CVE-2026-76956 — libexpat project / libexpat

CVE-2026-76956

libexpat project / libexpat PUBLISHED

Description (CNA)

In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to insufficient entropy, which results in being vulnerable to hash flooding attacks, causing a denial of service via crafted XML content.

Affected (CNA)

Vendor / product	Versions
libexpat project / libexpat	affected 2.8.2 before 2.8.4

CWE

CWE-394

References

https://github.com/libexpat/libexpat/pull/1326
https://github.com/libexpat/libexpat/pull/1329

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.