CVE-2026-66046
published 2026-08-18CVE-2026-66046: Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where…
PriorityP345high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.74%
54.4th percentile
Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an O(N^2) linear scan of elementType->defaultAtts to determine CDATA status. A remote unauthenticated attacker can supply a single well-formed XML document of a few megabytes to an application parsing untrusted XML to cause excessive CPU consumption, resulting in denial of service without requiring authentication, external entity resolution, or non-default parser options.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | expat | — | — |
| debian | xmlrpc-c | — | — |
| libexpat | libexpat | <= 2.8.3 | — |
| libexpat_project | libexpat | <= 2.8.3 | — |
| mozilla | firefox | — | — |
| mozilla | thunderbird | — | — |
| openshift | ose-rhel-coreos-8 | — | — |
| openshift | ose-rhel-coreos-9 | — | — |
| ubuntu | expat | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv4.08.7HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat7.5HIGH
vendor_ubuntu4.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Expat vulnerabilities
vendor_ubuntu·2026-09-24·CVSS 4.9
CVE-2026-56410 [MEDIUM] Expat vulnerabilities
Title: Expat vulnerabilities
Summary: Expat could be made to crash or run programs if it received specially
crafted input.
It was discovered that Expat did not correctly handle certain integer
arithmetic. An attacker could possibly use this issue to cause a denial of
service.
(CVE-2026-56406, CVE-2026-56407, CVE-2026-56409, CVE-2026-56410, CVE-2026-56411)
It was discovered that Expat did not correctly track handler call depth. An
attacker could possibly use this issue to cause Expat to crash or execute
arbitrary code. (CVE-2026-56131)
It was discovered that Expat did not correctly handle certain memory
operations. An attacker could possibly use this issue to cause Expat to
crash or execute arbitrary code. (CVE-2026-56132)
It was discovered that Expat did not correctly handle certain U
Red Hat
expat: Expat: Denial of Service via XML external entity parsing
vendor_redhat·2026-08-20·CVSS 7.5
CVE-2026-76641 [HIGH] CWE-125 expat: Expat: Denial of Service via XML external entity parsing
expat: Expat: Denial of Service via XML external entity parsing
Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory corruption by processing XML with external entity parsers created via XML_ExternalEntityParserCreate. A struct size mismatch between ELEMENT_TYPE members causes storeAtts to read the attIndex member past allocated memory boundaries, resulting in failure to normalize whitespace in non-CDATA attributes or a wild pointer dereference causing a segfault. This vulnerability was introduced by the fix for CVE-2026-66046.
A flaw was found in Expat. Attackers can exploit an out-of-bounds read vulnerability by processing XML with external entity parsers created via XML_ExternalEntityParserCreate. This can lead to memory corruption.
Red Hat
expat: Expat: Denial of Service via quadratic complexity in attribute processing
vendor_redhat·2026-08-18·CVSS 7.5
CVE-2026-66046 [HIGH] CWE-407 expat: Expat: Denial of Service via quadratic complexity in attribute processing
expat: Expat: Denial of Service via quadratic complexity in attribute processing
Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an O(N^2) linear scan of elementType->defaultAtts to determine CDATA status. A remote unauthenticated attacker can supply a single well-formed XML document of a few megabytes to an application parsing untrusted XML to cause excessive CPU consumption, resulting in denial of service without requiring authentication, external entity resolution, or non-default parser options.
A flaw was found in the Expat XML parsing library. A remote, unauthenticated attacker can supply a specially crafted
GHSA
Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory corruption by processing XML with external entity parsers created via XML_ExternalEntityParserC
ghsa_unreviewed·2026-08-20·CVSS 7.5
CVE-2026-76641 [HIGH] CWE-125 Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory corruption by processing XML with external entity parsers created via XML_ExternalEntityParserC
Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory corruption by processing XML with external entity parsers created via XML_ExternalEntityParserCreate. A struct size mismatch between ELEMENT_TYPE members causes storeAtts to read the attIndex member past allocated memory boundaries, resulting in failure to normalize whitespace in non-CDATA attributes or a wild pointer dereference causing a segfault. This vulnerability was introduced by the fix for CVE-2026-66046.
GHSA
Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-no
ghsa_unreviewed·2026-08-18
CVE-2026-66046 [HIGH] CWE-407 Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-no
Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an O(N^2) linear scan of elementType->defaultAtts to determine CDATA status. A remote unauthenticated attacker can supply a single well-formed XML document of a few megabytes to an application parsing untrusted XML to cause excessive CPU consumption, resulting in denial of service without requiring authentication, external entity resolution, or non-default parser options.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-76641 mingw-expat: Expat: Denial of Service via XML external entity parsing [fedora-all]
bugzilla·2026-09-24·CVSS 7.5
CVE-2026-76641 [HIGH] CVE-2026-76641 mingw-expat: Expat: Denial of Service via XML external entity parsing [fedora-all]
CVE-2026-76641 mingw-expat: Expat: Denial of Service via XML external entity parsing [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory corruption by processing XML with external entity parsers created via XML_ExternalEntityParserCreate. A struct size mismatch between ELEMENT_TYPE members causes storeAtts to read the attIndex member past allocated memory boundaries, resulting in failure to normalize whitespace in non-CDATA attributes or a wild pointer dereference causing a segfault. This vulnerability
Bugzilla
CVE-2026-76641 expat: Expat: Denial of Service via XML external entity parsing [fedora-all]
bugzilla·2026-09-24·CVSS 7.5
CVE-2026-76641 [HIGH] CVE-2026-76641 expat: Expat: Denial of Service via XML external entity parsing [fedora-all]
CVE-2026-76641 expat: Expat: Denial of Service via XML external entity parsing [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory corruption by processing XML with external entity parsers created via XML_ExternalEntityParserCreate. A struct size mismatch between ELEMENT_TYPE members causes storeAtts to read the attIndex member past allocated memory boundaries, resulting in failure to normalize whitespace in non-CDATA attributes or a wild pointer dereference causing a segfault. This vulnerability was in
Bugzilla
CVE-2026-66046 mingw-expat: Expat: Denial of Service via quadratic complexity in attribute processing [fedora-all]
bugzilla·2026-09-15·CVSS 7.5
CVE-2026-66046 [HIGH] CVE-2026-66046 mingw-expat: Expat: Denial of Service via quadratic complexity in attribute processing [fedora-all]
CVE-2026-66046 mingw-expat: Expat: Denial of Service via quadratic complexity in attribute processing [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an O(N^2) linear scan of elementType->defaultAtts to determine CDATA status. A remote unauthenticated attacker can supply a single well-formed XML document of a few megabytes to an application parsing untrusted XML to cause excessive
Bugzilla
CVE-2026-66046 expat: Expat: Denial of Service via quadratic complexity in attribute processing [fedora-all]
bugzilla·2026-09-15·CVSS 7.5
CVE-2026-66046 [HIGH] CVE-2026-66046 expat: Expat: Denial of Service via quadratic complexity in attribute processing [fedora-all]
CVE-2026-66046 expat: Expat: Denial of Service via quadratic complexity in attribute processing [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an O(N^2) linear scan of elementType->defaultAtts to determine CDATA status. A remote unauthenticated attacker can supply a single well-formed XML document of a few megabytes to an application parsing untrusted XML to cause excessive CPU co
Bugzilla
CVE-2026-76641 expat: Expat: Denial of Service via XML external entity parsing
bugzilla·2026-08-20·CVSS 7.5
CVE-2026-76641 [HIGH] CVE-2026-76641 expat: Expat: Denial of Service via XML external entity parsing
CVE-2026-76641 expat: Expat: Denial of Service via XML external entity parsing
Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory corruption by processing XML with external entity parsers created via XML_ExternalEntityParserCreate. A struct size mismatch between ELEMENT_TYPE members causes storeAtts to read the attIndex member past allocated memory boundaries, resulting in failure to normalize whitespace in non-CDATA attributes or a wild pointer dereference causing a segfault. This vulnerability was introduced by the fix for CVE-2026-66046.
Bugzilla
CVE-2026-66046 expat: Expat: Denial of Service via quadratic complexity in attribute processing
bugzilla·2026-08-18·CVSS 7.5
CVE-2026-66046 [HIGH] CVE-2026-66046 expat: Expat: Denial of Service via quadratic complexity in attribute processing
CVE-2026-66046 expat: Expat: Denial of Service via quadratic complexity in attribute processing
Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an O(N^2) linear scan of elementType->defaultAtts to determine CDATA status. A remote unauthenticated attacker can supply a single well-formed XML document of a few megabytes to an application parsing untrusted XML to cause excessive CPU consumption, resulting in denial of service without requiring authentication, external entity resolution, or non-default parser options.
2026-08-18
Published