CVE-2026-66046
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk54th percentile - higher than 54% of all known CVEs
Summary
Denial of service vulnerability in Expat through 2.8.3. The storeAtts() function in xmlparse.c has quadratic complexity, causing excessive CPU consumption when processing an XML document with many attributes with non-normalized values.
Risk Assessment
A remote unauthenticated attacker can send a few-megabyte XML document, causing CPU exhaustion and denial of service.
Recommendation
Update Expat to a version newer than 2.8.3 if a patch is available.
Other vulnerabilities in Expat
See all- CVE-2022-25315Critical
In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames.
- CVE-2022-25314High
In Expat (libexpat) before 2.4.5, there is an integer overflow in copyString.
- CVE-2022-25236Critical
In xmlparse.c in Expat (aka libexpat) before 2.4.5, attackers can insert namespace-separator characters into namespace URIs.
- CVE-2022-25235Critical
In xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain context.
- CVE-2022-23990High
Expat (libexpat) before 2.4.4 has an integer overflow in the doProlog function. This may lead to improper XML parser behavior.
- CVE-2022-23852Critical
Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES.
- CVE-2022-22824Critical
The defineAttribute function in xmlparse.c in Expat (libexpat) before 2.4.3 has an integer overflow. This may lead to incorrect behavior of the XML parser.
- CVE-2022-22823Critical
The build_model function in xmlparse.c in Expat (libexpat) before 2.4.3 has an integer overflow. This may lead to incorrect behavior of the XML parser.
- CVE-2022-22822Critical
addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
- CVE-2021-45960High
In Expat (libexpat) before 2.4.3, a left shift by 29 or more bits in the storeAtts function in xmlparse.c can lead to realloc misbehavior, such as allocating too few bytes or only freeing memory.
Original NVD description (English source)
Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an O(N^2) linear scan of elementType->defaultAtts to determine CDATA status. A remote unauthenticated attacker can supply a single well-formed XML document of a few megabytes to an application parsing untrusted XML to cause excessive CPU consumption, resulting in denial of service without requiring authentication, external entity resolution, or non-default parser options.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS