CVE-2026-66046
Received Received - Intake

Expat XML Parser Denial of Service via Quadratic Complexity

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: VulnCheck

Description
Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an O(N^2) linear scan of elementType->defaultAtts to determine CDATA status. A remote unauthenticated attacker can supply a single well-formed XML document of a few megabytes to an application parsing untrusted XML to cause excessive CPU consumption, resulting in denial of service without requiring authentication, external entity resolution, or non-default parser options.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-08-18
AI Q&A
2026-08-18
EPSS Evaluated
N/A
NVD
CVE-2026-66046
EUVD
EUVD-2026-60821

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
libexpat libexpat to 2.8.4 (exc)
expat expat to 2.8.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-407 An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-66046 is a denial of service vulnerability in Expat versions through 2.8.3. It occurs due to quadratic algorithmic complexity in the storeAtts() function in xmlparse.c. When processing N attributes with non-normalized values, the function performs an O(N^2) linear scan of elementType->defaultAtts to check CDATA status. This causes excessive CPU consumption when parsing a well-formed XML document of a few megabytes.

Detection Guidance

To detect this vulnerability, monitor CPU usage spikes when processing XML files. Check if applications using Expat 2.8.3 or earlier show excessive CPU consumption with small XML inputs. Use tools like top, htop, or ps to observe CPU load during XML parsing tasks.

Impact Analysis

An attacker can exploit this by sending a single XML file to an application that parses untrusted XML. This causes high CPU usage, leading to denial of service. The attack requires no authentication, no external entity resolution, and no special parser options. It affects availability of the application processing the XML.

Mitigation Strategies

Immediately update Expat to version 2.8.4 or later, which fixes the quadratic complexity issue. If updating is not possible, restrict XML parsing to trusted sources only and limit input size to reduce attack surface. Consider switching to alternative XML parsers with better performance characteristics.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-66046. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart