CVE-2023-52425 is a high severity (7.5) denial of service in libexpat through 2.5.0. A very large token that needs many buffer fills is reparsed over and over, using up CPU. Upgrade to libexpat 2.6.0 or later, or to a distribution or Python build that bundles it.
What's affected
NVD lists libexpat through 2.5.0. An oss-security post about Python security releases says the bundled libexpat was updated to 2.6.0 to address CVE-2023-52425, in Python 3.10.14, 3.9.19 and 3.8.19. That is my confirmation of 2.6.0 as the fixed upstream version.
The upstream change is pull request 789, merged on 30 January 2024, titled "Speed up parsing of big tokens". It added new controls for the deferral behavior, and the Python release notes say these were exposed as new APIs.
Weakness class: CWE-400.
Expat is everywhere: XML parsers in Python, PHP, Apache, Firefox, many language runtimes and embedded software. Many of these bundle their own copy, so the system package is only one place to look.
How to check if you're exposed
Check the system library first.
dpkg -l libexpat1
rpm -q expat
For Python, the interpreter reports its bundled version.
python3 -c "import pyexpat; print(pyexpat.EXPAT_VERSION)"
Anything printing 2.5.0 or lower needs attention. Then look for vendored copies in application directories and container images. You can run a free in-browser dependency scan at gold.safeguard.sh/scan to see which of your projects pull this component in, directly or through another package.
What to do now
- Upgrade libexpat to 2.6.0 or later, or install your distribution security update.
- Update Python to a release that bundles the fixed expat, such as 3.10.14, 3.9.19 or 3.8.19 or later in those lines.
- Rebuild applications that bundle expat statically.
- Limit the size of XML you accept from untrusted sources, and set request time limits on parsing services.
Why it matters
The upstream pull request explains the cause. When expat parses a really big token that needs multiple buffer fills, it has to reparse the token from the start each time, which takes more and more time. The fix adds a heuristic: after failing on the same token several times, it defers further parsing until much more data is available.
That makes the cost of a hostile document much smaller. The class is resource consumption, so the impact is a stalled process and not code execution. The record shows the CVE is not in the CISA Known Exploited Vulnerabilities catalog.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which libexpat version fixes CVE-2023-52425?
Version 2.6.0. The oss-security post on the Python releases states the bundled copy was updated to 2.6.0 for this CVE.
Is Python affected?
Python bundles expat in some builds, and the fixed Python releases include 2.6.0. Check pyexpat.EXPAT_VERSION on yours.
Sources
Last reviewed: 19 October 2026.
