CVE-2012-0876

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 5.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2012-07-03 · updated 2026-06-16
Weakness: CWE-400

Description

The XML parser (xmlparse.c) in expat before 2.1.0 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via an XML file with many identifiers with the same value.

Affected products

Canonical Ubuntu Linux: 8.04, 10.04, 11.04, 11.10, 12.04
Debian Linux: 6.0, 7.0
libexpat project libexpat: before 2.1.0 — fixed in 2.1.0
Oracle Corporation Solaris Operating System: 11.3
Python: from 2.6.0 before 2.6.8; from 2.7.0 before 2.7.3; from 3.1.0 before 3.1.5; from 3.2.0 before 3.2.3 — fixed in 2.6.8, 2.7.3, 3.1.5, 3.2.3
RedHat Enterprise Linux Desktop: 5.0, 6.0
RedHat Enterprise Linux Eus: 6.2
RedHat Enterprise Linux Server: 5.0, 6.0
RedHat Enterprise Linux Server Aus: 6.2
RedHat Enterprise Linux Workstation: 5.0, 6.0
RedHat Storage: 2.0

How to fix

Upgrade to a fixed version: libexpat project libexpat 2.1.0; Python 2.6.8, 2.7.3, 3.1.5, 3.2.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2012-0876 or the next vulnerability affects your stack