REDHAT-BUG-2517901: High severity Expat Expat vulnerability

Q: Which deployments are exposed to this denial-of-service issue?

Applications that parse untrusted XML using affected Expat versions are exposed. The issue can be triggered with a single well-formed XML document only a few megabytes in size.

Q: What does an attacker need to exploit it?

An attacker only needs the ability to provide XML input to the application. Exploitation does not require authentication, external entity resolution, or non-default parser options.

Q: Are default parser settings affected?

Yes. The vulnerability can be exploited without non-default parser options, so relying on default Expat configuration does not prevent the issue.

Q: What is the operational impact of successful exploitation?

Processing crafted XML can consume excessive CPU due to quadratic behavior when handling specified attributes with non-normalized values. This can make the affected application unavailable.

Published Aug 18, 2026

Updated

Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an O(N^2) linear scan of elementType->defaultAtts to determine CDATA status. A remote unauthenticated attacker can supply a single well-formed XML document of a few megabytes to an application parsing untrusted XML to cause excessive CPU consumption, resulting in denial of service without requiring authentication, external entity resolution, or non-default parser options.

Affected Software

1 affected component

Expat Expat<=2.8.3

Event History

Aug 18, 2026

Data Sourced

via Red Hat·02:28 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed to this denial-of-service issue?

Applications that parse untrusted XML using affected Expat versions are exposed. The issue can be triggered with a single well-formed XML document only a few megabytes in size.

What does an attacker need to exploit it?

An attacker only needs the ability to provide XML input to the application. Exploitation does not require authentication, external entity resolution, or non-default parser options.

Are default parser settings affected?

Yes. The vulnerability can be exploited without non-default parser options, so relying on default Expat configuration does not prevent the issue.

What is the operational impact of successful exploitation?

Processing crafted XML can consume excessive CPU due to quadratic behavior when handling specified attributes with non-normalized values. This can make the affected application unavailable.

REDHAT-BUG-2517901: High severity Expat Expat vulnerability

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed to this denial-of-service issue?

What does an attacker need to exploit it?

Are default parser settings affected?

What is the operational impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this denial-of-service issue?

What does an attacker need to exploit it?

Are default parser settings affected?

What is the operational impact of successful exploitation?