Disclosure summary
expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue. NOTE: it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE.
Source-reported weakness categories
CWE-611
Source-specific records & product guidance
Sources retain their own attribution and scoring. Follow the original record to confirm affected versions, fixed releases, and configuration conditions.
NIST National Vulnerability Database · NVD-CVE-2013-0340
Open original source · Updated Oct 09, 2026
Only CPE matches marked vulnerable=true are indexed. AND/OR platform conditions must be checked in the original NVD record.
| Vendor | Product / association | Version / bounds |
|---|---|---|
| libexpat_project | libexpat | * {"versionEndExcluding":"2.4.0"} |
| python | python | * {"versionStartIncluding":"3.9.0","versionEndExcluding":"3.9.7"} |
| apple | ipados | * {"versionEndExcluding":"14.8"} |
| apple | iphone_os | * {"versionEndExcluding":"14.8"} |
| apple | macos | * {"versionEndExcluding":"11.6"} |
| apple | tvos | * {"versionEndExcluding":"15.0"} |
| apple | watchos | * {"versionEndExcluding":"8.0"} |
Original records & references
- NIST NVD record
- CVE Program record
- github.com
- lists.apache.org
- lists.apache.org
- security.gentoo.org — Third Party Advisory
- support.apple.com — Third Party Advisory
- support.apple.com — Third Party Advisory
- support.apple.com — Third Party Advisory
- support.apple.com — Third Party Advisory
- support.apple.com — Third Party Advisory
- support.apple.com — Third Party Advisory
- lists.apache.org
- lists.apache.org
- security.gentoo.org — Third Party Advisory
- support.apple.com — Third Party Advisory
- support.apple.com — Third Party Advisory
- support.apple.com — Third Party Advisory
- support.apple.com — Third Party Advisory
- support.apple.com — Third Party Advisory
- support.apple.com — Third Party Advisory
PUBLISHED 2014-01-21T13:55:09-05:00
MODIFIED 2026-10-09T16:17:06-04:00
INGESTED 2026-10-10T20:50:17-04:00