In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to insufficient entropy, which results in being vulnerable to hash flooding attacks, causing a denial of service via crafted XML content.

libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in the case of a large token for which multiple buffer fills are needed.

References: [1] https://github.com/libexpat/libexpat/pull/789 [2] https://github.com/libexpat/libexpat/commit/34b598c5f594b015c513c73f06e7ced3323edbf1