CVE-2017-9233

What it actually does

The vulnerability allows an attacker to supply a malformed external entity definition via an external DTD, causing the Expat XML parser to enter an infinite loop and consume CPU resources indefinitely, resulting in denial of service.

Why it matters to the business

Applications relying on the vulnerable XML parser can be rendered unresponsive, leading to service outages, degraded performance, and the need for manual restarts or resource limits; widespread use in libraries and tools increases exposure across many systems despite the age of the issue.

How an attack unfolds

An attacker crafts an XML document containing a specially malformed external entity reference sourced from an external DTD and submits it to any application using the vulnerable Expat parser; the parser processes the definition and enters an unrecoverable infinite loop, denying service without requiring authentication or user interaction.

How to fix it

Upgrade libexpat to a version newer than 2.2.0; for affected packages apply python/cpython (GIT) fix ca079a3ea30098aff3197c559a0e32d42dda6d84, grype (Chainguard) 0.74.4-r1, or grype (Wolfi) 0.74.4-r1; where possible, configure parsers to disable external entity resolution.

How to confirm the fix worked

Verify the installed libexpat version is newer than 2.2.0; attempt to reproduce the infinite-loop condition with a test malformed DTD payload under controlled conditions and confirm the process terminates or rejects the input.

Typical attack path

1. Identify an application endpoint or input that accepts XML data processed by Expat
2. Craft a malicious XML payload with a malformed external entity definition in an external DTD
3. Deliver the payload over the network to the target parser
4. Trigger repeated parsing to sustain resource exhaustion

How to detect it

Search application and system logs for XML parsing events coinciding with sudden high CPU utilization on parser processes; examine inbound XML traffic for external entity references; review process dumps or resource monitors for non-terminating loops during XML handling.

What your security team should do

• Prioritize patching all instances of libexpat and dependent packages to the listed fixed versions
• Implement input validation and parser hardening to reject external DTDs by default
• Monitor for high sustained CPU usage in XML-processing services
• Review and restrict network-accessible XML endpoints