CVE-2026-66046

Expat (libexpat) through version 2.8.3 contains a denial-of-service flaw caused by quadratic algorithmic complexity in the storeAtts() function of xmlparse.c: when a document specifies N attributes with non-normalized values, the parser performs an O(N^2) linear scan of the element type's defaultAtts array to determine CDATA status. Because the flaw requires only default parser options, a remote unauthenticated attacker can trigger it by submitting a single well-formed XML document of just a few megabytes to any application that parses untrusted XML with libexpat; no authentication, external entity resolution, or non-default parser settings are needed. The attacker gains excessive CPU consumption that degrades or halts the affected service, with no data exposure, tampering, or code execution. Anyone running applications, services, or devices that embed or link libexpat to process attacker-controlled XML is affected, since the library ships by default with nearly all Linux distributions and is bundled in a vast number of applications, language bindings, and firmwares. Exploitation has not been observed in the wild (no KEV listing, EPSS ~0.6%), but public technical analyses and proof-of-concept references are available and the issue is rated 8.7 (high) under CVSS 4.0.

What to do: Upgrade libexpat to the first fixed release after 2.8.3 incorporating the storeAtts() fix (see upstream PR #1321) or apply your distribution's security patch. Inventory all copies of expat in the environment — including statically linked or bundled copies in applications and appliances that a system update will not reach — and, as interim mitigation, cap accepted XML payload sizes and attribute counts and enforce CPU/time limits on XML processing.