CVE-2026-41080: libexpat insufficient entropy for hash salt in XML parsing

Executive brief

libexpat is a widely used software library for processing XML data in various applications and operating systems. A security flaw in how it handles internal data organization could allow an attacker to slow down or crash a service by sending a specially crafted XML file. This type of 'hash flooding' attack primarily impacts the availability of the affected system.

Technical details

libexpat before version 2.8.0 is vulnerable to hash flooding due to insufficient entropy (CWE-331) used for its internal hash salt. The library previously used only 4 to 8 bytes of entropy, which could allow an attacker to predict hash collisions and trigger a denial-of-service (DoS) condition by providing a crafted XML document. Version 2.8.0 addresses this by increasing entropy to 16 bytes, adding support for the getentropy(3) provider, and introducing the XML_SetHashSalt16Bytes API. While some assessments suggest a network vector, the primary CNA assessment rates this as a low-severity local attack requiring high complexity.

Affected products

• libexpat project libexpat < 2.8.0

Timeline

• 2026-04-16: disclosed
• 2026-04-16: advisory
• 2026-04-24: patched: Expat 2.8.0 released

References

• https://blog.hartwork.org/posts/expat-2-8-0-released/
• https://github.com/libexpat/libexpat/issues/47
• https://github.com/libexpat/libexpat/pull/1183
• https://www.openwall.com/lists/oss-security/2026/04/26/1
• http://www.openwall.com/lists/oss-security/2026/04/26/1