CVE-2024-8176 Libexpat: expat: improper restriction of xml entity expansion depth in libexpat
Attackers can cause a denial of service by sending XML with deeply nested entities, exhausting stack space in libexpat.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-8176?
CVE-2024-8176 is a high-severity denial of service vulnerability in Red Hat DevWorkspace Operator 0.33, published on 14 Mar 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A stack overflow vulnerability exists in the libexpat library due to the way it handles recursive entity expansion in XML documents. When parsing an XML document with deeply nested entity references, libexpat can be forced to recurse indefinitely, exhausting the stack space and causing a crash. This issue could lead to denial of service (DoS) or, in some cases, exploitable memory corruption, depending on the environment and library usage.
Weakness: CWE-674
Which versions are affected by CVE-2024-8176?
Linux distribution packages (40)
expat AlmaLinux:10 | All versions | 2.7.1-1.el10_0 |
expat-devel AlmaLinux:10 | All versions | 2.7.1-1.el10_0 |
expat AlmaLinux:8 | All versions | 2.2.5-17.el8_10 |
expat-devel AlmaLinux:8 | All versions | 2.2.5-17.el8_10 |
xmlrpc-c AlmaLinux:8 | All versions | 1.51.0-11.el8_10 |
xmlrpc-c-c++ AlmaLinux:8 | All versions | 1.51.0-11.el8_10 |
xmlrpc-c-client AlmaLinux:8 | All versions | 1.51.0-11.el8_10 |
xmlrpc-c-client++ AlmaLinux:8 | All versions | 1.51.0-11.el8_10 |
xmlrpc-c-devel AlmaLinux:8 | All versions | 1.51.0-11.el8_10 |
expat AlmaLinux:9 | All versions | 2.5.0-3.el9_5.3 |
expat AlmaLinux:9 | All versions | 2.5.0-5.el9_6 |
expat-devel AlmaLinux:9 | All versions | 2.5.0-3.el9_5.3 |
expat-devel AlmaLinux:9 | All versions | 2.5.0-5.el9_6 |
expat Red Hat:enterprise_linux:10.0 | All versions | 0:2.7.1-1.el10_0 |
expat-debuginfo Red Hat:enterprise_linux:10.0 | All versions | 0:2.7.1-1.el10_0 |
expat-debugsource Red Hat:enterprise_linux:10.0 | All versions | 0:2.7.1-1.el10_0 |
expat-devel Red Hat:enterprise_linux:10.0 | All versions | 0:2.7.1-1.el10_0 |
expat Red Hat:enterprise_linux:8::baseos | All versions | 0:2.2.5-17.el8_10 |
expat-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 0:2.2.5-17.el8_10 |
expat-debugsource Red Hat:enterprise_linux:8::baseos | All versions | 0:2.2.5-17.el8_10 |
expat-devel Red Hat:enterprise_linux:8::baseos | All versions | 0:2.2.5-17.el8_10 |
xmlrpc-c Red Hat:enterprise_linux:8::baseos | All versions | 0:1.51.0-11.el8_10 |
xmlrpc-c-apps-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 0:1.51.0-11.el8_10 |
xmlrpc-c-c++-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 0:1.51.0-11.el8_10 |
xmlrpc-c-client Red Hat:enterprise_linux:8::baseos | All versions | 0:1.51.0-11.el8_10 |
xmlrpc-c-client++-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 0:1.51.0-11.el8_10 |
xmlrpc-c-client-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 0:1.51.0-11.el8_10 |
xmlrpc-c-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 0:1.51.0-11.el8_10 |
xmlrpc-c-debugsource Red Hat:enterprise_linux:8::baseos | All versions | 0:1.51.0-11.el8_10 |
xmlrpc-c-apps-debuginfo Red Hat:enterprise_linux:8::crb | All versions | 0:1.51.0-11.el8_10 |
xmlrpc-c-c++ Red Hat:enterprise_linux:8::crb | All versions | 0:1.51.0-11.el8_10 |
xmlrpc-c-c++-debuginfo Red Hat:enterprise_linux:8::crb | All versions | 0:1.51.0-11.el8_10 |
xmlrpc-c-client++ Red Hat:enterprise_linux:8::crb | All versions | 0:1.51.0-11.el8_10 |
xmlrpc-c-client++-debuginfo Red Hat:enterprise_linux:8::crb | All versions | 0:1.51.0-11.el8_10 |
xmlrpc-c-client-debuginfo Red Hat:enterprise_linux:8::crb | All versions | 0:1.51.0-11.el8_10 |
xmlrpc-c-debuginfo Red Hat:enterprise_linux:8::crb | All versions | 0:1.51.0-11.el8_10 |
xmlrpc-c-debugsource Red Hat:enterprise_linux:8::crb | All versions | 0:1.51.0-11.el8_10 |
xmlrpc-c-devel Red Hat:enterprise_linux:8::crb | All versions | 0:1.51.0-11.el8_10 |
expat-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:2.5.0-3.el9_5.3 |
expat-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:2.5.0-5.el9_6 |
How do I fix CVE-2024-8176?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-8176 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-8176 exists.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as ALPINE-CVE-2024-8176, ALSA-2025:3531, ALSA-2025:3913, ALSA-2025:4048, ALSA-2025:7444, ALSA-2025:7512 and 37 more.