CVE-2026-76956
Received Received - Intake

Hash Flooding DoS in libexpat XML Parser

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: MITRE

Description
In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to insufficient entropy, which results in being vulnerable to hash flooding attacks, causing a denial of service via crafted XML content.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-20
Last Modified
2026-08-20
Generated
2026-08-20
AI Q&A
2026-08-20
EPSS Evaluated
N/A
NVD
CVE-2026-76956
EUVD
EUVD-2026-63195

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
libexpat libexpat to 2.8.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-394 The product does not properly check when a function or operation returns a value that is legitimate for the function, but is not expected by the product.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in libexpat 2.8.2 and 2.8.3 involves incorrect handling of getentropy's return code. The function getentropy() returns 0 on success, but the code stored this value in a boolean variable, inverting the logic. This caused the system to discard proper entropy and fall back to weaker sources like time+pid, making it vulnerable to hash flooding attacks that can cause denial of service via crafted XML content.

Detection Guidance

To detect this vulnerability, check the version of libexpat installed on your system. Run: 'expat --version' or 'dpkg -l | grep expat' on Debian-based systems. If the version is 2.8.2 or 2.8.3, the system is vulnerable. Additionally, monitor for unusual CPU usage or crashes during XML processing, which may indicate hash flooding attempts.

Impact Analysis

This vulnerability can lead to denial of service attacks where an attacker sends specially crafted XML content to crash or slow down systems using affected versions of libexpat. It may also expose systems to hash flooding attacks due to insufficient entropy, potentially affecting performance and reliability of applications parsing XML.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling denial-of-service attacks through crafted XML content, disrupting services that handle sensitive data. Insufficient entropy may also affect security controls requiring randomness for encryption or authentication, though direct compliance impacts depend on system implementation and data processing context.

Mitigation Strategies

Immediately upgrade libexpat to version 2.8.4 or later. On Debian/Ubuntu, run: 'sudo apt update && sudo apt upgrade libexpat1'. For other systems, download the latest version from the official libexpat repository. After upgrading, restart any services using libexpat to ensure the fix is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-76956. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart