Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
libexpat Denial of Service via XML Input
published 26 days ago
Summary
A denial of service attack can occur when libexpat processes a large, specially crafted XML file. This can happen if you're using a version of libexpat older than 2.8.1. To protect yourself, update to the latest version of libexpat.
What to do
- Update expat_jll to version 2.8.1+0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Julia | – | expat_jll |
< 2.8.1+0 Fix: upgrade to 2.8.1+0
|
Original advisory text
In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input.
In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input.
References
- http://www.openwall.com/lists/oss-security/2026/05/11/16 URL
- https://access.redhat.com/errata/RHSA-2026:22715 URL
- https://access.redhat.com/errata/RHSA-2026:22721 URL
- https://access.redhat.com/errata/RHSA-2026:23230 URL
- https://access.redhat.com/errata/RHSA-2026:26319 URL
- https://access.redhat.com/errata/RHSA-2026:27201 URL
- https://access.redhat.com/errata/RHSA-2026:29197 URL
- https://access.redhat.com/security/cve/CVE-2026-45186 URL
- https://bugzilla.redhat.com/show_bug.cgi?id=2468575 URL
- https://cert-portal.siemens.com/productcert/html/ssa-082556.html URL
- https://github.com/libexpat/libexpat/pull/1216 URL
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45186.json URL
Severity
7.5
High
CVSS 3.1: 7.5 (OSV)
Timeline
Published9 Aug 2026
Updated9 Aug 2026
First seen9 Aug 2026
Sources
JLSEC-2026-1223 · OSV
Monitor software like this
Free during beta