CVE-2013-0340
expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote…
Published Jan 21, 2014 · updated Oct 14, 2026 · libexpat project libexpat
expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue. NOTE: it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Jan 21, 2014 · NIST NVD
Detected
expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue. NOTE: it could be argued that because
Oct 14, 2026 · NIST NVD
Updated
expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue. NOTE: it could be argued that because
Affected
- cpe apple/ipadosversion unspecified
- cpe apple/iphone osversion unspecified
- cpe apple/macosversion unspecified
- cpe libexpat project/libexpatversion unspecified
- cpe python/pythonversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2013-0340
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2013-0340
30-day exploitation probability 19.4%
first.org - NIST NVDVulnerability recordCVE-2013-0340
expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read ar
nvd.nist.gov