CVE-2026-45186Disclosure(libexpat_project / libexpat)

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch libexpat_project libexpat systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input.

libexpat_project CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Patch / fix

https://github.com/libexpat/libexpat/pull/1216

Exploit / PoC references

https://github.com/libexpat/libexpat/pull/1216

Vendor / third-party advisories

http://www.openwall.com/lists/oss-security/2026/05/11/16

Other references

Weakness type (CWE)

CWE-407

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

libexpat

Threat summary

Patch or workaround signal is available
5 mentions across 4 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 3 signals
Technical details provided in 3 signals
Disclosure: 3 classified signals
Peaked 3d ago at 2 mentions (2026-05-10); latest day: 1
5 total mentions across 4 days

Affected systems

Vendors

libexpat_project

Products

libexpat

Deep dive

Activity timeline5 mentions / 4d

Signal classification2 categories

Disclosure

360.0%

Patch

240.0%

Referenced assets6 URLs

By indicator

Classification over time

Date	Total	Labels

2026-05-10	2	Disclosure2
2026-05-11	1	Patch1
2026-05-15	1	Disclosure1
2026-06-14	1	Patch1

Full discourse5 posts

Open Source Security mailing list@oss_security147d
Disclosure
CVE-2026-45186: libexpat DoS https://www.openwall.com/lists/oss-security/2026/05/11/16 Quadratic runtime from attribute name collision checks allowed DoS through moderately sized crafted XML input. A layer of compression around XML can significantly reduce the minimum attack payload size. Fixed in 2.8.1.
Post summary
A quadratic‑runtime DoS vulnerability in libexpat (CVE‑2026‑45186) allows attackers to craft XML with attribute name collisions; the fix is available in version 2.8.1 and technical details on payload sizing are provided.
00030337
4.7K followersView on X
Frank@jedisct1150d
Patch
Expat 2.8.1 released, CVE-2026-45186 and CVSS unreliability https://blog.hartwork.org/posts/expat-2-8-1-released/
Post summary
The Expat 2.8.1 release patches CVE-2026-45186, though the note highlights potential weaknesses in CVSS scoring.
00010548
17.2K followersView on X
Komodo Cyber Security@Komodosec116d
Patch
Hartwork Blog · Expat 2.8.1 released, CVE-2026-45186 and CVSS unreliability https://blog.hartwork.org/posts/expat-2-8-1-released/?utm_source=dlvr.it&utm_medium=twitter
Post summary
The blog note informs readers that Expat 2.8.1 has been released to address CVE‑2026‑45186, with commentary on CVSS score reliability.
0000039
1.5K followersView on X
CVE@CVEnew151d
Disclosure
CVE-2026-45186 In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input. https://www.cve.org/CVERecord?id=CVE-2026-45186
Post summary
The post discloses a denial‑of‑service vulnerability in libexpat (before version 2.8.1) caused by computationally expensive attribute name collision checks when processing moderately sized XML input.
00000102
57.5K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds151d
Disclosure
CVE-2026-45186 Denial of Service via Attribute Name Collision in libexpat Before... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-45186 Customizable Vulnerability Alerts: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=4
Post summary
A brief announcement of CVE‑2026‑45186, a denial‑of‑service flaw in libexpat, with limited descriptive details.
0000051
4.0K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	libexpat_project	libexpat	-	-	-

Explore more

Back to dashboard libexpat_project CVEs libexpat vulnerabilities

What researchers are saying

CVE-2026-45186

Frank[verified]@jedisct1Patch

The Expat 2.8.1 release patches CVE-2026-45186, though the note highlights potential weaknesses in CVSS scoring.

Komodo Cyber Security[verified]@KomodosecPatch

The blog note informs readers that Expat 2.8.1 has been released to address CVE‑2026‑45186, with commentary on CVSS score reliability.

Open Source Security mailing list@oss_securityDisclosure

A quadratic‑runtime DoS vulnerability in libexpat (CVE‑2026‑45186) allows attackers to craft XML with attribute name collisions; the fix is available in version 2.8.1 and technical details on payload sizing are provided.

CVE@CVEnewDisclosure

The post discloses a denial‑of‑service vulnerability in libexpat (before version 2.8.1) caused by computationally expensive attribute name collision checks when processing moderately sized XML input.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

A brief announcement of CVE‑2026‑45186, a denial‑of‑service flaw in libexpat, with limited descriptive details.