CVE-2009-2473

neon before 0.28.6, when expat is used, does not properly detect recursion during entity expansion, which allows context-dependent attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.

CVSS v2.0

4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:N/A:P

EPSS

8.44% chance of exploitation in the next 30 days, 95th percentile

Published

2009-08-21

Updated

2024-08-07

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/10206

References

• CVE Record
• NVD entry

Related

• CVE-2009-2464
• CVE-2009-2477
• CVE-2009-2451
• CVE-2009-2478
• CVE-2009-2450
• CVE-2009-2479