CVE-2026-45186 Denial of service in libexpat
Attackers can cause denial of service in applications using libexpat by sending crafted XML input that triggers excessive computational complexity.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-45186?
CVE-2026-45186 is a low-severity denial of service vulnerability in Libexpat Project Libexpat, published on 10 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input.
Weakness: CWE-407
Which versions are affected by CVE-2026-45186?
It affects 1 product.
Linux distribution packages (28)
expat AlmaLinux:10 | All versions | 2.7.3-1.el10_2.1 |
expat-devel AlmaLinux:10 | All versions | 2.7.3-1.el10_2.1 |
thunderbird AlmaLinux:10 | All versions | 153.5.0-1.el10_2.alma.1 |
expat AlmaLinux:8 | All versions | 2.5.0-2.el8_10 |
expat-devel AlmaLinux:8 | All versions | 2.5.0-2.el8_10 |
expat AlmaLinux:9 | All versions | 2.5.0-6.el9_8.1 |
expat-devel AlmaLinux:9 | All versions | 2.5.0-6.el9_8.1 |
expat Red Hat:enterprise_linux:10.2 | All versions | 0:2.7.3-1.el10_2.1 |
expat-debuginfo Red Hat:enterprise_linux:10.2 | All versions | 0:2.7.3-1.el10_2.1 |
expat-debugsource Red Hat:enterprise_linux:10.2 | All versions | 0:2.7.3-1.el10_2.1 |
expat-devel Red Hat:enterprise_linux:10.2 | All versions | 0:2.7.3-1.el10_2.1 |
expat Red Hat:enterprise_linux:8::baseos | All versions | 0:2.5.0-2.el8_10 |
expat-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 0:2.5.0-2.el8_10 |
expat-debugsource Red Hat:enterprise_linux:8::baseos | All versions | 0:2.5.0-2.el8_10 |
expat-devel Red Hat:enterprise_linux:8::baseos | All versions | 0:2.5.0-2.el8_10 |
expat-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:2.5.0-6.el9_8.1 |
expat-debugsource Red Hat:enterprise_linux:9::appstream | All versions | 0:2.5.0-6.el9_8.1 |
expat-devel Red Hat:enterprise_linux:9::appstream | All versions | 0:2.5.0-6.el9_8.1 |
expat Red Hat:enterprise_linux:9::baseos | All versions | 0:2.5.0-6.el9_8.1 |
expat-debuginfo Red Hat:enterprise_linux:9::baseos | All versions | 0:2.5.0-6.el9_8.1 |
expat-debugsource Red Hat:enterprise_linux:9::baseos | All versions | 0:2.5.0-6.el9_8.1 |
expat Red Hat:hummingbird:1 | All versions | 0:2.8.5-1.1.hum1 |
expat-devel Red Hat:hummingbird:1 | All versions | 0:2.8.5-1.1.hum1 |
expat-static Red Hat:hummingbird:1 | All versions | 0:2.8.5-1.1.hum1 |
expat Rocky Linux:10 | All versions | 0:2.7.3-1.el10_2.1 |
thunderbird Rocky Linux:10 | All versions | 0:153.5.0-1.el10_2 |
expat Rocky Linux:8 | All versions | 0:2.5.0-2.el8_10 |
expat Rocky Linux:9 | All versions | 0:2.5.0-6.el9_8.1 |
Products include Libexpat Project Libexpat.
How do I fix CVE-2026-45186?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-45186 being exploited?
There is no known exploitation of CVE-2026-45186 in the wild and no public exploit code.
Other vulnerabilities in Libexpat Project Libexpat
Sources
Also known as ALPINE-CVE-2026-45186, ALSA-2026:22715, ALSA-2026:22721, ALSA-2026:23230, ALSA-2026:90895, AZL-86340 and 36 more.