CVE-2022-43680: Debian Linux

High severity, CVSS 7.5. EPSS: 2.5% chance of exploitation in the next 30 days.

In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory situations.

Affected products

• Debian Debian Linux: version 10.0 only; version 11.0 only
• Fedoraproject Fedora: version 35 only; version 36 only; version 37 only
• Libexpat Project Libexpat: up to and including 2.4.9
• Netapp Active Iq Unified Manager: affected versions not specified
• Netapp h300s Firmware: affected versions not specified
• Netapp h410c Firmware: affected versions not specified
• Netapp h410s Firmware: affected versions not specified
• Netapp h500s Firmware: affected versions not specified
• Netapp h700s Firmware: affected versions not specified
• Netapp Hci Compute Node Firmware: affected versions not specified
• Netapp Oncommand Workflow Automation: affected versions not specified
• Netapp Solidfire & Hci Management Node: affected versions not specified

Published 2022-10-24. Last modified 2026-06-17.