AZL-110546: CVE-2026-115506 affecting package expat 2.8.3-2

Q: What kind of input is required to trigger the denial of service?

An attacker must be able to provide XML that the affected Expat library parses. The crafted document uses a large DTD with nested entity expansions, while remaining moderately sized itself.

Q: What is the practical impact of successful exploitation?

Processing the malicious XML can consume tens of seconds of CPU time per parse. Systems that parse attacker-controlled XML may experience reduced availability or resource exhaustion under repeated requests.

Q: Are versions other than the listed package release potentially affected?

The vulnerability is described as affecting libexpat through version 2.9.0. The provided package is azure-linux/expat 2.8.3-2.

Published Oct 22, 2026

Updated

libexpat through 2.9.0 contains a denial of service vulnerability because billion laughs protection in accountingDiffTolerated() in xmlparse.c detects entity amplification too late. Attackers can supply a moderately sized XML document with a large DTD and nested entity expansions to consume tens of seconds of CPU per parse.

Affected Software

1 affected component

azure-linux/expat<=2.8.3-2

Event History

Oct 22, 2026

Advisory Published

via OSV·08:17 PM

Data Sourced

via OSV·08:17 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-115506

Frequently Asked Questions

What kind of input is required to trigger the denial of service?

An attacker must be able to provide XML that the affected Expat library parses. The crafted document uses a large DTD with nested entity expansions, while remaining moderately sized itself.

What is the practical impact of successful exploitation?

Processing the malicious XML can consume tens of seconds of CPU time per parse. Systems that parse attacker-controlled XML may experience reduced availability or resource exhaustion under repeated requests.

Are versions other than the listed package release potentially affected?

The vulnerability is described as affecting libexpat through version 2.9.0. The provided package is azure-linux/expat 2.8.3-2.

AZL-110546: CVE-2026-115506 affecting package expat 2.8.3-2

Affected Software

Event History

Child vulnerabilities

Frequently Asked Questions

What kind of input is required to trigger the denial of service?

What is the practical impact of successful exploitation?

Are versions other than the listed package release potentially affected?

Company

Resources

Contact

Frequently Asked Questions

What kind of input is required to trigger the denial of service?

What is the practical impact of successful exploitation?

Are versions other than the listed package release potentially affected?