# CVE-2026-45186: libexpat denial of service via attribute name collision check

Source: https://junglewise.ai/threats/cve-2026-45186-libexpat-denial-of-service-via-attribute-name-collision-check  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-10. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-45186 · Severity: low · CVSS 2.9 · Published 2026-05-10

libexpat is a widely used software library for processing XML data. A vulnerability in how it handles XML attributes allows an attacker to crash or slow down applications by sending a specially crafted, moderately sized XML file. This can lead to a denial of service, impacting the availability of web services and applications that rely on this library for data processing.

Technologies: [Libexpat Project Expat](https://junglewise.ai/threats/technologies/expat), [Libexpat Project Libexpat](https://junglewise.ai/threats/technologies/libexpat). Vendors: [Libexpat Project](https://junglewise.ai/threats/vendors/libexpat-project).

## Quick answers

**Is CVE-2026-45186 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-45186 being exploited in the wild.

**How severe is CVE-2026-45186?** Low severity, with a CVSS score of 2.9, published 10 May 2026.

**Which products and versions are affected?** Libexpat Project Expat before 2.8.1.

**Is there a fix for CVE-2026-45186?** A patch was published on 2026-05-10: libexpat 2.8.1 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-45186 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-45186?** Check whether you run Libexpat Project Expat or Libexpat Project Libexpat at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability classified as Inefficient Algorithmic Complexity (CWE-407) exists in libexpat's attribute name collision check mechanism. The root cause is quadratic runtime behavior triggered when parsing XML input with a large number of attributes. An unauthenticated remote attacker can exploit this by providing a moderately sized, crafted XML document, leading to excessive CPU consumption and a denial of service (DoS). While some initial reports suggested a low severity, the maintainers and Red Hat have identified the attack vector as network-based with low complexity, resulting in a CVSS score of 7.5. The issue is resolved in libexpat version 2.8.1.

## Affected products

- libexpat project libexpat before 2.8.1
- Red Hat Enterprise Linux 6, 7, 8, 9, 10
- Red Hat JBoss Core Services 2.4.62.SP4

## Timeline

- 2026-05-08: other: Fixing pull request submitted to GitHub
- 2026-05-10: patched: libexpat 2.8.1 released
- 2026-05-10: disclosed: Vulnerability disclosed and CVE assigned
- 2026-06-03: advisory: Red Hat issued security advisories for multiple products

## References

- [https://github.com/libexpat/libexpat/pull/1216](https://github.com/libexpat/libexpat/pull/1216)
- [http://www.openwall.com/lists/oss-security/2026/05/11/16](http://www.openwall.com/lists/oss-security/2026/05/11/16)
- [https://access.redhat.com/errata/RHSA-2026:22715](https://access.redhat.com/errata/RHSA-2026:22715)
- [https://access.redhat.com/errata/RHSA-2026:22721](https://access.redhat.com/errata/RHSA-2026:22721)
- [https://access.redhat.com/errata/RHSA-2026:23230](https://access.redhat.com/errata/RHSA-2026:23230)
- [https://access.redhat.com/errata/RHSA-2026:26319](https://access.redhat.com/errata/RHSA-2026:26319)
- [https://access.redhat.com/errata/RHSA-2026:27201](https://access.redhat.com/errata/RHSA-2026:27201)

## Related threats

- [libexpat use-after-free in custom encoding callbacks](https://junglewise.ai/threats/cve-2026-76957-libexpat-use-after-free-in-custom-encoding-callbacks)
- [libexpat hash flooding denial of service via mishandled entropy generation](https://junglewise.ai/threats/cve-2026-76956-libexpat-hash-flooding-denial-of-service-via-mishandled-entropy)
- [Expat XML parser denial of service via quadratic complexity](https://junglewise.ai/threats/cve-2026-66046-expat-xml-parser-denial-of-service-via-quadratic-complexity)
- [libexpat use-after-free in doCdataSection](https://junglewise.ai/threats/cve-2026-56412-libexpat-use-after-free-in-docdatasection)
- [libexpat integer overflow in xmlwf endDoctypeDecl](https://junglewise.ai/threats/cve-2026-56411-libexpat-integer-overflow-in-xmlwf-enddoctypedecl)