This vulnerability is caused by an infinite loop that can be triggered when the libexpat library parses DTD content. The resulting denial of service can exhaust CPU resources and potentially cause the application that uses libexpat to become unresponsive, impacting availability. The weakness is identified as CWE‑835: Infinite Loop.

The affected product is libexpat for the libexpat project. No specific affected versions are listed in the provided data, so all releases prior to the fix are potentially susceptible.

The CVSS score is 4, indicating moderate severity, and the EPSS score is below 1%, suggesting a low likelihood of exploitation. This vulnerability is not listed in the CISA KEV catalog. No attack vector is explicitly documented; based on the description, it is inferred that an attacker could cause the denial of service by supplying malicious XML with a DTD that triggers the infinite loop.