CVE-2012-1148

What it actually does

Memory leak in poolGrow during entity expansion in XML parsing causes unbounded memory consumption from crafted inputs that trigger repeated reallocation failures.

Why it matters to the business

Applications processing untrusted XML can exhaust available memory and become unavailable, disrupting dependent services and operations; the vulnerability is old with low exploitation likelihood and affects specific provisioner packages.

How an attack unfolds

An attacker supplies a large number of specially crafted XML documents that force repeated entity expansion attempts; each attempt fails to properly release memory on reallocation error, gradually consuming resources until the process terminates or becomes unresponsive.

How to fix it

Upgrade dynamic-localpv-provisioner (Chainguard) and dynamic-localpv-provisioner (Wolfi) to version 4.0.0-r3 or later; rebuild and redeploy any containers or images that embed the affected package.

How to confirm the fix worked

Confirm the installed package version meets or exceeds the fixed release; run regression tests that feed large numbers of entity-expansion XML payloads and monitor memory usage for leaks.

Typical attack path

1. Identify a network-accessible service that parses XML using the vulnerable expat library
2. Generate or obtain multiple crafted XML files designed to trigger entity-expansion reallocation failures
3. Send the files in rapid succession or in high volume to the target service
4. Observe progressive memory growth until the process crashes or is killed by the OS

How to detect it

Review process memory and resource-usage logs for sustained growth correlated with XML parsing activity; examine application error logs for repeated reallocation failures inside expat; because public exploitation is unknown, focus on post-upgrade verification rather than historical indicators.

What your security team should do

• Apply the 4.0.0-r3 update to all affected provisioner deployments immediately
• Scan container images and SBOMs for any remaining instances of expat before 2.1.0
• Add memory-usage monitoring and alerting for XML-processing workloads
• Review ingress points that accept XML and apply strict size or entity-expansion limits where possible