CVE-2026-66046 in libexpat
Summary
by MITRE • 08/18/2026
Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an O(N^2) linear scan of elementType->defaultAtts to determine CDATA status. A remote unauthenticated attacker can supply a single well-formed XML document of a few megabytes to an application parsing untrusted XML to cause excessive CPU consumption, resulting in denial of service without requiring authentication, external entity resolution, or non-default parser options.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/18/2026
The vulnerability identified within the Expat library through version 2.8.3 represents a significant security risk rooted in algorithmic inefficiency rather than traditional memory corruption flaws. This specific issue is classified as CWE-400, which denotes uncontrolled resource consumption due to quadratic algorithmic complexity. The core technical flaw resides in the storeAtts function located within the xmlparse.c source file of the Expat XML parser. When the parser processes an XML document containing a large number of attributes with non-normalized values, it executes a linear scan against the elementType->defaultAtts structure for each attribute to determine its CDATA status. This design choice results in O(N^2) time complexity relative to the number of specified attributes N. Consequently, as the count of attributes increases, the processing time grows exponentially rather than linearly, creating a severe performance bottleneck that can be easily exploited by an attacker.
From an operational perspective, this vulnerability enables a remote unauthenticated denial-of-service attack with minimal effort required from the adversary. An attacker needs only to supply a single well-formed XML document of modest size, typically ranging up to a few megabytes, to trigger the excessive CPU consumption on the target system. Unlike many other XML-related vulnerabilities such as those involving external entity resolution or specific parser configurations, this exploit does not require authentication, special parsing options, or complex payload structures. The simplicity of the attack vector makes it particularly dangerous in environments where untrusted XML data is processed automatically by web services, API endpoints, or any application utilizing Expat for document validation and parsing.
The impact of this vulnerability extends beyond simple service interruption to include potential cascading failures within larger systems that rely on synchronous processing models. The excessive CPU consumption can lead to thread exhaustion, memory pressure due to prolonged allocation states, and eventual crash of the hosting process. In cloud-native or containerized environments, such resource starvation may trigger automatic restarts or scaling events, leading to increased operational costs and reduced availability for legitimate users. This aligns with ATT&CK technique T1496, Resource Hijacking, where attackers leverage computational resources to degrade service quality or cause outages without necessarily gaining unauthorized access to data or system controls.
Mitigation strategies must prioritize immediate patching of the Expat library to a version later than 2.8.3, as this issue has been addressed in subsequent releases through algorithmic optimizations that reduce the complexity of attribute processing. Organizations should also implement input validation and rate limiting at the network perimeter to restrict the size and structure of incoming XML payloads before they reach the parser layer. Additionally, deploying web application firewalls with rules specifically tuned for detecting anomalous XML structures can provide an additional layer of defense against such algorithmic attacks. Regular security audits focusing on third-party library dependencies are essential to ensure that known vulnerabilities like this quadratic complexity flaw do not persist in production environments.