Log in Start free

Vulnerability · Published Apr 16, 2026 · Assigned by mitre

CVE-2026-41080

Low 2.9

In plain English

A low-severity security flaw in libexpat from libexpat project. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)2.9Low
Exploit odds (30 days)0.4%top 65.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20expat2.8.1-r0ALPINE-CVE-2026-41080
Alpine:v3.21expat2.8.1-r0ALPINE-CVE-2026-41080
Alpine:v3.22expat2.8.1-r0ALPINE-CVE-2026-41080
Alpine:v3.23expat2.8.1-r0ALPINE-CVE-2026-41080
Alpine:v3.24expat2.8.0-r0ALPINE-CVE-2026-41080
Debian:12expatno fix listedDEBIAN-CVE-2026-41080
Debian:13expat2.8.2-1~deb13u1DEBIAN-CVE-2026-41080
Debian:14expat2.8.0-1DEBIAN-CVE-2026-41080
Ubuntu:22.04:LTScadaverno fix listedUBUNTU-CVE-2026-41080
Ubuntu:24.04:LTScadaverno fix listedUBUNTU-CVE-2026-41080
Ubuntu:25.10cadaverno fix listedUBUNTU-CVE-2026-41080
Ubuntu:26.04:LTScadaverno fix listedUBUNTU-CVE-2026-41080
Ubuntu:26.10cadaverno fix listedUBUNTU-CVE-2026-41080
Ubuntu:22.04:LTSexpatno fix listedUBUNTU-CVE-2026-41080
Ubuntu:22.04:LTSexpat2.4.7-1ubuntu0.8USN-8790-1
Ubuntu:24.04:LTSexpat2.6.1-2ubuntu0.5USN-8790-1
Ubuntu:24.04:LTSexpat2.6.1-2ubuntu0.5UBUNTU-CVE-2026-41080
Ubuntu:25.10expatno fix listedUBUNTU-CVE-2026-41080
Ubuntu:26.04:LTSexpat2.7.4-1ubuntu0.1UBUNTU-CVE-2026-41080
Ubuntu:26.04:LTSexpat2.7.4-1ubuntu0.1USN-8790-1
Ubuntu:22.04:LTSinsighttoolkit4no fix listedUBUNTU-CVE-2026-41080
Ubuntu:22.04:LTSmatanzano fix listedUBUNTU-CVE-2026-41080
Ubuntu:24.04:LTSmatanzano fix listedUBUNTU-CVE-2026-41080
Ubuntu:25.10matanzano fix listedUBUNTU-CVE-2026-41080
Ubuntu:26.04:LTSmatanzano fix listedUBUNTU-CVE-2026-41080
Ubuntu:26.10matanzano fix listedUBUNTU-CVE-2026-41080
Ubuntu:25.10swish-eno fix listedUBUNTU-CVE-2026-41080
Ubuntu:26.10swish-eno fix listedUBUNTU-CVE-2026-41080
Ubuntu:22.04:LTStdomno fix listedUBUNTU-CVE-2026-41080
Ubuntu:24.04:LTStdomno fix listedUBUNTU-CVE-2026-41080
Ubuntu:25.10tdomno fix listedUBUNTU-CVE-2026-41080
Ubuntu:26.04:LTStdomno fix listedUBUNTU-CVE-2026-41080
Ubuntu:26.10tdomno fix listedUBUNTU-CVE-2026-41080
Ubuntu:22.04:LTSwbxml2no fix listedUBUNTU-CVE-2026-41080
Ubuntu:24.04:LTSwbxml2no fix listedUBUNTU-CVE-2026-41080
Ubuntu:25.10wbxml2no fix listedUBUNTU-CVE-2026-41080
Ubuntu:26.04:LTSwbxml2no fix listedUBUNTU-CVE-2026-41080
Ubuntu:26.10wbxml2no fix listedUBUNTU-CVE-2026-41080
Ubuntu:25.10xmlrpc-cno fix listedUBUNTU-CVE-2026-41080
Ubuntu:26.04:LTSxmlrpc-cno fix listedUBUNTU-CVE-2026-41080
Ubuntu:26.10xmlrpc-cno fix listedUBUNTU-CVE-2026-41080

Affected products (as reported)

VendorProductVersions
libexpat project libexpat 0 – before 2.8.0

Weakness: CWE-331 · Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

References