CVE-2026-41080 | BDVDB-2026-327455 Detail
libexpat projectlibexpat
Description#
libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document.
Impact#
Per CVSS v3.1: confidentiality impact none, integrity impact none, availability impact low. Attack vector: local.
Weaknesses#
- CWE-331 Insufficient Entropy
References#
- https://github.com/libexpat/libexpat/pull/1183
- https://github.com/libexpat/libexpat/issues/47
- https://www.openwall.com/lists/oss-security/2026/04/26/1
- https://blog.hartwork.org/posts/expat-2-8-0-released/
- http://www.openwall.com/lists/oss-security/2026/04/26/1
- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.