Log in Start free

Vulnerability · Published May 10, 2026 · Assigned by mitre

CVE-2026-45186

Low 2.9

In plain English

A low-severity security flaw in libexpat from libexpat project. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)2.9Low
Exploit odds (30 days)0.5%top 58.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10expat2.7.3-1.el10_2.1ALSA-2026:22715
AlmaLinux:8expat2.5.0-2.el8_10ALSA-2026:22721
AlmaLinux:9expat2.5.0-6.el9_8.1ALSA-2026:23230
AlmaLinux:10expat-devel2.7.3-1.el10_2.1ALSA-2026:22715
AlmaLinux:8expat-devel2.5.0-2.el8_10ALSA-2026:22721
AlmaLinux:9expat-devel2.5.0-6.el9_8.1ALSA-2026:23230
AlmaLinux:10firefox153.5.0-1.el10_2ALSA-2026:89758
AlmaLinux:8firefox153.5.0-1.el8_10ALSA-2026:89756
AlmaLinux:9firefox153.5.0-1.el9_8ALSA-2026:89757
AlmaLinux:9firefox-x11153.5.0-1.el9_8ALSA-2026:89757
AlmaLinux:10thunderbird153.5.0-1.el10_2.alma.1ALSA-2026:90895
Alpine:v3.20expat2.8.1-r0ALPINE-CVE-2026-45186
Alpine:v3.21expat2.8.1-r0ALPINE-CVE-2026-45186
Alpine:v3.22expat2.8.1-r0ALPINE-CVE-2026-45186
Alpine:v3.23expat2.8.1-r0ALPINE-CVE-2026-45186
Alpine:v3.24expat2.8.1-r0ALPINE-CVE-2026-45186
Debian:12expat2.5.0-1+deb12u4DEBIAN-CVE-2026-45186
Debian:13expat2.8.2-1~deb13u1DEBIAN-CVE-2026-45186
Debian:14expat2.8.0-2DEBIAN-CVE-2026-45186
Rocky Linux:10expat0:2.7.3-1.el10_2.1RLSA-2026:22715
Rocky Linux:8expat0:2.5.0-2.el8_10RLSA-2026:22721
Rocky Linux:9expat0:2.5.0-6.el9_8.1RLSA-2026:23230
Rocky Linux:10firefox0:153.5.0-1.el10_2RLSA-2026:89758
Rocky Linux:8firefox0:153.5.0-1.el8_10RLSA-2026:89756
Rocky Linux:9firefox0:153.5.0-1.el9_8RLSA-2026:89757
Rocky Linux:10thunderbird0:153.5.0-1.el10_2RLSA-2026:90895
Ubuntu:22.04:LTScadaverno fix listedUBUNTU-CVE-2026-45186
Ubuntu:24.04:LTScadaverno fix listedUBUNTU-CVE-2026-45186
Ubuntu:25.10cadaverno fix listedUBUNTU-CVE-2026-45186
Ubuntu:26.04:LTScadaverno fix listedUBUNTU-CVE-2026-45186
Ubuntu:26.10cadaverno fix listedUBUNTU-CVE-2026-45186
Ubuntu:22.04:LTSexpatno fix listedUBUNTU-CVE-2026-45186
Ubuntu:22.04:LTSexpat2.4.7-1ubuntu0.8USN-8790-1
Ubuntu:24.04:LTSexpat2.6.1-2ubuntu0.5UBUNTU-CVE-2026-45186
Ubuntu:24.04:LTSexpat2.6.1-2ubuntu0.5USN-8790-1
Ubuntu:25.10expatno fix listedUBUNTU-CVE-2026-45186
Ubuntu:26.04:LTSexpat2.7.4-1ubuntu0.1UBUNTU-CVE-2026-45186
Ubuntu:26.04:LTSexpat2.7.4-1ubuntu0.1USN-8790-1
Ubuntu:22.04:LTSinsighttoolkit4no fix listedUBUNTU-CVE-2026-45186
Ubuntu:22.04:LTSlibxmltokno fix listedUBUNTU-CVE-2026-45186
Ubuntu:24.04:LTSlibxmltokno fix listedUBUNTU-CVE-2026-45186
Ubuntu:22.04:LTSmatanzano fix listedUBUNTU-CVE-2026-45186
Ubuntu:24.04:LTSmatanzano fix listedUBUNTU-CVE-2026-45186
Ubuntu:25.10matanzano fix listedUBUNTU-CVE-2026-45186
Ubuntu:26.04:LTSmatanzano fix listedUBUNTU-CVE-2026-45186
Ubuntu:26.10matanzano fix listedUBUNTU-CVE-2026-45186
Ubuntu:25.10swish-eno fix listedUBUNTU-CVE-2026-45186
Ubuntu:26.10swish-eno fix listedUBUNTU-CVE-2026-45186
Ubuntu:22.04:LTStdomno fix listedUBUNTU-CVE-2026-45186
Ubuntu:24.04:LTStdomno fix listedUBUNTU-CVE-2026-45186
Ubuntu:25.10tdomno fix listedUBUNTU-CVE-2026-45186
Ubuntu:26.04:LTStdomno fix listedUBUNTU-CVE-2026-45186
Ubuntu:26.10tdomno fix listedUBUNTU-CVE-2026-45186
Ubuntu:22.04:LTSwbxml2no fix listedUBUNTU-CVE-2026-45186
Ubuntu:24.04:LTSwbxml2no fix listedUBUNTU-CVE-2026-45186
Ubuntu:25.10wbxml2no fix listedUBUNTU-CVE-2026-45186
Ubuntu:26.04:LTSwbxml2no fix listedUBUNTU-CVE-2026-45186
Ubuntu:26.10wbxml2no fix listedUBUNTU-CVE-2026-45186
Ubuntu:25.10xmlrpc-cno fix listedUBUNTU-CVE-2026-45186
Ubuntu:26.04:LTSxmlrpc-cno fix listedUBUNTU-CVE-2026-45186
Ubuntu:26.10xmlrpc-cno fix listedUBUNTU-CVE-2026-45186

Affected products (as reported)

VendorProductVersions
libexpat project libexpat 0 – before 2.8.1

Weakness: CWE-407 · Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

References