EUVD-2026-28985
Inefficient Algorithmic Complexity (CWE-407)
GHSA-r396-2q2c-pjhr
2.9
CVSS 3.1
CVSS VectorNVD
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Attack Vector
Local
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low
Lifecycle Timeline
4
Patch available
May 10, 2026 - 08:01 EUVD
Source Code Evidence Fetched
May 10, 2026 - 07:15 vuln.today
Analysis Generated
May 10, 2026 - 07:15 vuln.today
CVE Published
May 10, 2026 - 06:36 nvd
LOW 2.9
DescriptionNVD
In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input.
AnalysisAI
Denial of service in libexpat before 2.8.1 allows local attackers to cause excessive CPU consumption through moderately sized crafted XML input containing duplicate attribute definitions. The vulnerability exploits quadratic algorithmic complexity in attribute name collision checks (CWE-407), enabling denial of service with non-interactive local access. …
Sign in for full analysis, threat intelligence, and remediation guidance.
Share
External POC / Exploit Code
Leaving vuln.today
Destination URL
POC code from unknown sources may be malicious, contain backdoors, or be fake.
Always review and test exploit code in a safe, isolated environment (VM/sandbox).
Verify the source reputation and cross-reference with known databases (Exploit-DB, GitHub Security).