CVE-2026-113351: libexpat 2.7.2 through 2.9.0 Denial of Service via XML_ParserReset
libexpat 2.7.2 through 2.9.0 contains a denial of service vulnerability because XMLParserReset zeroes the direct byte count but never offsets tracked heap allocations. Attackers can submit a large XML document so later documents on the same reset parser fail with XMLERRORNOMEMORY until it is recreated.
Affected Software
Event History
Frequently Asked Questions
What conditions are required for exploitation?
An attacker must be able to submit a large XML document to an application using an affected libexpat version. The application must subsequently reuse the same parser through XML_ParserReset rather than recreating it.
What is the practical impact on an affected application?
After processing the large document, later documents handled by the reset parser can fail with XML_ERROR_NO_MEMORY. This can cause denial of service for requests or workloads assigned to that parser until it is recreated.
What can be done if updating libexpat is not immediately possible?
Avoid reusing parsers with XML_ParserReset after processing untrusted or large XML documents. Recreate the parser instead, particularly after large-document processing, to restore normal operation.
How can I identify whether this issue is affecting my service?
Check whether the service uses libexpat versions 2.7.2 through 2.9.0 and calls XML_ParserReset on parsers that process externally supplied XML. Affected behavior is indicated by later parsing attempts returning XML_ERROR_NO_MEMORY after a large XML document was processed on the same parser.