CVE-2026-41080

Summary

libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document.

Affected Software

Weaknesses

• CWE-331: CWE-331 Insufficient Entropy

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: partial

CVE Program Container

Additional References

• http://www.openwall.com/lists/oss-security/2026/04/26/1

References

• https://github.com/libexpat/libexpat/pull/1183
• https://github.com/libexpat/libexpat/issues/47
• https://www.openwall.com/lists/oss-security/2026/04/26/1
• https://blog.hartwork.org/posts/expat-2-8-0-released/

• ←Previous
• Next→