https://seclists.org/oss-sec/2026/q3/630: libexpat 2.8.4 fixes 4 vulnerabilities
Affected Software
Frequently Asked Questions
Which deployments are most exposed to the XML denial-of-service issues?
Deployments that parse attacker-controlled XML are exposed, including remotely reachable services. The supplied CVSS vector for these issues indicates network exploitation with no privileges or user interaction required.
Can compressed XML make the denial-of-service attack easier to deliver?
Yes. A compression layer around XML can significantly reduce the minimum size of the crafted payload needed to trigger the quadratic-runtime condition.
When is the hash-flooding denial-of-service issue relevant?
It is relevant in configurations where getentropy is configured or detected as the only high-quality entropy extractor. In that case, inverted getentropy return handling could allow hash-flooding denial of service.
Are applications using custom XML encodings affected by a separate issue?
Yes. CVE-2026-76957 concerns parser re-entry through custom encoding callbacks. The release protects those callbacks from parser re-entry.
What version contains fixes for the listed vulnerabilities?
libexpat 2.8.4 fixes CVE-2026-66046, CVE-2026-76641, CVE-2026-76956, and CVE-2026-76957.