Skip to main content

libexpat CVE-2026-76956

| EUVDEUVD-2026-63195 MEDIUM
Unexpected Status Code or Return Value (CWE-394)
2026-08-20 mitre GHSA-x282-q22w-c9hm
Denial Of Service Libexpat Suse
5.9
CVSS 3.1 · Vendor: mitre
Share

Severity by source

Vendor (mitre) PRIMARY
5.9 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
7.5 HIGH

Network-reachable XML parsing endpoint requires no authentication or interaction; impact is purely availability via hash flooding with no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

6
Severity Changed
Aug 20, 2026 - 18:22 NVD
HIGH MEDIUM
CVSS changed
Aug 20, 2026 - 18:22 NVD
7.5 (HIGH) 5.9 (MEDIUM)
Patch available
Aug 20, 2026 - 05:01 EUVD
Source Code Evidence Fetched
Aug 20, 2026 - 05:00 vuln.today
Analysis Generated
Aug 20, 2026 - 05:00 vuln.today
CVE Published
Aug 20, 2026 - 04:22 cve.org
HIGH 7.5

DescriptionCVE.org

In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to insufficient entropy, which results in being vulnerable to hash flooding attacks, causing a denial of service via crafted XML content.

AnalysisAI

Hash flooding denial-of-service in libexpat 2.8.2 and 2.8.3 stems from an inverted boolean check on the return value of getentropy(), causing the library to silently proceed with a predictable hash seed whenever the entropy syscall fails. Any network-accessible application that passes attacker-controlled XML through the vulnerable libexpat versions is exposed, since an adversary can craft XML content whose keys collide in libexpat's hash tables, forcing O(n²) lookup behavior and CPU exhaustion. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Identify XML endpoint backed by libexpat 2.8.2-2.8.3
Delivery
Confirm or assume predictable hash seed from failed getentropy
Exploit
Pre-compute XML keys colliding in same hash bucket
Execution
Submit crafted XML document to endpoint
Persist
Trigger O(n²) hash table traversal
Impact
Exhaust server CPU causing denial of service
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires two concurrent conditions: (1) the target must be running libexpat 2.8.2 or 2.8.3 specifically, and (2) getentropy() must have returned a non-zero (failure) value during libexpat's hash seed initialization - this is the trigger that causes the inverted boolean to silently accept bad entropy. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H and score of 7.5 accurately model the threat: the attack is network-reachable, requires no authentication or user interaction, and the sole impact is availability (A:H), consistent with hash flooding. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An unauthenticated remote attacker identifies a web service that accepts XML input and is backed by libexpat 2.8.2 or 2.8.3 running in an environment where getentropy() failed at startup (e.g., a seccomp-restricted container), leaving the hash seed at a predictable value. The attacker pre-computes a set of XML element names or attribute keys that all collide into the same hash bucket given the known seed, then submits a crafted XML document to the endpoint. …
Remediation Upgrade libexpat to version 2.8.4, which corrects the inverted return-code check in random_getentropy.c as documented in https://github.com/libexpat/libexpat/pull/1326. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, conduct a comprehensive inventory of systems and applications using libexpat 2.8.2 or 2.8.3, including transitive dependencies in container images and build pipelines. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Libexpat

View all
CVE-2022-25315 CRITICAL POC
9.8 Feb 18

In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames. Rated critical severity (CVSS 9.8),
CVE-2017-9233 HIGH POC
7.5 Jul 25

XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows attackers to put the p
CVE-2026-45186 HIGH POC
7.5 May 10

Denial of service in libexpat before 2.8.1 lets remote attackers exhaust CPU by submitting moderately sized crafted XML

CVE-2022-43680 HIGH POC
7.5 Oct 24

In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEnti
CVE-2019-15903 HIGH POC
7.5 Sep 04

In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too
CVE-2013-0340 MEDIUM POC
6.8 Jan 21

expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetE
CVE-2016-0718 CRITICAL
9.8 May 26

Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a m
CVE-2024-45492 CRITICAL
9.8 Aug 30

An issue was discovered in libexpat before 2.6.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exp
CVE-2024-45491 CRITICAL
9.8 Aug 30

An issue was discovered in libexpat before 2.6.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exp
CVE-2026-66046 HIGH
8.7 Aug 18

Denial of service in libexpat through 2.8.3 stems from quadratic CPU complexity in the storeAtts() XML attribute process
CVE-2026-76641 HIGH
8.7 Aug 20

Out-of-bounds read in libexpat through 2.8.3 allows remote unauthenticated attackers to crash any application that parse
CVE-2016-4472 HIGH
8.1 Jun 30

The overflow protection in Expat is removed by compilers with certain optimization settings, which allows remote attacke

Same weakness CWE-394 – Unexpected Status Code or Return Value

View all
CVE-2024-1713 HIGH POC
7.2
CVE-2026-25085 HIGH
8.6
CVE-2023-25948 HIGH
7.5
CVE-2019-0066 HIGH
7.5
CVE-2025-48510 HIGH
7.1
CVE-2025-22854 MEDIUM
6.9
CVE-2023-28975 MEDIUM
4.6
CVE-2023-48429 LOW
2.7

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 12 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Micro 5.3 Affected
SUSE Linux Enterprise Micro 5.4 Affected

Share

CVE-2026-76956 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy