CVE-2026-41080
Analyzed Analyzed - Analysis Complete
Hash Flooding Vulnerability in libexpat XML Parser Before

Publication date: 2026-04-16

Last updated on: 2026-06-12

Assigner: MITRE

Description
libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-04-16
Last Modified
2026-06-12
Generated
2026-06-16
AI Q&A
2026-04-16
EPSS Evaluated
2026-06-15
NVD
CVE-2026-41080
EUVD
EUVD-2026-23276
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
libexpat_project libexpat to 2.8.0 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-331 The product uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in libexpat versions before 2.7.6. It is caused by the use of insufficient entropy in the library's processing, which allows an attacker to perform hash flooding by crafting a malicious XML document.

Impact Analysis

The vulnerability can lead to hash flooding attacks, which may cause a denial of service by making the XML processing consume excessive resources. According to the CVSS score, the impact on availability is low, and there is no impact on confidentiality or integrity.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-41080. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart