CVE-2018-20843

Name: CVE-2018-20843
Creator: NVD / NIST
Published: 2019-06-24T17:15:09.98+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

HIGHCVSS 7.5/10EPSS 7.11%

Last modified Jun 17, 2026

CVE-2018-20843 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. In libexpat in Expat before 2.2.7, XML input including XML names that contain a large number of colons could make the XML parser consume a high amount of RAM and CPU resources while processing (enough to be usable for denial-of-service attacks).. EPSS estimates a 7.11% chance of exploitation in the next 30 days.

Description

In libexpat in Expat before 2.2.7, XML input including XML names that contain a large number of colons could make the XML parser consume a high amount of RAM and CPU resources while processing (enough to be usable for denial-of-service attacks).

Metrics

CVSS 3.1

7.5/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Probability

7.11%

93.4th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

Vendor	Product	Versions
Libexpat Project	Libexpat	< 2.2.7
Canonical	Ubuntu Linux	12.04
Canonical	Ubuntu Linux	14.04
Canonical	Ubuntu Linux	16.04
Canonical	Ubuntu Linux	18.04
Canonical	Ubuntu Linux	18.10
Canonical	Ubuntu Linux	19.04
Debian	Debian Linux	8.0
Debian	Debian Linux	9.0
Fedoraproject	Fedora	29
Fedoraproject	Fedora	30
Opensuse	Leap	15.0
Opensuse	Leap	15.1
Oracle	Hospitality Res 3700	>= 5.7, <= 5.7.6
Oracle	Http Server	12.1.3.0
Oracle	Http Server	12.2.1.4.0
Oracle	Outside In Technology	8.5.4
Oracle	Outside In Technology	8.5.5
Tenable	Nessus	< 8.15.0

References

http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00039.htmlMailing List, Third Party Advisory
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5226Issue Tracking, Third Party Advisory
https://github.com/libexpat/libexpat/blob/R_2_2_7/expat/ChangesRelease Notes, Third Party Advisory
https://github.com/libexpat/libexpat/issues/186Issue Tracking, Patch, Third Party Advisory
https://github.com/libexpat/libexpat/pull/262Exploit, Patch, Third Party Advisory
https://github.com/libexpat/libexpat/pull/262/commits/11f8838bf99ea0a6f0b76f9760c43704d00c4ff6Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/06/msg00028.htmlMailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CEJJSQSG3KSUQY4FPVHZ7ZTT7FORMFVD/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IDAUGEB3TUP6NEKJDBUBZX7N5OAUOOOK/
https://seclists.org/bugtraq/2019/Jun/39Mailing List, Third Party Advisory
https://security.gentoo.org/glsa/201911-08Third Party Advisory
https://security.netapp.com/advisory/ntap-20190703-0001/Third Party Advisory
https://support.f5.com/csp/article/K51011533Third Party Advisory
https://usn.ubuntu.com/4040-1/Third Party Advisory
https://usn.ubuntu.com/4040-2/Third Party Advisory
https://www.debian.org/security/2019/dsa-4472Third Party Advisory
https://www.oracle.com/security-alerts/cpuApr2021.htmlPatch, Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2020.htmlPatch, Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2020.htmlPatch, Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.htmlPatch, Third Party Advisory
https://www.tenable.com/security/tns-2021-11Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00039.htmlMailing List, Third Party Advisory
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5226Issue Tracking, Third Party Advisory
https://github.com/libexpat/libexpat/blob/R_2_2_7/expat/ChangesRelease Notes, Third Party Advisory
https://github.com/libexpat/libexpat/issues/186Issue Tracking, Patch, Third Party Advisory
https://github.com/libexpat/libexpat/pull/262Exploit, Patch, Third Party Advisory
https://github.com/libexpat/libexpat/pull/262/commits/11f8838bf99ea0a6f0b76f9760c43704d00c4ff6Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/06/msg00028.htmlMailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CEJJSQSG3KSUQY4FPVHZ7ZTT7FORMFVD/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IDAUGEB3TUP6NEKJDBUBZX7N5OAUOOOK/
https://seclists.org/bugtraq/2019/Jun/39Mailing List, Third Party Advisory
https://security.gentoo.org/glsa/201911-08Third Party Advisory
https://security.netapp.com/advisory/ntap-20190703-0001/Third Party Advisory
https://support.f5.com/csp/article/K51011533Third Party Advisory
https://usn.ubuntu.com/4040-1/Third Party Advisory
https://usn.ubuntu.com/4040-2/Third Party Advisory
https://www.debian.org/security/2019/dsa-4472Third Party Advisory
https://www.oracle.com/security-alerts/cpuApr2021.htmlPatch, Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2020.htmlPatch, Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2020.htmlPatch, Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.htmlPatch, Third Party Advisory
https://www.tenable.com/security/tns-2021-11Third Party Advisory

Timeline

Published: Jun 24, 2019
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2018-20843?

How severe is CVE-2018-20843?

CVE-2018-20843 has a CVSS score of 7.5/10 (HIGH severity). The EPSS model estimates a 7.11% probability of exploitation in the next 30 days.

How do I fix CVE-2018-20843?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2018-20843?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST