CVE-2026-76956: High severity libexpat libexpat vulnerability
In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to insufficient entropy, which results in being vulnerable to hash flooding attacks, causing a denial of service via crafted XML content.
Affected Software
Event History
Frequently Asked Questions
Which deployments should be prioritized for remediation?
Prioritize systems using libexpat 2.8.2 or 2.8.3 that parse XML content supplied by untrusted or remote parties. The issue can be triggered over the network and results in denial of service.
Does exploitation require authentication or user interaction?
No. The published vector indicates network access, low attack complexity, no privileges required, and no user interaction.
What version resolves the issue?
Update libexpat to version 2.8.4 or later. The affected releases are 2.8.2 and 2.8.3 before 2.8.4.
How can I determine whether a system is affected?
Identify the libexpat version installed or bundled with the application. Systems using 2.8.2 or 2.8.3 prior to 2.8.4 are affected.