libexpat CVE-2026-66046

Exploitation requires the target application to accept untrusted XML and pass it synchronously to libexpat for parsing via a network-accessible interface. The attacker must be able to deliver a moderately sized XML document-on the order of a few megabytes-containing a large number of element attributes with non-normalized values; no authentication, external entity resolution, or non-default parser options are needed. If the endpoint accepts compression-wrapped XML (e.g., gzip via Content-Encoding), the minimum viable payload size is significantly reduced, per the upstream advisory. Exploitation is limited by: (1) the target application must expose XML parsing to unauthenticated or lightly restricted network callers; (2) the quadratic effect requires sufficient attribute count, bounded by the allowed request size; and (3) asynchronous or rate-limited XML ingestion pipelines reduce but do not eliminate the DoS impact, since CPU is still consumed in the worker pool.

The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N) accurately reflects the low exploitation bar: no authentication, no complexity, no special trigger beyond a well-formed XML document with many non-normalized attributes. The upstream-stated CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (score 7.5) is consistent with the 4.0 assessment and confirms pure availability impact. No EPSS score was provided in the source data, so exploitation probability cannot be quantified; however, algorithmic complexity DoS vulnerabilities with zero prerequisites historically attract automated probing once details are public, and the PR diff provides enough information for independent reproduction. The absence of a CISA KEV listing and confirmed public exploit code tempers urgency slightly, but the attack pattern's simplicity-a single HTTP POST with crafted XML-means weaponization requires minimal skill. The advisory's explicit note that compression can dramatically shrink the attack payload is operationally significant, enabling viable attacks across rate-limited or body-size-restricted endpoints. Even a mid-sized municipal IT team in inowroclaw operating XML-ingesting microservices should treat this as urgent given libexpat's deep embedding across Python, PHP, and Linux distribution stacks. The DoS-only impact (no C/I) reduces business risk relative to RCE flaws, but service availability is frequently a contractual or safety requirement in API-dependent and operational environments.

An attacker crafts a well-formed XML document of several megabytes containing a large element with many attributes carrying non-normalized values and submits it to any HTTP endpoint-such as an XML-based API or SOAP service-that passes untrusted input directly to libexpat for synchronous parsing. The parser's O(N^2) scan of default attribute metadata pins one or more CPU cores for the duration of the parse, degrading or denying service to concurrent legitimate users without triggering any authentication check or error condition. No public exploit code has been confirmed, but the attack is fully reproducible from the public PR diff and CVE description.