peter bassill · operator
$ cve CVE-2009-2473 JSON

CVE-2009-2473 EXPLOIT

4.3
MEDIUM · CVSS 2.0 · EPSS 8.4% (pctl 95)

Patch early

A public exploit exists.

Description

neon before 0.28.6, when expat is used, does not properly detect recursion during entity expansion, which allows context-dependent attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.

Scoring

CVSS4.3 (MEDIUM, v2.0)
VectorAV:N/AC:M/Au:N/C:N/I:N/A:P
EPSS8.44% — more likely to be exploited than 95% of all CVEs
WeaknessCWE-399
On CISA KEVno
Public exploityes
Published2009-08-21
Last modified2026-06-16

Affected (1)

VendorProduct
webdavneon

Public exploits

SourceTitleDate
exploit-dbExpat 2.0.1 - UTF-8 Character XML Parsing Remote Denial of Service2009-11-12

References

→ the Explorer  ·  watch your stack  ·  NVD