Description (CNA)
In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| libexpat project / libexpat | affected 0 before 2.8.1 |
CWE
CWE-407
References
ADP enrichment
No English description supplied.
No references supplied.
No English description supplied.
A flaw was found in libexpat. When processing a specially crafted XML input containing a specific pattern of attributes, the parsing time increases quadratically due to checks for attribute name collisions. This consumes excessive CPU resources and eventually results in a denial of service.
- https://access.redhat.com/security/cve/CVE-2026-45186
- https://bugzilla.redhat.com/show_bug.cgi?id=2468575
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45186.json
- https://access.redhat.com/errata/RHSA-2026:22715
- https://access.redhat.com/errata/RHSA-2026:23230
- https://access.redhat.com/errata/RHSA-2026:22721
- https://access.redhat.com/errata/RHSA-2026:29197
- https://access.redhat.com/errata/RHSA-2026:27201
- https://access.redhat.com/errata/RHSA-2026:58981
- https://access.redhat.com/errata/RHSA-2026:26319
No English description supplied.