CVE-2021-46143 Integer overflow in n/a

High 8.1 Published 6 Jan 2022 Updated 14 Oct 2026

An integer overflow in libexpat's XML parser can cause a denial of service, affecting applications that process untrusted XML.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2021-46143?

CVE-2021-46143 is a high-severity vulnerability in Libexpat Project Libexpat, published on 6 Jan 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for m_groupSize.

Weakness: CWE-190

Which versions are affected by CVE-2021-46143?

It affects 8 products.

Products include Libexpat Project Libexpat, Netapp Active Iq Unified Manager, Netapp Clustered Data Ontap, Netapp Hci Baseboard Management Controller, Netapp Oncommand Workflow Automation, Netapp Solidfire \& Hci Management Node and 2 more.

How do I fix CVE-2021-46143?

Upgrade to a fixed version.

Is CVE-2021-46143 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-46143 exists.

Public exploit code: 1 proofs of concept on GitHub.

All Libexpat Project Libexpat vulnerabilities

Sources

Also known as ALPINE-CVE-2021-46143, AZL-7155, CLEANSTART-2026-LJ99909, DEBIAN-CVE-2021-46143, GHSA-j6g2-cvhq-p8xr, JLSEC-2025-43 and 1 more.