Fix quadratic runtime from attribute name collision checks that allowed denial of service attacks through moderately sized crafted XML input.
| Vendor | Product | Versions |
|---|---|---|
| libexpat_project | libexpat | 0 |
Downstream vendors/products affected by this vulnerability
| Vendor | Product | Source | Confidence |
|---|---|---|---|
| ibm | http | cert_advisory | 90% |
| open source | expat | cert_advisory | 90% |
Updated description with more technical detail, marked exploit as available, and noted that the vulnerability is actively exploited.
Updated affected versions to include 2.8.0, changed severity to MEDIUM, and noted that there is no available exploit.
Initial creation
