CVE-2022-25313 Denial of service in n/a

Medium 6.5 Published 18 Feb 2022 Updated 14 Oct 2026

An attacker can cause a denial of service by triggering stack exhaustion in the Expat XML parser via deeply nested DTD elements.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2022-25313?

CVE-2022-25313 is a medium-severity denial of service vulnerability in Debian Debian Linux, published on 18 Feb 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth in the DTD element.

Weakness: CWE-674

Which versions are affected by CVE-2022-25313?

It affects 6 products.

Products include Debian Debian Linux, Fedoraproject Fedora, Libexpat Project Libexpat, Oracle Http Server, Oracle Zfs Storage Appliance Kit, Siemens Sinema Remote Connect Server.

How do I fix CVE-2022-25313?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2022-25313 being exploited?

There is no known exploitation of CVE-2022-25313 in the wild and no public exploit code.

Public exploit code: 2 proofs of concept on GitHub.

All Debian Debian Linux vulnerabilities

Sources

Also known as ALPINE-CVE-2022-25313, AZL-8623, CLEANSTART-2026-JI27707, DEBIAN-CVE-2022-25313, GHSA-3gf2-723m-w3fv, JLSEC-2025-54 and 1 more.