expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler…

Description

expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue. NOTE: it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE.

Scores

EPSS (exploitation in 30 days)

19.4% · top 2.6% of all CVEs (5 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: yes · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.8.

Weakness

• n/a
• CWE-611 (opens in a new tab)All about CWE-611 and its CVEs

Affected products

• libexpat

  • affected < 2.4.0

References (26)

• [oss-security] 20130221 CVEs for libxml2 and expat internal and external XML entity expansion (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [oss-security] 20130413 Re-evaluating expat/libxml2 CVE assignments (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• 90634 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 1028213 (opens in a new tab)vdb-entryx_refsource_SECTRACKx_transferred
• GLSA-201701-21 (opens in a new tab)vendor-advisoryx_refsource_GENTOOx_transferred
• 58233 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
• https://support.apple.com/kb/HT212805 (opens in a new tab)x_refsource_CONFIRMx_transferred
• https://support.apple.com/kb/HT212804 (opens in a new tab)x_refsource_CONFIRMx_transferred
• https://support.apple.com/kb/HT212807 (opens in a new tab)x_refsource_CONFIRMx_transferred
• https://support.apple.com/kb/HT212819 (opens in a new tab)x_refsource_CONFIRMx_transferred
• https://support.apple.com/kb/HT212814 (opens in a new tab)x_refsource_CONFIRMx_transferred
• https://support.apple.com/kb/HT212815 (opens in a new tab)x_refsource_CONFIRMx_transferred
• 20210921 APPLE-SA-2021-09-20-1 iOS 15 and iPadOS 15 (opens in a new tab)mailing-listx_refsource_FULLDISCx_transferred
• 20210921 APPLE-SA-2021-09-20-2 watchOS 8 (opens in a new tab)mailing-listx_refsource_FULLDISCx_transferred
• 20210921 APPLE-SA-2021-09-20-8 Additional information for APPLE-SA-2021-09-13-4 Security Update 2021-005 Catalina (opens in a new tab)mailing-listx_refsource_FULLDISCx_transferred
• 20210921 APPLE-SA-2021-09-20-3 tvOS 15 (opens in a new tab)mailing-listx_refsource_FULLDISCx_transferred
• 20210921 APPLE-SA-2021-09-20-6 Additional information for APPLE-SA-2021-09-13-1 iOS 14.8 and iPadOS 14.8 (opens in a new tab)mailing-listx_refsource_FULLDISCx_transferred
• 20210921 APPLE-SA-2021-09-20-7 Additional information for APPLE-SA-2021-09-13-3 macOS Big Sur 11.6 (opens in a new tab)mailing-listx_refsource_FULLDISCx_transferred
• [announce] 20211007 CVE-2021-40439: Apache OpenOffice: Billion Laughs (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [openoffice-users] 20211007 CVE-2021-40439: Apache OpenOffice: Billion Laughs (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [oss-security] 20211007 CVE-2021-40439: Apache OpenOffice: Billion Laughs (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• 20211027 APPLE-SA-2021-10-26-10 Additional information for APPLE-SA-2021-09-20-2 watchOS 8 (opens in a new tab)mailing-listx_refsource_FULLDISCx_transferred
• 20211027 APPLE-SA-2021-10-26-11 Additional information for APPLE-SA-2021-09-20-3 tvOS 15 (opens in a new tab)mailing-listx_refsource_FULLDISCx_transferred
• 20211027 APPLE-SA-2021-10-26-9 Additional information for APPLE-SA-2021-09-20-1 iOS 15 and iPadOS 15 (opens in a new tab)mailing-listx_refsource_FULLDISCx_transferred
• Expat 2.4.0 and 2.4.1 Changelog (opens in a new tab)
• https://cert-portal.siemens.com/productcert/html/ssa-398330.html (opens in a new tab)

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2013-0340](https://trackcve.app/badge/CVE-2013-0340.svg)](https://trackcve.app/cve/CVE-2013-0340)

Record last updated 14 Oct 2026, 06:25 UTC.