Denial of Service Vulnerability in libexpat Affected by XML Parsing

CVE-2026-113351

What is CVE-2026-113351?

A denial of service vulnerability exists in libexpat versions 2.7.2 through 2.9.0 due to improper handling of heap allocations when resetting the XML parser. Specifically, when XML_ParserReset is invoked, it resets the direct byte count but does not adjust the tracked heap allocations. This behavior allows attackers to submit large XML documents, causing subsequent documents to fail with XML_ERROR_NO_MEMORY. This flaw can lead to service disruption, necessitating parser recreation for continued operation.

References