CVE-2026-115506: libexpat through 2.9.0 Denial of Service via Billion Laughs Detection Delay
libexpat through 2.9.0 contains a denial of service vulnerability because billion laughs protection in accountingDiffTolerated() in xmlparse.c detects entity amplification too late. Attackers can supply a moderately sized XML document with a large DTD and nested entity expansions to consume tens of seconds of CPU per parse.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications that use affected libexpat versions to parse XML documents are exposed when an attacker can provide XML input to the parser. The supplied data indicates that exploitation does not require authentication or user interaction.
What must an attacker provide to cause the denial of service?
An attacker needs to submit a moderately sized XML document containing a large DTD and nested entity expansions. This delays billion-laughs detection and can consume tens of seconds of CPU time for a single parse.
What is the practical impact on an affected service?
The issue affects availability: repeated parsing of crafted XML can tie up CPU resources and cause a denial of service. The provided data does not indicate confidentiality or integrity impact.