expat
mingw64-expat
mingw-expat (Red Hat package)
expat-doc
expat-static
libexpat-devel
libexpat1
libexpat1-debuginfo
libexpat1-32bit
libexpat1-debuginfo-32bit
expat-debuginfo-32bit
expat-32bit-debuginfo
libexpat1-32bit-debuginfo
libexpat-devel-32bit
libexpat-devel-64bit
expat-64bit-debuginfo
libexpat1-64bit
libexpat1-64bit-debuginfo
mingw-expat
mingw64-fontconfig
mingw32-fontconfig
mingw-fontconfig (Red Hat package)
spice-client-win (Red Hat package)
thunderbird (Debian package)
firefox-esr (Debian package)
firefox
firefox-debugsource
firefox-debuginfo
MozillaFirefox-devel
MozillaFirefox
MozillaFirefox-debuginfo
MozillaFirefox-debugsource
MozillaFirefox-translations-common
MozillaThunderbird-translations-other
MozillaThunderbird-debugsource
MozillaThunderbird
MozillaThunderbird-translations-common
MozillaThunderbird-debuginfo
MozillaFirefox-translations-other
MozillaFirefox-branding-upstream
thunderbird-debugsource
thunderbird-wayland
thunderbird-librnp-rnp
thunderbird-debuginfo
thunderbird
Mozilla Thunderbird
OpenShift distributed tracing platform (Tempo)
IBM HTTP Server
IBM CICS TX Standard
Juniper Junos Space

Install updates from vendor's website.

expat - update to 2.7.2
Netezza Appliance - update to 1.0.0.1
visionOS - update to 26.3
IBM Observability with Instana - update to 1.0.311
Quay - update to 3.16.1
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 5.3
Red Hat Advanced Cluster Security for Kubernetes - addressed in versions 4.7.9, 4.8.7
IBM Enterprise Content Management Text Search - addressed in versions 5.5.12.0 IF007, 5.6.0.0 IF007, 5.7.0.0 IF004
Nessus Network Monitor - update to 6.5.3
IBM Sterling Connect:Direct Web Services - addressed in versions 6.3.0.16, 6.4.0.5
LANTIME Operating System Firmware (LTOS) - update to 7.10.004
IBM Qradar SIEM - update to 7.5.0 Update Pack 14 IF03
Tenable Nessus - addressed in versions 10.8.0, 10.8.1, 10.8.2, 10.8.3, 10.8.4, 10.8.5, 10.8.6, 10.9.6, 10.11.1
watchOS - update to 26.3 23S620
App Connect Enterprise Certified Container - update to 12.19.0
macOS - addressed in versions 14.8.4 23J319, 15.7.4 24G517, 26.3 25D125
tvOS - update to 26.3 23K620
iPadOS - addressed in versions 18.7.5 22H311, 26.3 23D127
Apple iOS - addressed in versions 18.7.5 22H311, 26.3 23D127
AppDynamics NodeJS Agent - update to 25.12.1
Mozilla Thunderbird - addressed in versions 140.9.0, 149.0
Red Hat OpenShift Serverless - update to 1
expat (Ubuntu package) - addressed in versions 2.1.0-4ubuntu1.4+esm11, 2.1.0-7ubuntu0.16.04.5+esm11, 2.2.5-3ubuntu0.9+esm3, 2.2.9-1ubuntu0.8+esm1, 2.4.7-1ubuntu0.7, 2.7.1-2ubuntu0.2
expat-debugsource - addressed in versions 2.2.9-17, 2.4.1-18, 2.5.0-10, 2.5.0-11
expat-devel - addressed in versions 2.2.9-17, 2.4.1-18, 2.5.0-10, 2.5.0-11
expat-help - addressed in versions 2.2.9-17, 2.4.1-18, 2.5.0-10, 2.5.0-11
expat-debuginfo - addressed in versions 2.2.9-17, 2.4.1-18, 2.5.0-10, 2.5.0-11
expat - addressed in versions 2.2.9-17, 2.4.1-18, 2.5.0-10, 2.5.0-11
expat (Red Hat package) - addressed in versions 2.2.10-1.el8_4, 2.2.10-1.el8_6, 2.2.10-1.el8_8, 2.2.10-12.el9_0.4, 2.5.0-1.el8_10, 2.5.0-1.el9_2.3, 2.5.0-5.el9_6.1, 2.5.0-5.el9_7.1, 2.7.1-1.el10_0.3, 2.7.1-1.el10_1.3
expat - addressed in versions 2.5.0-1, 2.5.0-8
expat-devel - addressed in versions 2.5.0-1, 2.5.0-8
mingw32-expat - update to 2.5.0-1
mingw64-expat - update to 2.5.0-1
mingw-expat (Red Hat package) - update to 2.5.0-1.el8_10
expat-doc - update to 2.5.0-8
expat-static - update to 2.5.0-8
expat-debuginfo - addressed in versions 2.7.1-21.46.1, 2.7.1-150000.3.39.1, 2.7.1-150400.3.31.1, 2.7.1-150700.3.6.1
libexpat-devel - addressed in versions 2.7.1-21.46.1, 2.7.1-150000.3.39.1, 2.7.1-150400.3.31.1, 2.7.1-150700.3.6.1
expat-debugsource - addressed in versions 2.7.1-21.46.1, 2.7.1-150000.3.39.1, 2.7.1-150400.3.31.1, 2.7.1-150700.3.6.1
libexpat1 - addressed in versions 2.7.1-21.46.1, 2.7.1-150000.3.39.1, 2.7.1-150400.3.31.1, 2.7.1-150700.3.6.1
expat - addressed in versions 2.7.1-21.46.1, 2.7.1-150000.3.39.1, 2.7.1-150400.3.31.1, 2.7.1-150700.3.6.1
libexpat1-debuginfo - addressed in versions 2.7.1-21.46.1, 2.7.1-150000.3.39.1, 2.7.1-150400.3.31.1, 2.7.1-150700.3.6.1
libexpat1-32bit - addressed in versions 2.7.1-21.46.1, 2.7.1-150000.3.39.1, 2.7.1-150400.3.31.1, 2.7.1-150700.3.6.1
libexpat1-debuginfo-32bit - update to 2.7.1-21.46.1
expat-debuginfo-32bit - update to 2.7.1-21.46.1
expat-32bit-debuginfo - addressed in versions 2.7.1-150000.3.39.1, 2.7.1-150400.3.31.1, 2.7.1-150700.3.6.1
libexpat1-32bit-debuginfo - addressed in versions 2.7.1-150000.3.39.1, 2.7.1-150400.3.31.1, 2.7.1-150700.3.6.1
libexpat-devel-32bit - update to 2.7.1-150400.3.31.1
libexpat-devel-64bit - update to 2.7.1-150400.3.31.1
expat-64bit-debuginfo - update to 2.7.1-150400.3.31.1
libexpat1-64bit - update to 2.7.1-150400.3.31.1
libexpat1-64bit-debuginfo - update to 2.7.1-150400.3.31.1
expat - addressed in versions 2.7.2-1.fc41, 2.7.2-1.fc42
mingw-expat - addressed in versions 2.7.2-1.fc41, 2.7.2-1.fc42, 2.7.2-1.fc43
mingw64-fontconfig - update to 2.12.6-4
mingw32-fontconfig - update to 2.12.6-4
mingw-fontconfig (Red Hat package) - update to 2.12.6-4.el8_10
AI Inference Server - update to 3.2.5
AI Inference Server Model Optimization Tools - update to 3.2.5
OpenShift distributed tracing platform (Tempo) - update to 3.8.0
Red Hat OpenShift Container Platform - addressed in versions 4.12.84, 4.13.63, 4.14.61, 4.15.61, 4.16.55, 4.17.47, 4.18.31, 4.19.22, 4.20.10
OpenShift Virtualization - update to 4.19.17
IBM HTTP Server - addressed in versions 8.5.5.29, 9.0.5.27
spice-client-win (Red Hat package) - addressed in versions 8.10-3.el8_2.1, 8.10-3.el8_4.1, 8.10-3.el8_6.1, 8.10-3.el8_8.1
IBM OpenPages with Watson - update to 9.0.5.26
IBM Power Hardware Management Console (HMC) - addressed in versions 10.3.1063.2, 11.1.1111.5
IBM CICS TX Standard - update to 11.1.0.0 ifix40
Encryption Admin Utilities - update to 11.13.1
Juniper Junos Space - update to 26.1R1 Patch V1
thunderbird (Debian package) - addressed in versions 1:140.9.0esr-1~deb12u1, 1:140.9.0esr-1~deb13u1
firefox-esr (Debian package) - addressed in versions 140.9.0esr-1~deb12u1, 140.9.0esr-1~deb13u1
firefox - update to 140.9.0-1
firefox-debugsource - update to 140.9.0-1
firefox-debuginfo - update to 140.9.0-1
MozillaFirefox-devel - addressed in versions 140.9.0-112.304.2, 140.9.0-150200.152.225.1
MozillaFirefox - addressed in versions 140.9.0-112.304.2, 140.9.0-150200.152.225.1
MozillaFirefox-debuginfo - addressed in versions 140.9.0-112.304.2, 140.9.0-150200.152.225.1
MozillaFirefox-debugsource - addressed in versions 140.9.0-112.304.2, 140.9.0-150200.152.225.1
MozillaFirefox-translations-common - addressed in versions 140.9.0-112.304.2, 140.9.0-150200.152.225.1
MozillaThunderbird-translations-other - update to 140.9.0-150200.8.263.1
MozillaThunderbird-debugsource - update to 140.9.0-150200.8.263.1
MozillaThunderbird - update to 140.9.0-150200.8.263.1
MozillaThunderbird-translations-common - update to 140.9.0-150200.8.263.1
MozillaThunderbird-debuginfo - update to 140.9.0-150200.8.263.1
MozillaFirefox-translations-other - update to 140.9.0-150200.152.225.1
MozillaFirefox-branding-upstream - update to 140.9.0-150200.152.225.1
thunderbird-debugsource - update to 140.9.1-1
thunderbird-wayland - update to 140.9.1-1
thunderbird-librnp-rnp - update to 140.9.1-1
thunderbird-debuginfo - update to 140.9.1-1
thunderbird - update to 140.9.1-1

• https://github.com/libexpat/libexpat/blob/676a4c531ec768732fac215da9730b5f50fbd2bf/expat/Changes#L45-L74
• https://github.com/libexpat/libexpat/issues/1018
• https://github.com/libexpat/libexpat/pull/1034
• https://issues.oss-fuzz.com/issues/439133977

• Denial of service in libexpat
• Fedora 42 update for expat
• Fedora 41 update for expat
• Fedora 41 update for mingw-expat
• Fedora 43 update for mingw-expat
• Fedora 42 update for mingw-expat
• SUSE update for expat
• SUSE update for expat
• SUSE update for expat
• SUSE update for expat
• openEuler 24.03 LTS SP2 update for expat
• openEuler 24.03 LTS SP1 update for expat
• openEuler 24.03 LTS update for expat
• openEuler 22.03 LTS SP4 update for expat
• openEuler 22.03 LTS SP3 update for expat
• openEuler 20.03 LTS SP4 update for expat
• Multiple vulnerabilities in Oracle Communications Unified Inventory Management
• Multiple vulnerabilities in Oracle Financial Services Behavior Detection Platform
• Multiple vulnerabilities in Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition
• OpenBSD update for libexpat
• Red Hat Enterprise Linux 10 update for expat
• Meinberg LANTIME firmware update for third-party components
• Red Hat Enterprise Linux 10 update for expat
• Red Hat Enterprise Linux 9 update for expat
• Red Hat Enterprise Linux 8 update for expat
• Red Hat Enterprise Linux 8 update for mingw-expat
• Red Hat Enterprise Linux 9 update for expat
• Red Hat Enterprise Linux 9 update for expat
• Red Hat Enterprise Linux 9 update for expat
• Anolis OS update for expat
• Anolis OS update for mingw-expat
• Red Hat Enterprise Linux 8 update for expat
• Red Hat OpenShift distributed tracing platform update for libexpat
• Red Hat Enterprise Linux 8 update for expat
• Red Hat Enterprise Linux 8 update for expat
• Multiple vulnerabilities in Tenable Nessus
• Multiple vulnerabilities in Red Hat Advanced Cluster Security (RHACS) 4.7
• Multiple vulnerabilities in Red Hat AI Inference Server Model Optimization Tools
• Multiple vulnerabilities in Red Hat AI Inference Server (TPU)
• Multiple vulnerabilities in Red Hat AI Inference Server (CUDA)
• Multiple vulnerabilities in Red Hat AI Inference Server (ROCm)
• Multiple vulnerabilities in Red Hat AI Inference Server (ROCm)
• Red Hat Advanced Cluster Security (RHACS) 4.8 update for libexpat
• Multiple vulnerabilities in IBM QRadar SIEM
• Multiple vulnerabilities in IBM Watson Speech Services Cartridge
• IBM Sterling Connect:Direct Web Services update for libexpat
• Multiple vulnerabilities in IBM App Connect Enterprise Certified Container
• Red Hat Enterprise Linux 8 update for spice-client-win
• Red Hat Enterprise Linux 8 update for spice-client-win
• Red Hat Enterprise Linux 8 update for spice-client-win
• Red Hat Enterprise Linux 8 update for spice-client-win
• Multiple vulnerabilities in IBM Business Automation Workflow traditional
• IBM Netezza Appliance update for libexpat
• Multiple vulnerabilities in IBM HTTP Server
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.20
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.12
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.16
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.18
• Multiple vulnerabilities in Red Hat Quay 3.16
• Multiple vulnerabilities in IBM WebSphere Remote Server
• Multiple vulnerabilities in Communications Unified Assurance
• Multiple vulnerabilities in Oracle Communications Network Analytics Data Director
• Multiple vulnerabilities in Oracle Outside In Technology
• Multiple vulnerabilities in Oracle HTTP Server
• Multiple vulnerabilities in Red Hat OpenShift Serverless
• Multiple vulnerabilities in OpenShift Virtualization 4.19
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.17
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.13
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.19
• Multiple vulnerabilities in IBM CICS Transaction Gateway for Multiplatforms
• Tenable Network Monitor update for third-party components
• Multiple vulnerabilities in IBM Observability with Instana (Agent)
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.14
• Anolis OS update for expat
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.15
• Multiple vulnerabilities in IBM DevOps Code ClearCase
• Multiple vulnerabilities in IBM Financial Transaction Manager (FTM) for RedHat OpenShift
• Ubuntu update for expat
• Multiple vulnerabilities in Apple macOS Tahoe
• Multiple vulnerabilities in macOS Sequoia
• Multiple vulnerabilities in Apple macOS Sonoma
• Multiple vulnerabilities in Apple visionOS
• Multiple vulnerabilities in Apple watchOS
• Multiple vulnerabilities in Apple tvOS
• Multiple vulnerabilities in Apple iOS 26 and iPadOS 26
• Multiple vulnerabilities in Apple iOS 18 and iPadOS 18
• Multiple vulnerabilities in IBM Rational ClearQuest
• Red Hat Enterprise Linux 8 update for mingw-fontconfig
• Anolis OS update for mingw-fontconfig
• Splunk AppDynamics NodeJS Agent update for third-party components
• Multiple vulnerabilities in IBM OpenPages
• Multiple vulnerabilities in Thunderbird ESR
• Multiple vulnerabilities in Mozilla Thunderbird
• Debian update for firefox-esr
• Multiple vulnerabilities in IBM CICS TX Standard
• Debian update for thunderbird
• openEuler 22.03 LTS SP4 update for firefox
• openEuler 24.03 LTS SP3 update for firefox
• openEuler 24.03 LTS SP2 update for firefox
• openEuler 24.03 LTS SP1 update for firefox
• openEuler 24.03 LTS update for firefox
• SUSE update for MozillaFirefox
• SUSE update for MozillaFirefox
• IBM Power Hardware Management Console (HMC) update for libexpat
• SUSE update for MozillaThunderbird
• openEuler 24.03 LTS SP3 update for thunderbird
• openEuler 24.03 LTS SP2 update for thunderbird
• Multiple vulnerabilities in IBM Enterprise Content Management Text Search
• Multiple vulnerabilities in Junos Space
• Multiple vulnerabilities in Dell Encryption