{"url":"http://public2.vulnerablecode.io/api/packages/1036516?format=json","purl":"pkg:deb/debian/poco@1.3.2%2Bdfsg1-3","type":"deb","namespace":"debian","name":"poco","version":"1.3.2+dfsg1-3","qualifiers":{},"subpath":"","is_vulnerable":true,"next_non_vulnerable_version":"1.14.2-6","latest_non_vulnerable_version":"1.14.2-6","affected_by_vulnerabilities":[{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/20646?format=json","vulnerability_id":"VCID-2yhr-1v3n-p7a4","summary":"Integer Overflow or Wraparound\nUTF32Encoding.cpp in POCO has a Poco::UTF32Encoding integer overflow and resultant stack buffer overflow because Poco::UTF32Encoding::convert() and Poco::UTF32::queryConvert() may return a negative integer if a UTF-32 byte sequence evaluates to a value of 0x80000000 or higher. This is fixed in 1.11.8p2, 1.12.5p2, and 1.13.0.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2023-52389","reference_id":"","reference_type":"","scores":[{"value":"0.00132","scoring_system":"epss","scoring_elements":"0.3267","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00132","scoring_system":"epss","scoring_elements":"0.32659","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00132","scoring_system":"epss","scoring_elements":"0.32707","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00132","scoring_system":"epss","scoring_elements":"0.32733","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00132","scoring_system":"epss","scoring_elements":"0.32734","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00132","scoring_system":"epss","scoring_elements":"0.32697","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00132","scoring_system":"epss","scoring_elements":"0.32801","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00132","scoring_system":"epss","scoring_elements":"0.32837","published_at":"2026-04-04T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2023-52389"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-52389","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-52389"},{"reference_url":"https://github.com/pocoproject/poco/compare/poco-1.12.5p2-release...poco-1.13.0-release","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2025-05-09T23:34:09Z/"}],"url":"https://github.com/pocoproject/poco/compare/poco-1.12.5p2-release...poco-1.13.0-release"},{"reference_url":"https://github.com/pocoproject/poco/issues/4320","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2025-05-09T23:34:09Z/"}],"url":"https://github.com/pocoproject/poco/issues/4320"},{"reference_url":"https://pocoproject.org/blog/?p=1226","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2025-05-09T23:34:09Z/"}],"url":"https://pocoproject.org/blog/?p=1226"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52389","reference_id":"CVE-2023-52389","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52389"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/1053517?format=json","purl":"pkg:deb/debian/poco@1.11.0-3%2Bdeb12u1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-546e-svdf-fyac"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:deb/debian/poco@1.11.0-3%252Bdeb12u1"}],"aliases":["CVE-2023-52389"],"risk_score":4.4,"exploitability":"0.5","weighted_severity":"8.8","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-2yhr-1v3n-p7a4"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/3717?format=json","vulnerability_id":"VCID-4zzy-q5zp-jkgm","summary":"A buffer over-read flaw was found in the bundled expat library. An attacker who is able to get Apache to parse an untrused XML document (for example through mod_dav) may be able to cause a crash. This crash would only be a denial of service if using the worker MPM.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2009-3720.json","reference_id":"","reference_type":"","scores":[],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2009-3720.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2009-3720","reference_id":"","reference_type":"","scores":[{"value":"0.01541","scoring_system":"epss","scoring_elements":"0.81381","published_at":"2026-04-12T12:55:00Z"},{"value":"0.01541","scoring_system":"epss","scoring_elements":"0.8131","published_at":"2026-04-01T12:55:00Z"},{"value":"0.01541","scoring_system":"epss","scoring_elements":"0.81319","published_at":"2026-04-02T12:55:00Z"},{"value":"0.01541","scoring_system":"epss","scoring_elements":"0.81341","published_at":"2026-04-04T12:55:00Z"},{"value":"0.01541","scoring_system":"epss","scoring_elements":"0.81339","published_at":"2026-04-07T12:55:00Z"},{"value":"0.01541","scoring_system":"epss","scoring_elements":"0.81368","published_at":"2026-04-08T12:55:00Z"},{"value":"0.01541","scoring_system":"epss","scoring_elements":"0.81373","published_at":"2026-04-13T12:55:00Z"},{"value":"0.01541","scoring_system":"epss","scoring_elements":"0.81394","published_at":"2026-04-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2009-3720"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3720","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3720"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=531697","reference_id":"531697","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=531697"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=551936","reference_id":"551936","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=551936"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=560919","reference_id":"560919","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=560919"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=560920","reference_id":"560920","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=560920"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=560921","reference_id":"560921","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=560921"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=560922","reference_id":"560922","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=560922"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=560926","reference_id":"560926","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=560926"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=560927","reference_id":"560927","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=560927"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=560928","reference_id":"560928","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=560928"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=560929","reference_id":"560929","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=560929"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=560930","reference_id":"560930","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=560930"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=560935","reference_id":"560935","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=560935"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=560936","reference_id":"560936","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=560936"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=560937","reference_id":"560937","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=560937"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=560940","reference_id":"560940","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=560940"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=560942","reference_id":"560942","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=560942"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=560950","reference_id":"560950","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=560950"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=601053","reference_id":"601053","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=601053"},{"reference_url":"https://httpd.apache.org/security/json/CVE-2009-3720.json","reference_id":"CVE-2009-3720","reference_type":"","scores":[{"value":"low","scoring_system":"apache_httpd","scoring_elements":""}],"url":"https://httpd.apache.org/security/json/CVE-2009-3720.json"},{"reference_url":"https://security.gentoo.org/glsa/201209-06","reference_id":"GLSA-201209-06","reference_type":"","scores":[],"url":"https://security.gentoo.org/glsa/201209-06"},{"reference_url":"https://access.redhat.com/errata/RHSA-2009:1572","reference_id":"RHSA-2009:1572","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2009:1572"},{"reference_url":"https://access.redhat.com/errata/RHSA-2009:1625","reference_id":"RHSA-2009:1625","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2009:1625"},{"reference_url":"https://access.redhat.com/errata/RHSA-2010:0002","reference_id":"RHSA-2010:0002","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2010:0002"},{"reference_url":"https://access.redhat.com/errata/RHSA-2011:0491","reference_id":"RHSA-2011:0491","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2011:0491"},{"reference_url":"https://access.redhat.com/errata/RHSA-2011:0492","reference_id":"RHSA-2011:0492","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2011:0492"},{"reference_url":"https://access.redhat.com/errata/RHSA-2017:3239","reference_id":"RHSA-2017:3239","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2017:3239"},{"reference_url":"https://usn.ubuntu.com/890-1/","reference_id":"USN-890-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/890-1/"},{"reference_url":"https://usn.ubuntu.com/890-2/","reference_id":"USN-890-2","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/890-2/"},{"reference_url":"https://usn.ubuntu.com/890-3/","reference_id":"USN-890-3","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/890-3/"},{"reference_url":"https://usn.ubuntu.com/890-4/","reference_id":"USN-890-4","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/890-4/"},{"reference_url":"https://usn.ubuntu.com/890-5/","reference_id":"USN-890-5","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/890-5/"},{"reference_url":"https://usn.ubuntu.com/890-6/","reference_id":"USN-890-6","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/890-6/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/1036517?format=json","purl":"pkg:deb/debian/poco@1.3.6p1-1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2yhr-1v3n-p7a4"},{"vulnerability":"VCID-7pjn-2s13-d7by"},{"vulnerability":"VCID-9tkd-v4dq-2bd4"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:deb/debian/poco@1.3.6p1-1"}],"aliases":["CVE-2009-3720"],"risk_score":1.1,"exploitability":"0.5","weighted_severity":"2.1","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-4zzy-q5zp-jkgm"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/92560?format=json","vulnerability_id":"VCID-7pjn-2s13-d7by","summary":"The Poco::Net::X509Certificate::verify method in the NetSSL library in POCO C++ Libraries before 1.4.6p4 allows man-in-the-middle attackers to spoof SSL servers via crafted DNS PTR records that are requested during comparison of a server name to a wildcard domain name in an X.509 certificate.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2014-0350","reference_id":"","reference_type":"","scores":[{"value":"0.002","scoring_system":"epss","scoring_elements":"0.42077","published_at":"2026-04-01T12:55:00Z"},{"value":"0.002","scoring_system":"epss","scoring_elements":"0.42136","published_at":"2026-04-02T12:55:00Z"},{"value":"0.002","scoring_system":"epss","scoring_elements":"0.42164","published_at":"2026-04-09T12:55:00Z"},{"value":"0.002","scoring_system":"epss","scoring_elements":"0.42103","published_at":"2026-04-07T12:55:00Z"},{"value":"0.002","scoring_system":"epss","scoring_elements":"0.42153","published_at":"2026-04-08T12:55:00Z"},{"value":"0.002","scoring_system":"epss","scoring_elements":"0.42186","published_at":"2026-04-11T12:55:00Z"},{"value":"0.002","scoring_system":"epss","scoring_elements":"0.42149","published_at":"2026-04-12T12:55:00Z"},{"value":"0.002","scoring_system":"epss","scoring_elements":"0.42123","published_at":"2026-04-13T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2014-0350"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0350","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0350"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=746637","reference_id":"746637","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=746637"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/1036519?format=json","purl":"pkg:deb/debian/poco@1.3.6p1-5","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2yhr-1v3n-p7a4"},{"vulnerability":"VCID-9tkd-v4dq-2bd4"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:deb/debian/poco@1.3.6p1-5"}],"aliases":["CVE-2014-0350"],"risk_score":null,"exploitability":"0.5","weighted_severity":"0.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-7pjn-2s13-d7by"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/63564?format=json","vulnerability_id":"VCID-9tkd-v4dq-2bd4","summary":"security update","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2017-1000472","reference_id":"","reference_type":"","scores":[{"value":"0.0046","scoring_system":"epss","scoring_elements":"0.64127","published_at":"2026-04-13T12:55:00Z"},{"value":"0.0046","scoring_system":"epss","scoring_elements":"0.64157","published_at":"2026-04-12T12:55:00Z"},{"value":"0.0046","scoring_system":"epss","scoring_elements":"0.64046","published_at":"2026-04-01T12:55:00Z"},{"value":"0.0046","scoring_system":"epss","scoring_elements":"0.64103","published_at":"2026-04-02T12:55:00Z"},{"value":"0.0046","scoring_system":"epss","scoring_elements":"0.6413","published_at":"2026-04-04T12:55:00Z"},{"value":"0.0046","scoring_system":"epss","scoring_elements":"0.64089","published_at":"2026-04-07T12:55:00Z"},{"value":"0.0046","scoring_system":"epss","scoring_elements":"0.6414","published_at":"2026-04-08T12:55:00Z"},{"value":"0.0046","scoring_system":"epss","scoring_elements":"0.64156","published_at":"2026-04-09T12:55:00Z"},{"value":"0.0046","scoring_system":"epss","scoring_elements":"0.64167","published_at":"2026-04-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2017-1000472"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000472","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000472"},{"reference_url":"https://github.com/pocoproject/poco/issues/1968","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/pocoproject/poco/issues/1968"},{"reference_url":"https://lists.debian.org/debian-lts-announce/2018/01/msg00013.html","reference_id":"","reference_type":"","scores":[],"url":"https://lists.debian.org/debian-lts-announce/2018/01/msg00013.html"},{"reference_url":"https://www.debian.org/security/2018/dsa-4083","reference_id":"","reference_type":"","scores":[],"url":"https://www.debian.org/security/2018/dsa-4083"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:pocoproject:poco:*:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:pocoproject:poco:*:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:pocoproject:poco:*:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*","reference_id":"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*","reference_id":"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2017-1000472","reference_id":"CVE-2017-1000472","reference_type":"","scores":[{"value":"5.8","scoring_system":"cvssv2","scoring_elements":"AV:N/AC:M/Au:N/C:N/I:P/A:P"},{"value":"6.5","scoring_system":"cvssv3","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-1000472"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/1036520?format=json","purl":"pkg:deb/debian/poco@1.3.6p1-5%2Bdeb8u1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2yhr-1v3n-p7a4"},{"vulnerability":"VCID-9tkd-v4dq-2bd4"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:deb/debian/poco@1.3.6p1-5%252Bdeb8u1"},{"url":"http://public2.vulnerablecode.io/api/packages/1037666?format=json","purl":"pkg:deb/debian/poco@1.7.6%2Bdfsg1-5%2Bdeb9u1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2yhr-1v3n-p7a4"},{"vulnerability":"VCID-9tkd-v4dq-2bd4"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:deb/debian/poco@1.7.6%252Bdfsg1-5%252Bdeb9u1"},{"url":"http://public2.vulnerablecode.io/api/packages/1053515?format=json","purl":"pkg:deb/debian/poco@1.9.0-5","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2yhr-1v3n-p7a4"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:deb/debian/poco@1.9.0-5"}],"aliases":["CVE-2017-1000472"],"risk_score":3.0,"exploitability":"0.5","weighted_severity":"5.9","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-9tkd-v4dq-2bd4"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/3716?format=json","vulnerability_id":"VCID-qtav-hqnd-b7fa","summary":"A buffer over-read flaw was found in the bundled expat library. An attacker who is able to get Apache to parse an untrused XML document (for example through mod_dav) may be able to cause a crash. This crash would only be a denial of service if using the worker MPM.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2009-3560.json","reference_id":"","reference_type":"","scores":[],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2009-3560.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2009-3560","reference_id":"","reference_type":"","scores":[{"value":"0.0283","scoring_system":"epss","scoring_elements":"0.86182","published_at":"2026-04-11T12:55:00Z"},{"value":"0.0283","scoring_system":"epss","scoring_elements":"0.86111","published_at":"2026-04-01T12:55:00Z"},{"value":"0.0283","scoring_system":"epss","scoring_elements":"0.86121","published_at":"2026-04-02T12:55:00Z"},{"value":"0.0283","scoring_system":"epss","scoring_elements":"0.86137","published_at":"2026-04-07T12:55:00Z"},{"value":"0.0283","scoring_system":"epss","scoring_elements":"0.86156","published_at":"2026-04-08T12:55:00Z"},{"value":"0.0283","scoring_system":"epss","scoring_elements":"0.86168","published_at":"2026-04-09T12:55:00Z"},{"value":"0.03311","scoring_system":"epss","scoring_elements":"0.87253","published_at":"2026-04-13T12:55:00Z"},{"value":"0.03311","scoring_system":"epss","scoring_elements":"0.87257","published_at":"2026-04-12T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2009-3560"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3560","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3560"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=533174","reference_id":"533174","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=533174"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=560901","reference_id":"560901","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=560901"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=560919","reference_id":"560919","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=560919"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=560920","reference_id":"560920","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=560920"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=560921","reference_id":"560921","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=560921"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=560922","reference_id":"560922","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=560922"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=560926","reference_id":"560926","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=560926"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=560927","reference_id":"560927","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=560927"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=560928","reference_id":"560928","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=560928"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=560929","reference_id":"560929","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=560929"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=560930","reference_id":"560930","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=560930"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=560935","reference_id":"560935","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=560935"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=560936","reference_id":"560936","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=560936"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=560937","reference_id":"560937","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=560937"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=560940","reference_id":"560940","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=560940"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=560942","reference_id":"560942","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=560942"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=601053","reference_id":"601053","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=601053"},{"reference_url":"https://httpd.apache.org/security/json/CVE-2009-3560.json","reference_id":"CVE-2009-3560","reference_type":"","scores":[{"value":"low","scoring_system":"apache_httpd","scoring_elements":""}],"url":"https://httpd.apache.org/security/json/CVE-2009-3560.json"},{"reference_url":"https://security.gentoo.org/glsa/201209-06","reference_id":"GLSA-201209-06","reference_type":"","scores":[],"url":"https://security.gentoo.org/glsa/201209-06"},{"reference_url":"https://access.redhat.com/errata/RHSA-2009:1625","reference_id":"RHSA-2009:1625","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2009:1625"},{"reference_url":"https://access.redhat.com/errata/RHSA-2017:3239","reference_id":"RHSA-2017:3239","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2017:3239"},{"reference_url":"https://usn.ubuntu.com/890-1/","reference_id":"USN-890-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/890-1/"},{"reference_url":"https://usn.ubuntu.com/890-2/","reference_id":"USN-890-2","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/890-2/"},{"reference_url":"https://usn.ubuntu.com/890-3/","reference_id":"USN-890-3","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/890-3/"},{"reference_url":"https://usn.ubuntu.com/890-4/","reference_id":"USN-890-4","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/890-4/"},{"reference_url":"https://usn.ubuntu.com/890-5/","reference_id":"USN-890-5","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/890-5/"},{"reference_url":"https://usn.ubuntu.com/890-6/","reference_id":"USN-890-6","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/890-6/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/1036517?format=json","purl":"pkg:deb/debian/poco@1.3.6p1-1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2yhr-1v3n-p7a4"},{"vulnerability":"VCID-7pjn-2s13-d7by"},{"vulnerability":"VCID-9tkd-v4dq-2bd4"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:deb/debian/poco@1.3.6p1-1"}],"aliases":["CVE-2009-3560"],"risk_score":1.1,"exploitability":"0.5","weighted_severity":"2.1","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-qtav-hqnd-b7fa"}],"fixing_vulnerabilities":[],"risk_score":"4.4","resource_url":"http://public2.vulnerablecode.io/packages/pkg:deb/debian/poco@1.3.2%252Bdfsg1-3"}