CVE-2025-59375: Libexpat DOS Vulnerability

CVE-2025-59375 Overview

CVE-2025-59375 is a Resource Exhaustion vulnerability affecting libexpat, the widely-used XML parsing library maintained by the libexpat project. The vulnerability allows remote attackers to trigger disproportionately large dynamic memory allocations by submitting specially crafted small XML documents for parsing. This memory exhaustion attack can lead to denial of service conditions on systems utilizing vulnerable versions of libexpat.

The vulnerability was identified through the OSS-Fuzz continuous fuzzing infrastructure and affects libexpat versions prior to 2.7.2. Given the widespread adoption of libexpat across numerous applications, operating systems, and embedded devices that require XML parsing capabilities, the potential impact of this vulnerability is significant.

Critical Impact

Attackers can exhaust system memory resources and cause denial of service by sending minimal XML payloads that trigger excessive memory allocation in vulnerable libexpat versions.

Affected Products

• libexpat_project libexpat (versions prior to 2.7.2)

Discovery Timeline

• 2025-09-15 - CVE CVE-2025-59375 published to NVD
• 2025-11-04 - Last updated in NVD database

Technical Details for CVE-2025-59375

Vulnerability Analysis

This vulnerability is classified as CWE-770 (Allocation of Resources Without Limits or Throttling). The core issue lies in libexpat's handling of certain XML document structures that can cause the parser to allocate memory in a manner disproportionate to the input size.

When processing specific XML constructs, the parser fails to properly limit or validate the amount of memory being allocated relative to the actual document content. This creates an amplification scenario where a maliciously crafted XML document of minimal size can trigger memory allocations orders of magnitude larger than the input.

The vulnerability is network-exploitable, requiring no authentication or user interaction to trigger. Any application that parses untrusted XML content using a vulnerable version of libexpat could be affected.

Root Cause

The root cause stems from insufficient resource allocation controls within the XML parsing logic. The parser's memory allocation routines do not adequately constrain memory consumption relative to input document size, allowing attackers to craft inputs that maximize the ratio of allocated memory to document bytes. This design oversight enables a classic amplification-based denial of service attack.

Attack Vector

The attack can be executed remotely over the network by any unauthenticated attacker who can submit XML content for parsing. The attacker crafts a small, specially structured XML document designed to exploit the memory allocation amplification weakness.

When the target application parses this malicious document using a vulnerable version of libexpat, the library allocates excessive amounts of memory. This can rapidly consume available system resources, leading to application crashes, system instability, or complete denial of service for legitimate users.

The attack is particularly effective because the small document size means that rate-limiting or input size restrictions may not prevent exploitation. For detailed technical information about the vulnerability mechanism, see the GitHub Issue #1018 and OSS-Fuzz Issue #439133977.

Detection Methods for CVE-2025-59375

Indicators of Compromise

• Unusual memory consumption spikes in processes utilizing libexpat for XML parsing
• Application crashes or out-of-memory errors occurring during XML document processing
• Abnormally small XML documents being submitted to XML parsing endpoints
• Memory allocation failures logged by applications using libexpat

Detection Strategies

• Monitor system and application memory usage patterns for sudden, unexplained increases correlated with XML processing activities
• Implement application-level logging to track XML document sizes versus processing resource consumption
• Deploy intrusion detection rules to identify patterns of small XML documents submitted in high volume to parsing endpoints
• Use SentinelOne's behavioral AI to detect anomalous memory allocation patterns indicative of resource exhaustion attacks

Monitoring Recommendations

• Enable memory profiling and alerting for applications that process XML from untrusted sources
• Configure resource limits (cgroups, ulimits) on processes that use libexpat to contain potential memory exhaustion
• Review application logs for patterns of XML parsing failures or memory-related errors
• Implement endpoint monitoring to detect denial of service conditions affecting libexpat-dependent services

How to Mitigate CVE-2025-59375

Immediate Actions Required

• Upgrade libexpat to version 2.7.2 or later immediately on all affected systems
• Identify all applications and dependencies that utilize libexpat for XML parsing
• Implement resource limits on processes that parse untrusted XML content
• Review and restrict network access to XML parsing services where possible

Patch Information

The libexpat project has released version 2.7.2 which addresses this vulnerability. The fix was implemented via Pull Request #1034. Complete changelog information is available in the GitHub Version 2.7.2 Changes documentation.

Organizations should prioritize updating libexpat across all systems, including direct installations and applications that bundle the library. For additional context on the security fix, consult the OpenWall Security Discussion.

Workarounds

• Implement strict memory limits on processes that perform XML parsing using cgroups or container resource constraints
• Deploy input validation to reject or quarantine XML documents from untrusted sources pending review
• Consider using application-level XML processing timeouts and resource quotas where supported
• Isolate XML parsing services into separate processes or containers to limit blast radius

# Configuration example - Limit memory for XML processing service
# Using systemd service limits
[Service]
MemoryLimit=512M
MemoryHigh=400M

# Using ulimit in shell scripts
ulimit -v 524288  # Limit virtual memory to 512MB