Denial of Service Vulnerability in Expat XML Parser by Libexpat
CVE-2026-66046

8.7HIGH

Key Information:

Vendor

Libexpat Project

Status
Libexpat
Vendor
CVE Published:
18 August 2026

What is CVE-2026-66046?

Expat XML Parser, specifically versions up to 2.8.3, has a denial of service vulnerability attributed to quadratic algorithmic complexity within the storeAtts() function. This vulnerability allows a remote unauthenticated attacker to craft a specially-formatted XML document that, when processed, causes significant CPU resource consumption due to inefficient handling of N non-normalized attributes. This results in a denial of service as the application struggles with escalating resource demands, all without the necessity for user authentication or advanced parser configurations.

Affected Version(s)

libexpat 0 <= 2.8.3

References

https://github.com/libexpat/libexpat/pull/1321
issue-tracking
https://www.vulncheck.com/advisories/expat-denial-of-serv...
third-party-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Fabian Wahle (Hap Security)
Sebastian Pipping
VulnCheck
.