CVE-2024-50602Medium· 5.9▾ TwilightPoC availableAn issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function because XML_StopParser can stop/suspend an unstarted parser.
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 32.5 · likelihood 0.2 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
1.0%
1 GitHub repo (last check)
An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function because XML_StopParser can stop/suspend an unstarted parser.
active_iq_unified_managersolidfire_&_hci_management_nodesolidfire_&_hci_storage_nodewindows_host_utilitiesdebian_linux = 11.0hci_compute_nodeh300s_firmwareh500s_firmwareh700s_firmwareh410s_firmwareh410c_firmwarelibexpat < 2.6.4Upgrade past the affected range:
libexpat 2.6.4Connected by shared product, vendor, weakness, or advisory.
CVE-2021-36086Low· 3.3The CIL compiler in SELinux 3.2 has a use-after-free in cil_reset_classpermission (called from cil_reset_classperms_set and cil_reset_classperms_list).
CVE-2021-32292Critical· 9.8An issue was discovered in json-c from 20200420 (post 0.14 unreleased code) through 0.15-20200726
CVE-2025-0725High· 7.3When libcurl is asked to perform automatic gzip decompression of content-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option, **using zlib 1.2.0.3 or older**, an attacker-controlled integer overflow would make libcurl perfor…
CVE-2024-42154Medium· 4.4In the Linux kernel, the following vulnerability has been resolved: tcp_metrics: validate source addr length I don't see anything checking that TCP_METRICS_ATTR_SADDR_IPV4 is at least 4 bytes long, and the policy doesn't have an entry …
CVE-2023-5178High· 8.8A use-after-free vulnerability was found in drivers/nvme/target/tcp.c` in `nvmet_tcp_free_crypto` due to a logical bug in the NVMe/TCP subsystem in the Linux kernel
CVE-2023-3338Medium· 6.5A null pointer dereference flaw was found in the Linux kernel's DECnet networking protocol