CVE-2026-66046: Expat Denial of Service via storeAtts() Quadratic Complexity
Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an O(N^2) linear scan of elementType->defaultAtts to determine CDATA status. A remote unauthenticated attacker can supply a single well-formed XML document of a few megabytes to an application parsing untrusted XML to cause excessive CPU consumption, resulting in denial of service without requiring authentication, external entity resolution, or non-default parser options.
Affected Software
Event History
Frequently Asked Questions
Which deployments are realistically exposed?
Applications that parse untrusted XML with Expat are exposed, including when Expat is used with default parser settings. The attack does not depend on external entity resolution or non-default parser options.
What does an attacker need to exploit this issue?
An unauthenticated remote attacker only needs to submit one well-formed XML document containing many specified attributes with non-normalized values. A document of a few megabytes can cause excessive CPU consumption.
How can I determine whether my application may be affected?
Look for services or applications that accept untrusted XML and use Expat through version 2.8.3. The vulnerable processing pattern is XML with many specified attributes whose values are non-normalized.