Skip to main content

libexpat CVE-2026-45186

| EUVDEUVD-2026-28985 HIGH
Inefficient Algorithmic Complexity (CWE-407)
2026-05-10 mitre GHSA-r396-2q2c-pjhr
Denial Of Service Libexpat Libexpat Project
High
Disputed · 7.5 NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Locate network XML-parsing endpoint
  2. Delivery
    Craft XML element with many colliding attributes
  3. Exploit
    Submit moderately sized document
  4. Execution
    Trigger quadratic collision check in libexpat
  5. Impact
    Exhaust CPU and deny service

Vulnerability Assessment

Weakness
CWE
CWE-407
ASVS 5.0
V2 - Validation and Business Logic Algorithmic complexity limits
Exploitation Conditions

Exploitation requires that the target application pass attacker-controlled XML to libexpat (versions before 2.8.1) and that the crafted document contain an element with a large number of colliding attribute names to trigger the quadratic collision-check path. No authentication, no user interaction, and no special build option are required (CVSS PR:N/UI:N/AC:L), so any default-configured deployment that parses untrusted XML over the network is exploitable. The practical limiting factor is reachability: the attacker must be able to deliver XML into a libexpat-backed parser, so services that only parse trusted/internal XML, that impose strict attribute-count or input-size limits, or that already run 2.8.1+ are not exposed. Impact is confined to availability (CPU exhaustion / DoS); there is no data disclosure or code execution.
Impact

The signals are internally consistent and point to a real-but-bounded availability risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) indicates remote, unauthenticated, low-complexity exploitation with no user interaction, but impact is restricted to availability (A:H) with no confidentiality or integrity loss - this is purely a DoS, not RCE. CISA SSVC reinforces a moderate posture: Exploitation=none (no observed exploitation), Automatable=no, and Technical Impact=partial, which together would typically yield a 'Track' rather than 'Act' decision. EPSS is 0.00% (0th percentile), and the CVE is not in CISA KEV, so there is no evidence of widespread or active exploitation. The notable counter-signal is that public PoC code exists (a gist), so weaponization effort is low even though no campaigns are observed. Net: prioritize patching anywhere libexpat parses untrusted/attacker-controlled XML on a network-reachable path, but this is not a confidentiality/integrity emergency. Note the tension between A:H and SSVC Technical Impact=partial - A:H denotes high availability impact while SSVC scores it partial; treat the practical impact as service-level CPU exhaustion rather than total system compromise.
Exploit ScenarioDerived

An attacker identifies a network-facing service (for example an API, SOAP/XML endpoint, or SAML/config ingest path) that parses externally supplied XML with a vulnerable libexpat. They submit a single moderately sized XML document containing an element with a large collection of colliding attribute names, causing the parser to spend excessive CPU on duplicate-attribute checks and stalling or exhausting the worker. Public PoC code exists (a gist demonstrating the input), lowering the effort to reproduce, and the low-complexity unauthenticated vector means repeated requests can degrade or deny the service.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv5 – Jun 30, 2026

Denial of service in libexpat before 2.8.1 lets remote attackers exhaust CPU by submitting moderately sized crafted XML whose elements contain many colliding attribute names, triggering quadratic-time behavior in the parser's duplicate-attribute detection. Affects the widely embedded Expat C XML parsing library; publicly available exploit code exists (a proof-of-concept gist), though EPSS is 0.00% and the issue is not in CISA KEV, indicating no observed in-the-wild exploitation. CVSS 7.5 reflects availability-only impact with no confidentiality or integrity exposure.

Earlier versions of this analysis (4)
v4 Jun 30, 2026 - 04:22 cvss changed CVSS 7.5

Denial of service in the libexpat XML parser (all versions before 2.8.1) lets remote attackers exhaust CPU by submitting moderately sized crafted XML whose elements contain attribute names engineered to collide during the parser's duplicate-attribute detection. Because the collision check has poor computational complexity (CWE-407), a small input produces disproportionate processing cost, degrading or stalling any service that parses untrusted XML through Expat. Publicly available exploit code exists, but EPSS is 0.00% and CISA's SSVC rates exploitation as none with only partial technical impact.

v3 Jun 30, 2026 - 04:22 cvss changed CVSS 7.5

Denial of service in libexpat before 2.8.1 lets remote unauthenticated attackers exhaust CPU by submitting moderately sized crafted XML whose attribute names trigger worst-case algorithmic complexity in the parser's name-collision checks (CWE-407). Any application linking the vulnerable Expat library to parse untrusted XML is exposed; publicly available exploit code exists (a hartwork proof-of-concept gist), though EPSS is 0.00% and there is no public exploit identified as actively exploited. The flaw causes availability impact only, with no confidentiality or integrity exposure.

v2 Jun 30, 2026 - 04:19 cvss changed CVSS 7.5

Denial of service in libexpat before 2.8.1 lets remote unauthenticated attackers exhaust CPU by submitting moderately sized crafted XML whose attribute names trigger algorithmically expensive collision checks. The flaw is an algorithmic-complexity issue (CWE-407) with availability-only impact; publicly available exploit code exists, though EPSS is 0.00% and it is not on CISA KEV. Red Hat has shipped fixes and the upstream patch landed for the 2.8.1 release.

v1 May 10, 2026 - 07:15 CVSS 2.9

Denial of service in libexpat before 2.8.1 allows local attackers to cause excessive CPU consumption through moderately sized crafted XML input containing duplicate attribute definitions. The vulnerability exploits quadratic algorithmic complexity in attribute name collision checks (CWE-407), enabling denial of service with non-interactive local access. No public exploit code or active exploitation has been identified; this is a low-severity DoS requiring local access on a system parsing untrusted XML.

RemediationAI

Upgrade libexpat to version 2.8.1 or later (Vendor-released patch: libexpat 2.8.1), which fixes the attribute-collision complexity; the upstream change is in GitHub PR https://github.com/libexpat/libexpat/pull/1216. On enterprise Linux, apply the corresponding distribution updates rather than rebuilding from source - for Red Hat consume the relevant errata (RHSA-2026:22715, 22721, 23230, 26319, 27201, 29197) and consult the VEX at https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45186.json to confirm which shipped components are impacted, and remember to restart or redeploy any long-running services (and language runtimes such as Python) that have the old library mapped into memory. Where immediate patching is impossible and XML originates from untrusted sources, apply compensating controls: enforce strict input-size and per-element attribute-count limits at the application or gateway layer to reject documents with abnormally many attributes (trade-off: may reject unusual-but-legitimate XML), constrain CPU/time per parse via request timeouts or sandboxing of parser workers (trade-off: adds latency and operational complexity), and restrict or authenticate the network endpoints that accept XML so anonymous remote submission is blocked (trade-off: reduces but does not eliminate exposure for authenticated clients).

Affected VersionsENISA

libexpat 0 <2.8.1

Affected Packages

euvd libexpat fix: 2.8.1

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

libexpat (Expat) is a stream-oriented, non-validating XML parser written in C that is embedded across countless applications and language runtimes (e.g. Python's xml.parsers.expat, Perl, PHP, and many native packages). The root cause is CWE-407 (Inefficient Algorithmic Complexity): when parsing a start tag, Expat must ensure no attribute name is duplicated, and the collision-checking routine scales poorly - approximately O(n^2) - with the number of attributes on a single element. An attacker who supplies an element with a large set of colliding/near-colliding attribute names forces disproportionate CPU work relative to the small input size, so even a moderately sized document (not a billion-laughs-style expansion) drives the parser into a long compute loop. The affected CPE is cpe:2.3:a:libexpat_project:libexpat, all versions prior to 2.8.1.

Know when Libexpat gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Low–High)
NVD PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI 7.5 HIGH

Untrusted XML reaches the parser remotely without auth or interaction (AV:N/AC:L/PR:N/UI:N); impact is CPU-exhaustion DoS only, so C:N/I:N/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE 2.9 LOW
AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Red Hat 7.5 HIGH

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

8
Analysis Updated
Jun 30, 2026 - 04:23 vuln.today
v5 - CVSS changed
Analysis Updated
Jun 30, 2026 - 04:22 vuln.today
v4 - CVSS changed
Analysis Updated
Jun 30, 2026 - 04:22 vuln.today
v3 - CVSS changed
Analysis Updated
Jun 30, 2026 - 04:19 vuln.today
v2 - CVSS changed
Severity Changed
Jun 30, 2026 - 03:24 NVD
LOW HIGH
CVSS changed
Jun 30, 2026 - 03:24 NVD
2.9 (LOW) 7.5 (HIGH)
Patch available
May 10, 2026 - 08:01 EUVD
CVE Published
May 10, 2026 - 06:36 nvd
LOW 2.9

DescriptionNVD

In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input.

Executive ViewAI

Why It Matters

The widely-embedded Expat XML parsing library (libexpat) versions before 2.8.1 contain a denial-of-service vulnerability that could disrupt services across any organization whose applications depend on it. A vendor patch is available and should be deployed urgently across the infrastructure, given the library's ubiquity in production systems. Publicly available exploit code exists, though current indicators show no active exploitation.

Business Impact: High
Compensating Controls

Apply vendor patch: libexpat 2.8.1.

Threat Intelligence Overview

EPSS Score
0.0%
Top 100% exploitable
Prevalence
Ubiquitous
Expat is embedded in countless apps, OS packages, and language runtimes
Exploit
POC
Public exploit code exists
Data Quality
8 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment MSRC Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC Yes
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact
High
Technical Impact
Partial

Priority Score

58
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: +20
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Libexpat

View all
CVE-2022-25315 CRITICAL POC
9.8 Feb 18

In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames. Rated critical severity (CVSS 9.8),
CVE-2025-59375 HIGH POC
7.5 Sep 15

libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is
CVE-2019-15903 HIGH POC
7.5 Sep 04

In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too
CVE-2026-93990 HIGH POC
8.7 Sep 19

Malformed UTF-16 decoding in libexpat through 2.8.4 lets remote attackers hide XML markup from the parser: a lone high s
CVE-2026-115506 HIGH POC
8.7 Oct 22

CPU exhaustion in libexpat through 2.9.0 lets remote attackers stall XML parsing workloads by supplying a moderately siz
CVE-2022-43680 HIGH POC
7.5 Oct 24

In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEnti
CVE-2024-28757 HIGH POC
7.5

Alpine Linux: expat fixed in 2.6.2-r0
CVE-2017-9233 HIGH POC
7.5 Jul 25

XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows attackers to put the p
CVE-2013-0340 MEDIUM POC
6.8 Jan 21

expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetE
CVE-2016-0718 CRITICAL
9.8 May 26

Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a m
CVE-2024-45492 CRITICAL
9.8 Aug 30

An issue was discovered in libexpat before 2.6.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exp
CVE-2024-45491 CRITICAL
9.8 Aug 30

An issue was discovered in libexpat before 2.6.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exp

Same weakness CWE-407 – Inefficient Algorithmic Complexity

View all
CVE-2026-90776 HIGH POC
8.7
CVE-2026-59094 HIGH POC
8.7
CVE-2026-54284 HIGH POC
8.7
CVE-2022-45061 HIGH POC
7.5
CVE-2026-71321 HIGH POC
7.5
CVE-2026-59887 HIGH POC
7.5
CVE-2026-73643 HIGH POC
7.5
CVE-2026-59870 HIGH POC
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Low
Product Status
SUSE Liberty Linux 10 Fixed
SUSE Liberty Linux 8 Fixed
SUSE Liberty Linux 9 Fixed
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-45186 ADVISORY https://seclists.org/oss-sec/2026/q3/630 ADVISORY https://ubuntu.com/security/notices/USN-8790-1 ADVISORY https://vuldb.com/vuln/362489 REF http://www.openwall.com/lists/oss-security/2026/05/11/16 REF https://access.redhat.com/errata/RHSA-2026:22715 REF https://access.redhat.com/errata/RHSA-2026:22721 REF https://access.redhat.com/errata/RHSA-2026:23230 REF https://access.redhat.com/errata/RHSA-2026:26319 REF https://access.redhat.com/errata/RHSA-2026:27201 REF https://access.redhat.com/errata/RHSA-2026:29197 REF https://access.redhat.com/errata/RHSA-2026:58981 REF https://access.redhat.com/security/cve/CVE-2026-45186 REF https://bugzilla.redhat.com/show_bug.cgi?id=2468575 REF https://cert-portal.siemens.com/productcert/html/ssa-082556.html REF https://github.com/libexpat/libexpat/pull/1216 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45186.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy