CVE-2011-2188: LuaExpat before 1.2.0 does not properly detect recursion during entity expansion, which allows remote attac...

Security readout for executives and security teams

LuaExpat before 1.2.0 can be forced to consume excessive CPU and memory while expanding nested XML entities. The practical business risk is service disruption in applications that accept XML from users or external systems. The source bundle does not indicate code execution, data theft, or confirmed active exploitation. Exposure is most likely where Lua applications use LuaExpat before 1.2.0 to parse untrusted XML, especially in public APIs, import pipelines, integrations, or message-processing services. The bundle’s affected-product metadata is incomplete, so inventory confirmation is required. Prioritize if internet-facing or business-critical services parse XML using LuaExpat. Otherwise, handle through normal dependency remediation. The main risk is outage, not known compromise, based on the provided sources. Mitigation focus: Upgrade LuaExpat to 1.2.0 or later where present.; Follow relevant vendor or distribution guidance for packaged LuaExpat versions.; Restrict untrusted XML ingestion where LuaExpat cannot be updated promptly..

Prepared

Jun 28, 2026, 00:52 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.