Junglewise Threat Intelligence

CVE-2026-45186: libexpat denial of service via attribute name collision check

CVE-2026-45186 · Severity: low · CVSS 2.9 · Published 2026-05-10

Technologies: Red Hat Enterprise Linux, Libexpat Project Expat, Libexpat Project Libexpat. Vendors: Red Hat, Libexpat Project.

Executive brief

libexpat is a widely used software library for processing XML data. A vulnerability in how it handles XML attributes allows an attacker to crash or slow down applications by sending a specially crafted, moderately sized XML file. This can lead to a denial of service, impacting the availability of web services and applications that rely on this library for data processing.

Technical details

A vulnerability classified as Inefficient Algorithmic Complexity (CWE-407) exists in libexpat's attribute name collision check mechanism. The root cause is quadratic runtime behavior triggered when parsing XML input with a large number of attributes. An unauthenticated remote attacker can exploit this by providing a moderately sized, crafted XML document, leading to excessive CPU consumption and a denial of service (DoS). While some initial reports suggested a low severity, the maintainers and Red Hat have identified the attack vector as network-based with low complexity, resulting in a CVSS score of 7.5. The issue is resolved in libexpat version 2.8.1.

Affected products

  • libexpat project libexpat before 2.8.1
  • Red Hat Enterprise Linux 6, 7, 8, 9, 10
  • Red Hat JBoss Core Services 2.4.62.SP4

Timeline

  • 2026-05-08: other: Fixing pull request submitted to GitHub
  • 2026-05-10: patched: libexpat 2.8.1 released
  • 2026-05-10: disclosed: Vulnerability disclosed and CVE assigned
  • 2026-06-03: advisory: Red Hat issued security advisories for multiple products

References

Related threats