EUVD-2026-23276Severity by source
AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
AV:N reflects libexpat's common role parsing network-sourced XML; AC:H retained for salt-prediction complexity; C:N and I:N confirmed by CWE-331 scope.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
6DescriptionCVE.org
libexpat before 2.7.6 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document.
AnalysisAI
Hash flooding denial-of-service in libexpat before 2.7.6 stems from the existing SipHash-based collision protection consuming only 4-8 bytes of salt entropy (constrained by the width of unsigned long) when the SipHash implementation supports a full 16-byte key - reducing the effective salt space and enabling a knowledgeable attacker to craft XML documents with deliberately colliding element or attribute names. All libexpat versions from 0 through 2.7.5 are affected per CPE cpe:2.3:a:libexpat_project:libexpat. No active exploitation has been confirmed (no CISA KEV listing), EPSS sits at 0.01% (2nd percentile), and SSVC designates exploitation as none and the flaw as non-automatable, placing real-world urgency firmly in the low tier.
Technical ContextAI
libexpat (CPE: cpe:2.3:a:libexpat_project:libexpat) is a widely embedded C library for streaming XML parsing, consumed by Python (via pyexpat), PHP, and numerous system packages. Its hash collision defense uses SipHash internally, which supports a 128-bit (16-byte) key. The root cause is CWE-331 (Insufficient Entropy): the legacy XML_SetHashSalt API accepted only an unsigned long argument - 4 bytes on 32-bit platforms, 8 bytes on 64-bit platforms - leaving 8-12 bytes of the SipHash key unpopulated and therefore contributing no entropy. An attacker who can narrow the effective salt space can engineer XML names that land in the same hash bucket, producing pathological O(n²) lookup chains. The upstream fix in PR #1183 introduces XML_SetHashSalt16Bytes (versioned symbol LIBEXPAT_2.7.6) consuming the full 16-byte key, and formally deprecates XML_SetHashSalt. Per the changelog, any application that explicitly calls XML_SetHashSalt should now be treated as introducing a vulnerability.
RemediationAI
Upgrade to libexpat 2.7.6 or later; this is the vendor-released patch confirmed by upstream PR #1183 (https://github.com/libexpat/libexpat/pull/1183) and the Expat release blog at https://blog.hartwork.org/posts/expat-2-8-0-released/. Any application code that explicitly calls XML_SetHashSalt should be migrated to XML_SetHashSalt16Bytes using a high-quality entropy source such as getentropy(3) - or should omit both calls entirely, allowing Expat 2.7.6's internal machinery to auto-generate a full 16-byte salt. Continuing to call XML_SetHashSalt after upgrading is itself considered a vulnerability per the upstream changelog. For environments where immediate patching is not feasible, restricting the size and structural complexity of XML inputs accepted from untrusted sources (e.g., enforcing document size limits at the application or WAF layer) reduces the attacker's ability to saturate hash buckets, though this has operational trade-offs for legitimate large-payload workflows. Siemens-specific remediation should follow SSA-082556.
In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames. Rated critical severity (CVSS 9.8),
XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows attackers to put the p
libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is
Denial of service in libexpat before 2.8.1 lets remote attackers exhaust CPU by submitting moderately sized crafted XML
In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEnti
In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too
expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetE
Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a m
An issue was discovered in libexpat before 2.6.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exp
An issue was discovered in libexpat before 2.6.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exp
Denial of service in libexpat through 2.8.3 stems from quadratic CPU complexity in the storeAtts() XML attribute process
Out-of-bounds read in libexpat through 2.8.3 allows remote unauthenticated attackers to crash any application that parse
Same weakness CWE-331 – Insufficient Entropy
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today