CVE-2021-46143: Libexpat Project Libexpat

High severity, CVSS 7.8. EPSS: 3.8% chance of exploitation in the next 30 days.

In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for m_groupSize.

Affected products

• Libexpat Project Libexpat: before 2.4.3 (fixed in 2.4.3)
• Netapp Active Iq Unified Manager: affected versions not specified
• Netapp Clustered Data Ontap: affected versions not specified
• Netapp Hci Baseboard Management Controller: version h610c only; version h610s only; version h615c only
• Netapp Oncommand Workflow Automation: affected versions not specified
• Netapp Solidfire & Hci Management Node: affected versions not specified
• Siemens Sinema Remote Connect Server: before 3.1 (fixed in 3.1)
• Tenable Nessus: before 8.15.3 (fixed in 8.15.3); from 10.0.0, before 10.1.1 (fixed in 10.1.1)

Published 2022-01-06. Last modified 2026-06-17.