CVE-2009-3720: The updatePosition function in lib/xmltok_impl.c in libexpat in Expat 2.0.1, as used in Python, PyXML, w3c-...

Security readout for executives and security teams

CVE-2009-3720 is a denial-of-service flaw in Expat 2.0.1 XML parsing. A specially crafted XML document with malformed UTF-8 can crash applications that embed or depend on vulnerable libexpat, including some Python-related stacks and other software. Exposure is most likely in legacy systems, appliances, embedded products, or packaged applications that include Expat 2.0.1 or vulnerable vendor backports. The CVE affected data is incomplete, so verify by package inventory and vendor advisories rather than product names alone. Treat as a cleanup and resilience issue unless a critical service parses untrusted XML with vulnerable Expat. The business risk is service crash and availability loss, especially in older externally exposed systems. Mitigation focus: Inventory systems and applications that include libexpat or bundled Expat code.; Apply applicable vendor updates from OS or application maintainers.; Prioritize externally reachable services that parse untrusted XML..

Prepared

Jun 28, 2026, 18:15 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.