CVE-2026-115506 in Libexpat
Summary
by MITRE • 10/22/2026
libexpat through 2.9.0 contains a denial of service vulnerability because billion laughs protection in accountingDiffTolerated() in xmlparse.c detects entity amplification too late. Attackers can supply a moderately sized XML document with a large DTD and nested entity expansions to consume tens of seconds of CPU per parse.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/22/2026
The libexpat library, widely utilized for parsing Extensible Markup Language documents across numerous software ecosystems including web browsers, operating systems, and enterprise applications, contains a critical denial of service vulnerability in versions through 2.9.0. This flaw resides specifically within the accountingDiffTolerated function located in the xmlparse.c source file. The core technical deficiency involves the timing of entity amplification detection during the parsing process. Specifically, the billion laughs protection mechanism fails to identify excessive entity expansion early enough in the execution flow. Instead of rejecting or limiting the processing when the potential for exponential resource consumption becomes apparent at the initial stages of DTD and entity definition analysis, the parser proceeds with the actual expansion operations before the threshold is breached. This delayed detection allows an attacker to craft a moderately sized XML document that contains a large Document Type Definition section coupled with deeply nested entity expansions.
From a technical perspective, this vulnerability exploits the recursive nature of XML entity resolution. When an XML processor encounters an entity reference, it substitutes the reference with its defined value. If entities are defined in terms of other entities, particularly within a DTD, this can lead to exponential growth in the size of the parsed data relative to the input file size. The billion laughs attack is a well-known class of such exploits where each level of nesting multiplies the output size significantly. In libexpat versions prior to 2.9.0, the accountingDiffTolerated function serves as a safeguard against this by tracking the difference in memory or processing units allocated during expansion. However, due to the logical flaw described, this check occurs after significant computational work has already been performed for each level of nesting. Consequently, an attacker can supply input that triggers tens of seconds of CPU consumption per parse operation, effectively exhausting system resources and rendering the application unresponsive.
The operational impact of this vulnerability is severe in environments where libexpat processes untrusted or semi-trusted XML data without prior validation. Denial of service attacks targeting these applications can lead to significant downtime, increased infrastructure costs due to resource exhaustion, and potential cascading failures if the affected component is part of a larger distributed system. For services handling high volumes of XML requests, even moderately sized malicious payloads can cause sustained CPU spikes that degrade performance for legitimate users. This aligns with Common Weakness Enumeration CWE-400, which describes uncontrolled resource consumption within a loop or recursive process. Furthermore, the exploitation technique maps directly to MITRE ATT&CK tactic T1496, Resource Hijacking, specifically sub-tactic T1496.002, Denial of Service via CPU exhaustion. The attack vector is classified as remote with low complexity, requiring only a single crafted XML document to trigger the condition, making it highly feasible for automated exploitation campaigns targeting public-facing APIs or web services that accept XML input.
Mitigation strategies must address both immediate remediation and long-term architectural defenses. The primary recommendation is to upgrade libexpat to version 2.9.0 or later, where the accountingDiffTolerated function has been corrected to detect entity amplification earlier in the parsing lifecycle, thereby preventing excessive CPU consumption before it occurs. For systems unable to immediately patch, implementing input validation at the network perimeter using Web Application Firewalls can help block XML documents with suspiciously large DTDs or deeply nested structures based on heuristic analysis of entity definitions. Additionally, developers should enforce strict limits on entity expansion depth and total output size within their application logic where possible. Enabling timeout mechanisms for parsing operations ensures that any single parse request does not monopolize CPU resources indefinitely. Regular security audits focusing on XML processing libraries are essential to identify similar timing-related flaws in other components of the software supply chain, ensuring robust protection against resource exhaustion attacks.