# CVE-2026-113351: libexpat denial of service via XML_ParserReset byte count inconsistency

Source: https://junglewise.ai/threats/cve-2026-113351-libexpat-2-7-2-through-2-9-0-contains-a-denial-of-service  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-20. Updated: 2026-10-20  
License: CC BY 4.0 with a link back

CVE-2026-113351 · Severity: medium · CVSS 5.9 · Published 2026-10-20

libexpat is a widely-used XML parsing library embedded in many applications and operating systems. A flaw in the XML_ParserReset function causes it to lose track of memory allocations, allowing attackers to submit large XML documents that exhaust parser resources. Subsequent documents processed with the same parser will fail with out-of-memory errors, causing denial of service until the parser is recreated.

Technologies: [Libexpat](https://junglewise.ai/threats/technologies/libexpat-libexpat). Vendors: [Libexpat](https://junglewise.ai/threats/vendors/libexpat).

## Quick answers

**Is CVE-2026-113351 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-113351 being exploited in the wild.

**How severe is CVE-2026-113351?** Medium severity, with a CVSS score of 5.9, published 20 October 2026.

**Which products and versions are affected?** Libexpat 2.7.2 through 2.9.0.

**Is there a fix for CVE-2026-113351?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-113351 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-113351?** Check whether you run Libexpat at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

XML_ParserReset zeroes the direct byte count but fails to adjust tracked heap allocations, creating an inconsistency in memory tracking. An attacker can send a large XML document to consume heap memory, and when the parser is reset, the byte count is cleared while the heap allocations remain tracked, causing later parsing attempts to fail with XML_ERROR_NO_MEMORY. No user interaction or authentication is required; the vulnerability is reachable over the network by any entity that can submit XML to a vulnerable parser.

## Affected products

- libexpat libexpat 2.7.2 through 2.9.0

## Timeline

- 2026-10-20: disclosed

## References

- [https://github.com/libexpat/libexpat](https://github.com/libexpat/libexpat)
- [https://github.com/libexpat/libexpat/blob/a76b1174c1ea52abb639a4c69d52b630a8a106a2/expat/lib/xmlparse.c](https://github.com/libexpat/libexpat/blob/a76b1174c1ea52abb639a4c69d52b630a8a106a2/expat/lib/xmlparse.c)

## Related threats

- [libexpat out-of-bounds read in unknown encoding handlers](https://junglewise.ai/threats/cve-2026-124317-libexpat-through-2-10-0-contains-an-out-of-bounds-read)
- [libexpat NULL pointer dereference in external entity parsing](https://junglewise.ai/threats/cve-2026-117610-libexpat-through-2-9-0-contains-a-null-pointer-dereference)
- [libexpat denial of service in billion laughs protection](https://junglewise.ai/threats/cve-2026-115506-libexpat-through-2-9-0-contains-a-denial-of-service)