expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue. NOTE: it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-991275 advisory.

    expat before version 2.4.0 does not properly handle entities expansion unless an application developer     uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service     (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML     document, aka an XML External Entity (XXE) issue.  NOTE: it could be argued that because expat already     provides the ability to disable external entity expansion, the responsibility for resolving this issue     lies with application developers; according to this argument, this entry should be REJECTed, and each     affected application would need its own CVE.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:22842 advisory.

    Expat is a C library for parsing XML documents.

    Security Fix(es):

    * expat: internal entity expansion (CVE-2013-0340)

    * expat: integer overflow in the doProlog function (CVE-2022-23990)

    * libexpat: expat: Improper Restriction of XML Entity Expansion Depth in libexpat (CVE-2024-8176)

    * expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small     document that is submitted for parsing (CVE-2025-59375)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:22871 advisory.

    Expat is a C library for parsing XML documents.

    Security Fix(es):

    * expat: internal entity expansion (CVE-2013-0340)

    * expat: large number of colons in input makes parser consume high amount of resources, leading to DoS     (CVE-2018-20843)

    * expat: heap-based buffer over-read via crafted XML input (CVE-2019-15903)

    * expat: Large number of prefixed XML attributes on a single tag can crash libexpat (CVE-2021-45960)

    * expat: Integer overflow in doProlog in xmlparse.c (CVE-2021-46143)

    * expat: Integer overflow in addBinding in xmlparse.c (CVE-2022-22822)

    * expat: Integer overflow in build_model in xmlparse.c (CVE-2022-22823)

    * expat: Integer overflow in defineAttribute in xmlparse.c (CVE-2022-22824)

    * expat: Integer overflow in lookup in xmlparse.c (CVE-2022-22825)

    * expat: Integer overflow in nextScaffoldPart in xmlparse.c (CVE-2022-22826)

    * expat: Integer overflow in storeAtts in xmlparse.c (CVE-2022-22827)

    * expat: integer overflow in the doProlog function (CVE-2022-23990)

    * expat: Stack exhaustion in doctype parsing (CVE-2022-25313)

    * expat: Integer overflow in copyString() (CVE-2022-25314)

    * expat: use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate     (CVE-2022-43680)

    * expat: parsing large tokens can trigger a denial of service (CVE-2023-52425)

    * libexpat: expat: Improper Restriction of XML Entity Expansion Depth in libexpat (CVE-2024-8176)

    * expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small     document that is submitted for parsing (CVE-2025-59375)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:22785 advisory.

    Expat is a C library for parsing XML documents.

    Security Fix(es):

    * expat: internal entity expansion (CVE-2013-0340)

    * expat: Large number of prefixed XML attributes on a single tag can crash libexpat (CVE-2021-45960)

    * expat: Integer overflow in doProlog in xmlparse.c (CVE-2021-46143)

    * expat: Integer overflow in addBinding in xmlparse.c (CVE-2022-22822)

    * expat: Integer overflow in build_model in xmlparse.c (CVE-2022-22823)

    * expat: Integer overflow in defineAttribute in xmlparse.c (CVE-2022-22824)

    * expat: Integer overflow in lookup in xmlparse.c (CVE-2022-22825)

    * expat: Integer overflow in nextScaffoldPart in xmlparse.c (CVE-2022-22826)

    * expat: Integer overflow in storeAtts in xmlparse.c (CVE-2022-22827)

    * expat: integer overflow in the doProlog function (CVE-2022-23990)

    * expat: Stack exhaustion in doctype parsing (CVE-2022-25313)

    * expat: Integer overflow in copyString() (CVE-2022-25314)

    * expat: use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate     (CVE-2022-43680)

    * expat: parsing large tokens can trigger a denial of service (CVE-2023-52425)

    * libexpat: expat: Improper Restriction of XML Entity Expansion Depth in libexpat (CVE-2024-8176)

    * expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small     document that is submitted for parsing (CVE-2025-59375)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:22607 advisory.

    Expat is a C library for parsing XML documents.

    Security Fix(es):

    * expat: internal entity expansion (CVE-2013-0340)

    * expat: integer overflow in the doProlog function (CVE-2022-23990)

    * libexpat: expat: Improper Restriction of XML Entity Expansion Depth in libexpat (CVE-2024-8176)

    * expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small     document that is submitted for parsing (CVE-2025-59375)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:22035 advisory.

    Expat is a C library for parsing XML documents.

    Security Fix(es):

    * expat: internal entity expansion (CVE-2013-0340)

    * expat: parsing large tokens can trigger a denial of service (CVE-2023-52425)

    * libexpat: expat: Improper Restriction of XML Entity Expansion Depth in libexpat (CVE-2024-8176)

    * expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small     document that is submitted for parsing (CVE-2025-59375)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

expat 2.1.0 and earlier does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue.  NOTE: it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - expat before version 2.4.0 does not properly handle entities expansion unless an application developer     uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service     (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML     document, aka an XML External Entity (XXE) issue. NOTE: it could be argued that because expat already     provides the ability to disable external entity expansion, the responsibility for resolving this issue     lies with application developers; according to this argument, this entry should be REJECTed, and each     affected application would need its own CVE. (CVE-2013-0340)

Note that Nessus relies on the presence of the package as reported by the vendor.

According to the versions of the expat package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - expat 2.1.0 and earlier does not properly handle entities expansion unless an application developer uses     the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service     (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML     document, aka an XML External Entity (XXE) issue. NOTE: it could be argued that because expat already     provides the ability to disable external entity expansion, the responsibility for resolving this issue     lies with application developers; according to this argument, this entry should be REJECTed, and each     affected application would need its own CVE. (CVE-2013-0340)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the expat package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - expat 2.1.0 and earlier does not properly handle entities expansion unless an application developer uses     the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service     (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML     document, aka an XML External Entity (XXE) issue. NOTE: it could be argued that because expat already     provides the ability to disable external entity expansion, the responsibility for resolving this issue     lies with application developers; according to this argument, this entry should be REJECTed, and each     affected application would need its own CVE. (CVE-2013-0340)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Apple iOS running on the mobile device is prior to 15. It is, therefore, affected by multiple vulnerabilities.

The version of Apple iOS running on the mobile device is prior to 14.8. It is, therefore, affected by multiple vulnerabilities.

The remote host is running a version of macOS / Mac OS X that is prior to Catalina Security Update 2021-005. It is, therefore, affected by multiple vulnerabilities, including the following:

  - Arbitrary code execution when processing a maliciously crafted image. (CVE-2021-30835, CVE-2021-30847)

  - An integer overflow issue due to insufficient input validation, which can lead to arbitrary code     execution by an unauthenticated attacker when processing a maliciously crafted PDF. (CVE-2021-30860)

  - Arbitrary code execution when processing a maliciously crafted dfont file. (CVE-2021-30841,     CVE-2021-30842, CVE-2021-30843)

Note that Nessus has not tested for this issue but has instead relied only on the operating system's self-reported version number.

The remote host is running a version of macOS / Mac OS X that is 11.x prior to 11.6 Big Sur. It is, therefore, affected by multiple vulnerabilities including the following:

  - A use after free issue was addressed with improved memory management. Exploitation of this vulnerability may lead to     arbitrary code execution. (CVE-2021-30858)

  - An integer overflow was addressed with improved input validation. Exploitation of this vulnerability may lead to     arbitrary code execution. (CVE-2021-30860)

  - Insufficient checks when processing maliciously crafted dfont files may lead to arbitrary code     execution. (CVE-2021-30841, CVE-2021-30842, CVE-2021-30843)

Note that Nessus has not tested for this issue but has instead relied only on the operating system's self-reported version number.

Kurt Seifried reports :

So here are the CVE's for the two big ones, libxml2 and expat. Both are affected by the expansion of internal entities (which can be used to consume resources) and external entities (which can cause a denial of service against other services, be used to port scan, etc.).

A billion laughs attack is a type of denial-of-service attack which is aimed at parsers of XML documents.

New expat packages are available for Slackware 14.0, 14.1, 14.2, and
-current to fix a security issue.

The version of IBM Netezza Analytics installed on the remote Linux host is 1.2.1 - 3.2.1. It is, therefore, affected by multiple vulnerabilities in the Open Source James Clark Expat component.

The remote host is affected by the vulnerability described in GLSA-201701-21 (Expat: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Expat. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker, by enticing a user to process a specially crafted XML       file, could execute arbitrary code with the privileges of the process or       cause a Denial of Service condition.  This attack could also be used       against automated systems that arbitrarily process XML files.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
279107	Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: expat (UTSA-2025-991275)	Nessus	Unity Linux Local Security Checks	critical
277859	RHEL 8 : expat (RHSA-2025:22842)	Nessus	Red Hat Local Security Checks	high
277829	RHEL 8 : expat (RHSA-2025:22871)	Nessus	Red Hat Local Security Checks	critical
277504	RHEL 8 : expat (RHSA-2025:22785)	Nessus	Red Hat Local Security Checks	critical
277137	RHEL 8 : expat (RHSA-2025:22607)	Nessus	Red Hat Local Security Checks	high
276721	RHEL 9 : expat (RHSA-2025:22035)	Nessus	Red Hat Local Security Checks	high
504171	Siemens SIMATIC S7-1500 Improper Restriction of XML External Entity Reference (CVE-2013-0340)	Tenable OT Security	Tenable.ot	critical
217819	Linux Distros Unpatched Vulnerability : CVE-2013-0340	Nessus	Misc.	high
155536	EulerOS Virtualization 2.9.0 : expat (EulerOS-SA-2021-2784)	Nessus	Huawei Local Security Checks	critical
155509	EulerOS Virtualization 2.9.1 : expat (EulerOS-SA-2021-2756)	Nessus	Huawei Local Security Checks	critical
153711	EulerOS 2.0 SP9 : expat (EulerOS-SA-2021-2548)	Nessus	Huawei Local Security Checks	critical
153698	EulerOS 2.0 SP9 : expat (EulerOS-SA-2021-2524)	Nessus	Huawei Local Security Checks	critical
153507	Apple iOS < 15 Multiple Vulnerabilities (HT212814)	Nessus	Mobile Devices	critical
153434	Apple iOS < 14.8 Multiple Vulnerabilities (HT212807)	Nessus	Mobile Devices	critical
153432	macOS 10.15.x < Catalina Security Update 2021-005 Catalina (HT212805)	Nessus	MacOS X Local Security Checks	high
153429	macOS 11.x < 11.6 (HT212804)	Nessus	MacOS X Local Security Checks	high
149883	FreeBSD : texproc/expat2 -- billion laugh attack (5fa90ee6-bc9e-11eb-a287-e0d55e2a8bf9)	Nessus	FreeBSD Local Security Checks	critical
149858	Slackware 14.0 / 14.1 / 14.2 / current : expat (SSA:2021-143-01)	Nessus	Slackware Local Security Checks	critical
106714	IBM Netezza Analytics Open Source James Clark Expat Multiple Vulnerabilities (swg22012645)	Nessus	General	medium
96415	GLSA-201701-21 : Expat: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical

Detections

Analytics

CVE-2013-0340

critical

Tenable Plugins

critical

high

critical

critical

high

high

critical

high

critical

critical

critical

critical

critical

critical

high

high

critical

critical

medium

critical