CVE-2026-66046
Fixed in a distro release EPSS <1%CVSS 7.5
Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an O(N^2) linear scan of elementType->defaultAtts to determine CDATA status. A remote unauthenticated attacker can supply a single well-formed XML document of a few megabytes to an application parsing untrusted XML to cause excessive CPU consumption, resulting in denial of service without requiring authentication, external entity resolution, or non-default parser options.
Products: libexpat_project libexpat
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 10 | expat | 2.7.3-1.el10_2.5 |
| AlmaLinux 10 | expat-devel | 2.7.3-1.el10_2.5 |
| AlmaLinux 8 | expat | 2.5.0-4.el8_10 |
| AlmaLinux 8 | expat-devel | 2.5.0-4.el8_10 |
| AlmaLinux 9 | expat | 2.5.0-6.el9_8.5 |
| AlmaLinux 9 | expat-devel | 2.5.0-6.el9_8.5 |
| Alpine 3.21 | expat | 2.8.4-r0 |
| Alpine 3.22 | expat | 2.8.4-r0 |
| Alpine 3.23 | expat | 2.8.4-r0 |
| Alpine 3.24 | expat | 2.8.4-r0 |
| Amazon Linux 2 | expat | 2.1.0-15.amzn2.0.9 |
| Amazon Linux 2 | expat-devel | 2.1.0-15.amzn2.0.9 |
| Amazon Linux 2 | expat-static | 2.1.0-15.amzn2.0.9 |
| Amazon Linux 2 | thunderbird | 140.14.0-1.amzn2.0.1 |
| Amazon Linux 2023 | expat | 2.8.3-1.amzn2023.0.1 |
| Amazon Linux 2023 | expat-devel | 2.8.3-1.amzn2023.0.1 |
| Amazon Linux 2023 | expat-static | 2.8.3-1.amzn2023.0.1 |
| Amazon Linux 2023 | firefox | 140.14.0-1.amzn2023.0.1 |
| Debian 12 | expat | 2.5.0-1+deb12u4 |
| Debian 13 | expat | 2.9.0-1~deb13u1 |
| Debian 14 | expat | 2.8.4-1 |
| Red Hat Enterprise Linux 10.2 | expat | 0:2.7.3-1.el10_2.5 |
| Red Hat Enterprise Linux 10.2 | expat-debuginfo | 0:2.7.3-1.el10_2.5 |
| Red Hat Enterprise Linux 10.2 | expat-debugsource | 0:2.7.3-1.el10_2.5 |
| Red Hat Enterprise Linux 10.2 | expat-devel | 0:2.7.3-1.el10_2.5 |
| Red Hat Enterprise Linux 8 | expat | 0:2.5.0-4.el8_10 |
| Red Hat Enterprise Linux 8 | expat-debuginfo | 0:2.5.0-4.el8_10 |
| Red Hat Enterprise Linux 8 | expat-debugsource | 0:2.5.0-4.el8_10 |
| Red Hat Enterprise Linux 8 | expat-devel | 0:2.5.0-4.el8_10 |
| Red Hat Enterprise Linux 9 | expat | 0:2.5.0-6.el9_8.5 |
| Red Hat Enterprise Linux 9 | expat-debuginfo | 0:2.5.0-6.el9_8.5 |
| Red Hat Enterprise Linux 9 | expat-debugsource | 0:2.5.0-6.el9_8.5 |
| Red Hat Enterprise Linux 9 | expat-devel | 0:2.5.0-6.el9_8.5 |
| Red Hat hummingbird 1 | expat | 0:2.8.4-0.1.hum1 |
| Red Hat hummingbird 1 | expat-devel | 0:2.8.4-0.1.hum1 |
| Red Hat hummingbird 1 | expat-static | 0:2.8.4-0.1.hum1 |
| Rocky Linux 10 | expat | 0:2.7.3-1.el10_2.5 |
| Rocky Linux 8 | expat | 0:2.5.0-4.el8_10 |
| Rocky Linux 9 | expat | 0:2.5.0-6.el9_8.5 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | MozillaFirefox | 153.5.0-150400.157.16.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | expat | 2.8.5-150400.3.40.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | MozillaFirefox | 153.5.0-150400.157.16.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | expat | 2.8.5-150400.3.40.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS | MozillaFirefox | 153.5.0-150400.157.16.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS | expat | 2.8.5-150400.3.40.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS | MozillaFirefox | 153.5.0-150400.157.16.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS | expat | 2.8.5-150400.3.40.1 |
| SUSE Linux Enterprise Micro 5.3 | expat | 2.8.5-150400.3.40.1 |
| SUSE Linux Enterprise Micro 5.4 | expat | 2.8.5-150400.3.40.1 |
| SUSE Linux Enterprise Micro 5.5 | expat | 2.8.5-150400.3.40.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP7 | expat | 2.8.5-150700.3.15.1 |
| SUSE Linux Enterprise Module for Desktop Applications 15 SP7 | MozillaFirefox | 153.5.0-150400.157.16.1 |
| SUSE Linux Enterprise Module for Package Hub 15 SP7 | MozillaThunderbird | 153.5.0-150400.13.9.1 |
| SUSE Linux Enterprise Server 12 SP5-LTSS | MozillaFirefox | 153.5.0-118.16.2 |
| SUSE Linux Enterprise Server 12 SP5-LTSS | expat | 2.8.5-21.55.1 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | MozillaFirefox | 153.5.0-150400.157.16.1 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | expat | 2.8.5-150400.3.40.1 |
| SUSE Linux Enterprise Server 15 SP5-LTSS | MozillaFirefox | 153.5.0-150400.157.16.1 |
| SUSE Linux Enterprise Server 15 SP5-LTSS | expat | 2.8.5-150400.3.40.1 |
| SUSE Linux Enterprise Server 15 SP6-LTSS | MozillaFirefox | 153.5.0-150400.157.16.1 |
| SUSE Linux Enterprise Server 15 SP6-LTSS | expat | 2.8.5-150400.3.40.1 |
| SUSE Linux Enterprise Server 16.0 | MozillaFirefox | 153.5.0-160000.1.1 |
| SUSE Linux Enterprise Server 16.0 | expat | 2.8.4-160000.1.1 |
| SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 | MozillaFirefox | 153.5.0-118.16.2 |
| SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 | expat | 2.8.5-21.55.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | MozillaFirefox | 153.5.0-150400.157.16.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | expat | 2.8.5-150400.3.40.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | MozillaFirefox | 153.5.0-150400.157.16.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | expat | 2.8.5-150400.3.40.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | MozillaFirefox | 153.5.0-150400.157.16.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | expat | 2.8.5-150400.3.40.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | MozillaFirefox | 153.5.0-160000.1.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | expat | 2.8.4-160000.1.1 |
| SUSE Linux Enterprise Workstation Extension 15 SP7 | MozillaThunderbird | 153.5.0-150400.13.9.1 |
| SUSE Linux Micro 6.2 | expat | 2.8.4-160000.1.1 |
| Ubuntu 16.04 LTS | cadaver | no fix |
| Ubuntu 16.04 LTS | insighttoolkit4 | no fix |
| Ubuntu 16.04 LTS | matanza | no fix |
| Ubuntu 16.04 LTS | smart | no fix |
| Ubuntu 16.04 LTS | tdom | no fix |
| Ubuntu 16.04 LTS | wbxml2 | no fix |
| Ubuntu 18.04 LTS | cadaver | no fix |
| Ubuntu 18.04 LTS | insighttoolkit4 | no fix |
| Ubuntu 18.04 LTS | matanza | no fix |
| Ubuntu 18.04 LTS | smart | no fix |
| Ubuntu 18.04 LTS | tdom | no fix |
| Ubuntu 18.04 LTS | vnc4 | no fix |
| Ubuntu 18.04 LTS | wbxml2 | no fix |
| Ubuntu 20.04 LTS | cadaver | no fix |
| Ubuntu 20.04 LTS | insighttoolkit4 | no fix |
| Ubuntu 20.04 LTS | matanza | no fix |
| Ubuntu 20.04 LTS | tdom | no fix |
| Ubuntu 20.04 LTS | wbxml2 | no fix |
| Ubuntu 22.04 LTS | cadaver | no fix |
| Ubuntu 22.04 LTS | expat | 2.4.7-1ubuntu0.9 |
| Ubuntu 22.04 LTS | insighttoolkit4 | no fix |
| Ubuntu 22.04 LTS | matanza | no fix |
| Ubuntu 22.04 LTS | tdom | no fix |
| Ubuntu 22.04 LTS | wbxml2 | no fix |
| Ubuntu 24.04 LTS | cadaver | no fix |
| Ubuntu 24.04 LTS | expat | 2.6.1-2ubuntu0.6 |
| Ubuntu 24.04 LTS | matanza | no fix |
| Ubuntu 24.04 LTS | tdom | no fix |
| Ubuntu 24.04 LTS | wbxml2 | no fix |
| Ubuntu 26.04 LTS | cadaver | no fix |
| Ubuntu 26.04 LTS | expat | 2.7.4-1ubuntu0.2 |
| Ubuntu 26.04 LTS | matanza | no fix |
| Ubuntu 26.04 LTS | tdom | no fix |
| Ubuntu 26.04 LTS | wbxml2 | no fix |
| Ubuntu 26.04 LTS | xmlrpc-c | no fix |
| Ubuntu 26.10 | cadaver | no fix |
| Ubuntu 26.10 | matanza | no fix |
| Ubuntu 26.10 | swish-e | no fix |
| Ubuntu 26.10 | tdom | no fix |
| Ubuntu 26.10 | wbxml2 | no fix |
| Ubuntu 26.10 | xmlrpc-c | no fix |
| Ubuntu Pro 14.04 LTS | coin3 | no fix |
| Ubuntu Pro 14.04 LTS | expat | 2.1.0-4ubuntu1.4+esm13 |
| Ubuntu Pro 14.04 LTS | vnc4 | no fix |
| Ubuntu Pro 14.04 LTS | vtk | no fix |
| Ubuntu Pro 14.04 LTS | xmlrpc-c | no fix |
| Ubuntu Pro 16.04 LTS | ayttm | no fix |
| Ubuntu Pro 16.04 LTS | cableswig | no fix |
| Ubuntu Pro 16.04 LTS | coin3 | no fix |
| Ubuntu Pro 16.04 LTS | expat | 2.1.0-7ubuntu0.16.04.5+esm14 |
| Ubuntu Pro 16.04 LTS | libxmltok | no fix |
| Ubuntu Pro 16.04 LTS | swish-e | no fix |
| Ubuntu Pro 16.04 LTS | vnc4 | no fix |
| Ubuntu Pro 16.04 LTS | vtk | no fix |
| Ubuntu Pro 16.04 LTS | xmlrpc-c | no fix |
| Ubuntu Pro 18.04 LTS | coin3 | no fix |
| Ubuntu Pro 18.04 LTS | expat | 2.2.5-3ubuntu0.9+esm5 |
| Ubuntu Pro 18.04 LTS | libxmltok | no fix |
| Ubuntu Pro 18.04 LTS | swish-e | no fix |
| Ubuntu Pro 18.04 LTS | xmlrpc-c | no fix |
| Ubuntu Pro 20.04 LTS | expat | 2.2.9-1ubuntu0.8+esm3 |
| Ubuntu Pro 20.04 LTS | libxmltok | no fix |
| Ubuntu Pro 20.04 LTS | swish-e | no fix |
| Ubuntu Pro 20.04 LTS | xmlrpc-c | no fix |
| Ubuntu Pro 22.04 LTS | libxmltok | no fix |
| Ubuntu Pro 22.04 LTS | swish-e | no fix |
| Ubuntu Pro 22.04 LTS | xmlrpc-c | no fix |
| Ubuntu Pro 24.04 LTS | libxmltok | no fix |
| Ubuntu Pro 24.04 LTS | swish-e | no fix |
| Ubuntu Pro 24.04 LTS | xmlrpc-c | no fix |
| Ubuntu Pro 26.04 LTS | swish-e | no fix |
| openSUSE Leap 16.0 | MozillaFirefox | 153.5.0-160000.1.1 |
| openSUSE Leap 16.0 | expat | 2.8.4-160000.1.1 |
| openSUSE Tumbleweed | expat | 2.8.4-1.1 |