Executive brief
Expat is a widely-used XML parsing library found in many applications and operating systems. A vulnerability in how it processes XML attributes with certain characteristics causes the parser to consume excessive CPU time when handling specially crafted documents, allowing an attacker to crash or hang applications without special permissions. The attack requires only supplying a few megabytes of valid XML, making it trivial to exploit.
Technical details
The vulnerability stems from quadratic algorithmic complexity (O(N²)) in the storeAtts() function in xmlparse.c, specifically in the default attribute CDATA status lookup. When processing N specified attributes that require normalization and have the maybeTokenized flag set, the function performs a linear scan of elementType->defaultAtts for each attribute, resulting in N² comparisons. An attacker can craft an XML document with many non-normalized attributes to trigger excessive CPU consumption on the parsing application. No authentication is required; the attack only requires the ability to supply an XML document to a parser. A fix has been merged upstream migrating the linear lookup to hash table lookups to eliminate the quadratic behavior.
Affected products
- Expat Expat through 2.8.3
Timeline
- 2026-08-18: disclosed
- 2026-08-18: patched: Fix merged in PR #1321 on libexpat master branch