Read the docs
TI-2026-33006 Aliases CVE-2026-45186GHSA-r396-2q2c-pjhr

In libexpat before 2.8.1, the computational complexity of attribute name collision checks…

Priority LOW 33CWE-407Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 12 fixed, 3 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-407.

Summary

In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00479 41st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial libexpat (libexpat project): 2.8.1Red Hat: 15 advisoriesRed Hat: 12 fixed, 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
libexpat projectlibexpatbefore 2.8.12.8.1Patch availableCNA
  • libexpat Vendorlibexpat project Affected before 2.8.1 Fixed in 2.8.1 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:libexpat_project:libexpat:*:*:*:*:*:*:*:*before 2.8.1Vulnerablelibexpat project
  • cpe:2.3:a:libexpat_project:libexpat:*:*:*:*:*:*:*:* Versions before 2.8.1 Vulnerable ·libexpat project

Remediation

  • Fix · CNA libexpat (libexpat project) Fixed in 2.8.1

Red Hat 15 advisories

  • RHSA-2026:95596 Released 2026-11-05 · Red Hat rating Important
    thunderbird security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) thunderbird-153.5.0-1.el9_6
  • RHSA-2026:95597 Released 2026-11-05 · Red Hat rating Important
    thunderbird security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream E4S (v.9.4) thunderbird-153.5.0-1.el9_4
  • RHSA-2026:93443 Released 2026-11-02 · Red Hat rating Important
    thunderbird security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 9) thunderbird-153.5.0-1.el9_8
Show 12 more Red Hat advisories
  • RHSA-2026:90895 Released 2026-10-27 · Red Hat rating Important
    thunderbird security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 10) thunderbird-153.5.0-1.el10_2
  • RHSA-2026:89757 Released 2026-10-26 · Red Hat rating Important
    firefox security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 9) firefox-153.5.0-1.el9_8, firefox-x11-153.5.0-1.el9_8
  • RHSA-2026:89756 Released 2026-10-26 · Red Hat rating Important
    firefox security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) firefox-153.5.0-1.el8_10
  • RHSA-2026:89758 Released 2026-10-26 · Red Hat rating Important
    firefox security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 10) firefox-153.5.0-1.el10_2
  • RHSA-2026:77236 Released 2026-10-07 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images expat-2.8.5-1.1.hum1@aarch64, expat-2.8.5-1.1.hum1@s390x, expat-2.8.5-1.1.hum1@src +7
  • RHSA-2026:58981 Released 2026-08-24 · Red Hat rating Critical
    Red Hat Update Infrastructure 5.3 Technology Preview security update
    • Red Hat Update Infrastructure 5 registry.redhat.io/rhui5/cds-kubernetes-tp-rhel9, registry.redhat.io/rhui5/installer-tp-rhel9, registry.redhat.io/rhui5/rhua-tp-rhel9
  • RHSA-2026:29197 Released 2026-06-24 · Red Hat rating Important
    A Subscription Management tool for finding and reporting Red Hat product usage
    • Red Hat Discovery 2 registry.redhat.io/discovery/discovery-server-rhel9, registry.redhat.io/discovery/discovery-ui-rhel9
  • RHSA-2026:27201 Released 2026-06-22 · Red Hat rating Important
    Red Hat JBoss Core Services Apache HTTP Server 2.4.62 SP4 security update
    • Red Hat JBoss Core Services 2.4.62.SP4
  • RHSA-2026:26319 Released 2026-06-16 · Red Hat rating Important
    Red Hat Update Infrastructure 5.2 security update
    • Red Hat Update Infrastructure 5 registry.redhat.io/rhui5/cds-rhel9, registry.redhat.io/rhui5/haproxy-rhel9, registry.redhat.io/rhui5/installer-rhel9 +1
  • RHSA-2026:23230 Released 2026-06-04 · Red Hat rating Important
    expat security update
    • Red Hat Enterprise Linux AppStream (v. 9) expat-devel-2.5.0-6.el9_8.1
    • Red Hat Enterprise Linux BaseOS (v. 9) expat-2.5.0-6.el9_8.1
  • RHSA-2026:22721 Released 2026-06-03 · Red Hat rating Important
    expat security update
    • Red Hat Enterprise Linux BaseOS (v. 8) expat-2.5.0-2.el8_10, expat-devel-2.5.0-2.el8_10
  • RHSA-2026:22715 Released 2026-06-03 · Red Hat rating Important
    expat security update
    • Red Hat Enterprise Linux AppStream (v. 10) expat-devel-2.7.3-1.el10_2.1
    • Red Hat Enterprise Linux BaseOS (v. 10) expat-2.7.3-1.el10_2.1

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix yet
Red Hat Enterprise Linux 7AffectedNo fix yet
Red Hat Enterprise Linux 8AffectedNo fix yet
Red Hat Discovery 2Fixed RHSA-2026:29197
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:22715, RHSA-2026:89758, RHSA-2026:90895
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:89756
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:23230, RHSA-2026:89757, RHSA-2026:93443
Red Hat Enterprise Linux AppStream E4S (v.9.4)Fixed RHSA-2026:95597
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2026:95596
Red Hat Enterprise Linux BaseOS (v. 10)Fixed RHSA-2026:22715
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2026:22721
Red Hat Enterprise Linux BaseOS (v. 9)Fixed RHSA-2026:23230
Red Hat Hardened ImagesFixed RHSA-2026:77236
Red Hat JBoss Core Services 2.4.62.SP4Fixed RHSA-2026:27201
Red Hat Update Infrastructure 5Fixed RHSA-2026:26319, RHSA-2026:58981
Not affected: 1 product
  • Red Hat Update Infrastructure 5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-45186
  2. 2026-10-03 Alias added: GHSA-r396-2q2c-pjhr
  3. 2026-10-07 Fix available: RHSA-2026:77236 · Red Hat
  4. 2026-10-07 Fix available: Red Hat Hardened Images · Red Hat
  5. 2026-10-09 Fix available: RHSA-2026:27201 · Red Hat
  6. 2026-10-09 Fix available: Red Hat JBoss Core Services 2.4.62.SP4 · Red Hat
  7. 2026-10-27 Affected versions changed · Red Hat
  8. 2026-10-29 Fix available: RHSA-2026:90895 · Red Hat
  9. 2026-10-31 Fix available: RHSA-2026:89758 · Red Hat
  10. 2026-10-31 Fix available: RHSA-2026:89757 · Red Hat
  11. 2026-10-31 Fix available: RHSA-2026:89756 · Red Hat
  12. 2026-10-31 Fix available: Red Hat Enterprise Linux AppStream (v. 8) · Red Hat
  13. 2026-11-02 Fix available: RHSA-2026:93443 · Red Hat
  14. 2026-11-02 Affected versions changed · Red Hat
  15. 2026-11-05 Fix available: Red Hat Enterprise Linux AppStream E4S (v.9.4) · Red Hat
  16. 2026-11-06 Fix available: Red Hat Enterprise Linux AppStream EUS (v.9.6) · Red Hat
  17. 2026-11-06 Fix available: RHSA-2026:95597 · Red Hat
  18. 2026-11-06 Fix available: RHSA-2026:95596 · Red Hat

References

Exploit 1

Advisory 1

  • TI-2022-09008 In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames. CVSS 3.1CRITICAL 9.8
  • TI-2026-79488 Billion laughs detection delay in libexpat enables denial of service CVSS 4.0HIGH 8.7
  • TI-2022-08947 xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert… CVSS 3.1CRITICAL 9.8
  • TI-2021-20962 In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the… CVSS 3.1HIGH 8.8
  • TI-2021-21076 In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for m_groupSize. CVSS 3.1HIGH 8.1
  • TI-2016-00645 Expat allows context-dependent attackers to cause a denial of service (crash) or possibly… CVSS 3.1CRITICAL 9.8
See all 67 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences