CVE-2026-41080

LowCVSS 2.9

Published: 16/04/2026(UTC)Updated: 12/06/2026(UTC)Translated: 17/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.01%

2th percentile — higher than 2% of all known CVEs

libexpat before 2.8.0 uses insufficient entropy, which can lead to hash flooding attacks via a crafted XML document.

An attacker could exploit this vulnerability to overload the system, potentially leading to denial of service or other performance issues.

It is recommended to upgrade libexpat to version 2.8.0 or later to mitigate this vulnerability.

Original NVD description (English source)

libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document.