# CVE-2026-41080: libexpat insufficient entropy for hash salt in XML parsing

Source: https://junglewise.ai/threats/cve-2026-41080-libexpat-insufficient-entropy-for-hash-salt-in-xml-parsing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-16. Updated: 2026-06-12  
License: CC BY 4.0 with a link back

CVE-2026-41080 · Severity: low · CVSS 2.9 · Published 2026-04-16

libexpat is a widely used software library for processing XML data in various applications and operating systems. A security flaw in how it handles internal data organization could allow an attacker to slow down or crash a service by sending a specially crafted XML file. This type of 'hash flooding' attack primarily impacts the availability of the affected system.

Technologies: [Libexpat Project Libexpat](https://junglewise.ai/threats/technologies/libexpat). Vendors: [Libexpat Project](https://junglewise.ai/threats/vendors/libexpat-project).

## Quick answers

**Is CVE-2026-41080 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-41080 being exploited in the wild.

**How severe is CVE-2026-41080?** Low severity, with a CVSS score of 2.9, published 16 April 2026.

**Which products and versions are affected?** Libexpat Project Libexpat < 2.8.0.

**Is there a fix for CVE-2026-41080?** A patch was published on 2026-04-24: Expat 2.8.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-41080 attacked?** It is attacked over the network or with local access, in a software library.

**Am I affected by CVE-2026-41080?** Check whether you run Libexpat Project Libexpat at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

libexpat before version 2.8.0 is vulnerable to hash flooding due to insufficient entropy (CWE-331) used for its internal hash salt. The library previously used only 4 to 8 bytes of entropy, which could allow an attacker to predict hash collisions and trigger a denial-of-service (DoS) condition by providing a crafted XML document. Version 2.8.0 addresses this by increasing entropy to 16 bytes, adding support for the getentropy(3) provider, and introducing the XML_SetHashSalt16Bytes API. While some assessments suggest a network vector, the primary CNA assessment rates this as a low-severity local attack requiring high complexity.

## Affected products

- libexpat project libexpat < 2.8.0

## Timeline

- 2026-04-16: disclosed
- 2026-04-16: advisory
- 2026-04-24: patched: Expat 2.8.0 released

## References

- [https://blog.hartwork.org/posts/expat-2-8-0-released/](https://blog.hartwork.org/posts/expat-2-8-0-released/)
- [https://github.com/libexpat/libexpat/issues/47](https://github.com/libexpat/libexpat/issues/47)
- [https://github.com/libexpat/libexpat/pull/1183](https://github.com/libexpat/libexpat/pull/1183)
- [https://www.openwall.com/lists/oss-security/2026/04/26/1](https://www.openwall.com/lists/oss-security/2026/04/26/1)
- [http://www.openwall.com/lists/oss-security/2026/04/26/1](http://www.openwall.com/lists/oss-security/2026/04/26/1)

## Related threats

- [libexpat use-after-free in custom encoding callbacks](https://junglewise.ai/threats/cve-2026-76957-libexpat-use-after-free-in-custom-encoding-callbacks)
- [libexpat hash flooding denial of service via mishandled entropy generation](https://junglewise.ai/threats/cve-2026-76956-libexpat-hash-flooding-denial-of-service-via-mishandled-entropy)
- [Expat XML parser denial of service via quadratic complexity](https://junglewise.ai/threats/cve-2026-66046-expat-xml-parser-denial-of-service-via-quadratic-complexity)
- [Python CPython denial of service in XML parsers](https://junglewise.ai/threats/cve-2026-7210-python-cpython-denial-of-service-in-xml-parsers)
- [libexpat denial of service via attribute name collision check](https://junglewise.ai/threats/cve-2026-45186-libexpat-denial-of-service-via-attribute-name-collision-check)