CVE-2026-45186

Published: May 10, 2026Modified: Jul 24, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input.

Affected (1)

Products: Libexpat Project: Libexpat

Libexpat Project

1 product

Libexpat

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Libexpat Project Libexpat	Before 2.8.1

Related CWEs

CWE-407

Inefficient Algorithmic Complexity

An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

References (12)

https://github.com/libexpat/libexpat/pull/1216

Source: cve@mitre.org

ExploitIssue TrackingPatch

http://www.openwall.com/lists/oss-security/2026/05/11/16

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://access.redhat.com/errata/RHSA-2026:22715