Log in Start free

Vulnerability · Published Aug 18, 2026 · Assigned by VulnCheck

CVE-2026-66046Expat Denial of Service via storeAtts() Quadratic Complexity

High 7.5

In plain English

A high-severity security flaw in libexpat from libexpat project. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 55% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.7%top 45.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an O(N^2) linear scan of elementType->defaultAtts to determine CDATA status. A remote unauthenticated attacker can supply a single well-formed XML document of a few megabytes to an application parsing untrusted XML to cause excessive CPU consumption, resulting in denial of service without requiring authentication, external entity resolution, or non-default parser options.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10expat2.7.3-1.el10_2.5ALSA-2026:74001
AlmaLinux:8expat2.5.0-4.el8_10ALSA-2026:72448
AlmaLinux:9expat2.5.0-6.el9_8.5ALSA-2026:72663
AlmaLinux:10expat-devel2.7.3-1.el10_2.5ALSA-2026:74001
AlmaLinux:8expat-devel2.5.0-4.el8_10ALSA-2026:72448
AlmaLinux:9expat-devel2.5.0-6.el9_8.5ALSA-2026:72663
Alpine:v3.21expat2.8.4-r0ALPINE-CVE-2026-66046
Alpine:v3.22expat2.8.4-r0ALPINE-CVE-2026-66046
Alpine:v3.23expat2.8.4-r0ALPINE-CVE-2026-66046
Alpine:v3.24expat2.8.4-r0ALPINE-CVE-2026-66046
Debian:12expat2.5.0-1+deb12u4DEBIAN-CVE-2026-66046
Debian:13expat2.9.0-1~deb13u1DEBIAN-CVE-2026-66046
Debian:14expat2.8.4-1DEBIAN-CVE-2026-66046
Rocky Linux:10expat0:2.7.3-1.el10_2.5RLSA-2026:74001
Rocky Linux:8expat0:2.5.0-4.el8_10RLSA-2026:72448
Rocky Linux:9expat0:2.5.0-6.el9_8.5RLSA-2026:72663
Ubuntu:22.04:LTScadaverno fix listedUBUNTU-CVE-2026-66046
Ubuntu:24.04:LTScadaverno fix listedUBUNTU-CVE-2026-66046
Ubuntu:26.04:LTScadaverno fix listedUBUNTU-CVE-2026-66046
Ubuntu:26.10cadaverno fix listedUBUNTU-CVE-2026-66046
Ubuntu:22.04:LTSexpat2.4.7-1ubuntu0.9UBUNTU-CVE-2026-66046
Ubuntu:22.04:LTSexpat2.4.7-1ubuntu0.9USN-8813-1
Ubuntu:24.04:LTSexpat2.6.1-2ubuntu0.6UBUNTU-CVE-2026-66046
Ubuntu:24.04:LTSexpat2.6.1-2ubuntu0.6USN-8813-1
Ubuntu:26.04:LTSexpat2.7.4-1ubuntu0.2UBUNTU-CVE-2026-66046
Ubuntu:26.04:LTSexpat2.7.4-1ubuntu0.2USN-8813-1
Ubuntu:22.04:LTSinsighttoolkit4no fix listedUBUNTU-CVE-2026-66046
Ubuntu:22.04:LTSmatanzano fix listedUBUNTU-CVE-2026-66046
Ubuntu:24.04:LTSmatanzano fix listedUBUNTU-CVE-2026-66046
Ubuntu:26.04:LTSmatanzano fix listedUBUNTU-CVE-2026-66046
Ubuntu:26.10matanzano fix listedUBUNTU-CVE-2026-66046
Ubuntu:26.10swish-eno fix listedUBUNTU-CVE-2026-66046
Ubuntu:22.04:LTStdomno fix listedUBUNTU-CVE-2026-66046
Ubuntu:24.04:LTStdomno fix listedUBUNTU-CVE-2026-66046
Ubuntu:26.04:LTStdomno fix listedUBUNTU-CVE-2026-66046
Ubuntu:26.10tdomno fix listedUBUNTU-CVE-2026-66046
Ubuntu:22.04:LTSwbxml2no fix listedUBUNTU-CVE-2026-66046
Ubuntu:24.04:LTSwbxml2no fix listedUBUNTU-CVE-2026-66046
Ubuntu:26.04:LTSwbxml2no fix listedUBUNTU-CVE-2026-66046
Ubuntu:26.10wbxml2no fix listedUBUNTU-CVE-2026-66046
Ubuntu:26.04:LTSxmlrpc-cno fix listedUBUNTU-CVE-2026-66046
Ubuntu:26.10xmlrpc-cno fix listedUBUNTU-CVE-2026-66046

Affected products (as reported)

VendorProductVersions
libexpat project libexpat 0 – through 2.8.3

Weakness: CWE-407 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References