Vulnerability Database

314,496

Total vulnerabilities in the database

CVE-2009-2473

neon before 0.28.6, when expat is used, does not properly detect recursion during entity expansion, which allows context-dependent attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.

  • Published: Aug 21, 2009
  • Updated: Nov 9, 2025
  • CVE: CVE-2009-2473
  • Severity: Low
  • Exploit:

CVSS v2:

  • Severity: Low
  • Score: 4.3
  • AV:N/AC:M/Au:N/C:N/I:N/A:P

CWEs:

Software From Fixed in
webdav / neon 0.28.6 0.28.6.x