---
id: CVE-2017-9233
title: >-
  XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML
  Parser Library) allows attackers to put the parser in an infinite loop using a
  malformed external entity definition from an external DTD.
summary: >-
  XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML
  Parser Library) allows attackers to put the parser in an infinite loop using a
  malformed external entity definition from an external DTD.
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-611
  - CWE-835
vendor: libexpat_project
product: libexpat
affected:
  - libexpat <= 2.2.0
  - 'python >= 2.7.0, < 2.7.15'
  - 'python >= 3.3.0, < 3.3.7'
  - 'python >= 3.4.0, < 3.4.7'
  - 'python >= 3.5.0, < 3.5.4'
  - 'python >= 3.6.0, < 3.6.2'
  - debian_linux = 8.0
  - debian_linux = 9.0
  - debian_linux = 10.0
patched:
  - python 3.6.2
published: '2017-07-25'
updated: '2026-10-08'
sourceUpdated: '2026-10-08T21:17:06.167'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2017-9233'
references:
  - url: 'http://www.debian.org/security/2017/dsa-3898'
    label: cve@mitre.org
  - url: 'http://www.openwall.com/lists/oss-security/2017/06/17/7'
    label: cve@mitre.org
  - url: 'http://www.securityfocus.com/bid/99276'
    label: cve@mitre.org
  - url: 'http://www.securitytracker.com/id/1039427'
    label: cve@mitre.org
  - url: 'https://github.com/libexpat/libexpat/blob/master/expat/Changes'
    label: cve@mitre.org
  - url: 'https://libexpat.github.io/doc/cve-2017-9233/'
    label: cve@mitre.org
  - url: >-
      https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
    label: cve@mitre.org
  - url: >-
      https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
    label: cve@mitre.org
  - url: 'https://support.apple.com/HT208112'
    label: cve@mitre.org
  - url: 'https://support.apple.com/HT208113'
    label: cve@mitre.org
  - url: 'https://support.apple.com/HT208115'
    label: cve@mitre.org
  - url: 'https://support.apple.com/HT208144'
    label: cve@mitre.org
  - url: 'https://support.f5.com/csp/article/K03244804'
    label: cve@mitre.org
  - url: 'http://www.debian.org/security/2017/dsa-3898'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.openwall.com/lists/oss-security/2017/06/17/7'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.securityfocus.com/bid/99276'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.securitytracker.com/id/1039427'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://github.com/libexpat/libexpat/blob/master/expat/Changes'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://libexpat.github.io/doc/cve-2017-9233/'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://support.apple.com/HT208112'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://support.apple.com/HT208113'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://support.apple.com/HT208115'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://support.apple.com/HT208144'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://support.f5.com/csp/article/K03244804'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
epss: 0.08739
epssPercentile: 0.95047
ingestedAt: '2026-10-08T22:11:53.692Z'
---

## Overview

XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows attackers to put the parser in an infinite loop using a malformed external entity definition from an external DTD.

## Affected

- `libexpat <= 2.2.0`
- `python >= 2.7.0, < 2.7.15`
- `python >= 3.3.0, < 3.3.7`
- `python >= 3.4.0, < 3.4.7`
- `python >= 3.5.0, < 3.5.4`
- `python >= 3.6.0, < 3.6.2`
- `debian_linux = 8.0`
- `debian_linux = 9.0`
- `debian_linux = 10.0`

## Remediation

Upgrade past the affected range:

- `python 3.6.2`