CVE-2021-45960
In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., allocating too…
Published Jan 1, 2022 · updated Oct 14, 2026 · libexpat project libexpat
In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memory).
Timeline
Detection, updates, and resolution for this record.
Jan 1, 2022 · NIST NVD
Detected
In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memory).
Oct 14, 2026 · NIST NVD
Updated
In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memory).
Affected
- cpe debian/debian linux10.0
- cpe debian/debian linux11.0
- cpe libexpat project/libexpatversion unspecified
- cpe netapp/active iq unified managerversion unspecified
- cpe netapp/hci baseboard management controllerh610c
- cpe siemens/sinema remote connect serverversion unspecified
- cpe tenable/nessusversion unspecified
Sources
- CVE.orgCVE-2021-45960
Official CVE identifier
cve.org - NIST NVDCVE-2021-45960
In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memory).
nvd.nist.gov