CVE-2025-66382
📋 TL;DR
CVE-2025-66382 is a denial-of-service vulnerability in libexpat where a specially crafted XML file (~2MB) can cause excessive processing time (dozens of seconds). This affects any application using vulnerable libexpat versions to parse XML files, potentially impacting web servers, document processors, and XML parsers.
💻 Affected Systems
- libexpat
- Applications using libexpat XML parser
📦 What is this software?
Libexpat by Libexpat Project
⚠️ Risk & Real-World Impact
Worst Case
Application becomes unresponsive for extended periods, causing service disruption or resource exhaustion leading to denial of service.
Likely Case
Degraded performance when processing malicious XML files, potentially causing timeouts or slow responses.
If Mitigated
Minimal impact with proper input validation, rate limiting, and resource monitoring in place.
🎯 Exploit Status
Exploitation requires ability to submit crafted XML files to vulnerable parsers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: libexpat 2.7.4 or later
Vendor Advisory: https://github.com/libexpat/libexpat/issues/1076
Restart Required: Yes
Instructions:
1. Update libexpat to version 2.7.4 or later. 2. Rebuild applications using libexpat if statically linked. 3. Restart affected services.
🔧 Temporary Workarounds
Input validation and size limits
allImplement XML file size limits and validation before parsing
# Example for web servers: limit request body size
# nginx: client_max_body_size 1M;
# Apache: LimitRequestBody 1048576
Resource monitoring and timeouts
allSet processing timeouts for XML parsing operations
# Implement timeout in application code
# Python: signal.alarm(seconds)
# Java: ExecutorService with timeout
🧯 If You Can't Patch
- Implement strict XML file size limits (e.g., reject files >1MB)
- Deploy WAF rules to block suspicious XML patterns and large file uploads
🔍 How to Verify
Check if Vulnerable:
Check libexpat version: expat --version or ldd on binary to check linked library versionCheck Version:
expat --version 2>/dev/null || strings /usr/lib*/libexpat.so* | grep -i 'expat_' | head -1Verify Fix Applied:
Confirm libexpat version is 2.7.4 or later and test with known safe XML files📡 Detection & Monitoring
Log Indicators:
- Unusually long XML processing times
- Process timeouts or hangs
- Large XML file uploads (~2MB)
Network Indicators:
- Multiple large XML file uploads to endpoints
- XML content with unusual patterns
SIEM Query:
source="application_logs" AND (message="*timeout*" OR message="*hang*" OR message="*XML*" AND size>1900000)