Read the docs
TI-2026-76800 Aliases CVE-2026-113351GHSA-6r6q-9jmv-gg3h

Denial of service in libexpat via XML_ParserReset

Priority LOW 36CWE-909Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 1 fixed, 4 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.

Summary

libexpat from 2.7.2 through 2.9.0 is affected. XML_ParserReset clears the direct byte count but does not reset tracked heap allocations, a missing initialization of a resource (CWE-909). An unauthenticated remote attacker can submit a large XML document so that later documents on the same reset parser fail with out-of-memory errors until the parser is recreated.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

libexpat 2.7.2 through 2.9.0 contains a denial of service vulnerability because XML_ParserReset zeroes the direct byte count but never offsets tracked heap allocations. Attackers can submit a large XML document so later documents on the same reset parser fail with XML_ERROR_NO_MEMORY until it is recreated.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00494 42nd percentileScored 2026-11-07
Fix Partial Red Hat: 1 advisoryRed Hat: 1 fixed, 4 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
libexpat projectlibexpat2.7.2 – 2.9.0—No fix listedCNA
  • libexpat Vendorlibexpat project Affected 2.7.2 – 2.9.0 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:libexpat_project:libexpat:*:*:*:*:*:*:*:*2.7.2 – 2.9.0Vulnerablelibexpat project
  • cpe:2.3:a:libexpat_project:libexpat:*:*:*:*:*:*:*:* Versions 2.7.2 – 2.9.0 Vulnerable ·libexpat project

Remediation

The sources list no fixed version for libexpat. Red Hat advisory RHSA-2026:90325 fixes Red Hat Hardened Images. Red Hat Enterprise Linux 8, 9 and 10 are affected, with no plan available, and Red Hat OpenShift AI (RHOAI) is also affected.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Red Hat 1 advisory

  • RHSA-2026:90325 Released 2026-10-26 · Red Hat rating Moderate
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images expat-2.9.0-1.1.hum1@aarch64, expat-2.9.0-1.1.hum1@s390x, expat-2.9.0-1.1.hum1@src +7

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 10AffectedNo fix yet
Red Hat Enterprise Linux 8AffectedNo fix yet
Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat OpenShift AI (RHOAI)Affected—
Red Hat Hardened ImagesFixed RHSA-2026:90325
Not affected: 8 products
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 5

Timeline

  1. 2026-10-20 Threatist record created from CVE-2026-113351
  2. 2026-10-20 Alias added: GHSA-6r6q-9jmv-gg3h
  3. 2026-10-20 Affected versions changed · Red Hat
  4. 2026-10-20 CVSS score added · Red Hat
  5. 2026-10-20 CISA SSVC decision points changed
  6. 2026-10-20 Priority changed: MEDIUM → LOW
  7. 2026-10-30 Fix available: RHSA-2026:90325 · Red Hat
  8. 2026-10-30 Fix available: Red Hat Hardened Images · Red Hat
  9. 2026-10-30 Affected versions changed · Red Hat
  10. 2026-11-03 CVSS score added · NVD
  11. 2026-11-04 Affected versions changed · Red Hat
  12. 2026-11-04 Affected versions changed · Red Hat
  13. 2026-11-06 Affected versions changed · Red Hat

References

Patch 1

Other 3

  • TI-2022-09008 In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames. CVSS 3.1CRITICAL 9.8
  • TI-2026-79488 Billion laughs detection delay in libexpat enables denial of service CVSS 4.0HIGH 8.7
  • TI-2022-08947 xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert… CVSS 3.1CRITICAL 9.8
  • TI-2021-20962 In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the… CVSS 3.1HIGH 8.8
  • TI-2021-21076 In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for m_groupSize. CVSS 3.1HIGH 8.1
  • TI-2016-00645 Expat allows context-dependent attackers to cause a denial of service (crash) or possibly… CVSS 3.1CRITICAL 9.8
See all 67 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences