libexpat CVE-2026-76956

Exploitation requires two concurrent conditions: (1) the target must be running libexpat 2.8.2 or 2.8.3 specifically, and (2) getentropy() must have returned a non-zero (failure) value during libexpat's hash seed initialization - this is the trigger that causes the inverted boolean to silently accept bad entropy. The getentropy() syscall fails in specific environments: heavily sandboxed containers with seccomp filters blocking getrandom, certain early-boot contexts, or systems where /dev/urandom is unavailable. In standard Linux userspace, getentropy() typically succeeds, meaning the vulnerability is latent but not always triggered. Once the seed is predictable, any attacker who can submit arbitrary XML to the application satisfies the remaining condition - no authentication, elevated privilege, or non-default application configuration is required. The impact is strictly limited to availability; no confidentiality or integrity exploitation path exists.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H and score of 7.5 accurately model the threat: the attack is network-reachable, requires no authentication or user interaction, and the sole impact is availability (A:H), consistent with hash flooding. No EPSS score was provided in the input data, so probabilistic exploitation likelihood cannot be quantified from this dataset. There is no CISA KEV listing, meaning active exploitation has not been confirmed; no public POC was identified, though the patch diff in PR #1326 is public and hash flooding techniques are widely understood, lowering the bar for independent exploit development. The real-world blast radius exceeds what a single libexpat CPE suggests, because the library is bundled into Python, PHP, and many Linux packages - even a mid-sized municipal IT team in olsztyn managing a mixed Python/PHP web tier would be affected without necessarily knowing libexpat is present. The primary mitigating factor is that exploitation requires getentropy() to have silently failed at initialization time, which is not the common case in standard Linux environments but is realistic in certain container, sandbox, or early-boot scenarios.

An unauthenticated remote attacker identifies a web service that accepts XML input and is backed by libexpat 2.8.2 or 2.8.3 running in an environment where getentropy() failed at startup (e.g., a seccomp-restricted container), leaving the hash seed at a predictable value. The attacker pre-computes a set of XML element names or attribute keys that all collide into the same hash bucket given the known seed, then submits a crafted XML document to the endpoint. The server's XML parsing degrades to O(n²) hash collision resolution, consuming CPU until the service becomes unresponsive or the process is killed by the OS.