CVE-2024-8176 describes a vulnerability in libexpat where recursive entity expansion in XML documents is not properly restricted, allowing an attacker to cause uncontrolled recursion and stack overflow. This can crash applications using libexpat or potentially lead to memory corruption. The vulnerability has a CVSS 3.1 base score of 7.5 (high) with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts availability. Red Hat advisories confirm the issue and provide patches in updated packages for Red Hat JBoss Core Services Apache HTTP Server and Red Hat Enterprise Linux 9.4 Extended Update Support. The vendor advisories include detailed remediation instructions and confirm the availability of fixes.

The vulnerability can cause denial of service by crashing applications that parse maliciously crafted XML documents with deeply nested entity references. In some environments, it may also lead to exploitable memory corruption. The impact is limited to availability and potentially integrity depending on exploitation. There are no confirmed reports of active exploitation in the wild. The vulnerability affects software using libexpat, including Red Hat JBoss Core Services and Red Hat Enterprise Linux distributions.

Official patches are available from Red Hat for affected products, including Red Hat JBoss Core Services Apache HTTP Server 2.4.62 SP1 and Red Hat Enterprise Linux 9.4 Extended Update Support. Users should apply these updates as soon as possible following vendor guidance. The vendor advisories provide detailed instructions and download links for the updated packages. No additional mitigation is required beyond applying the official fixes.