Expat Denial of Service Vulnerability (CVE-2026-66046)

Expat, a widely used C library for parsing XML, contains a denial of service (DoS) vulnerability in versions up to 2.8.3. The issue stems from the storeAtts() function within xmlparse.c, which exhibits quadratic algorithmic complexity. When the parser processes an XML document containing a large number of attributes with non-normalized values, it triggers an O(N^2) linear scan of the elementType->defaultAtts structure to determine CDATA status. An unauthenticated remote attacker can exploit this by submitting a specially crafted, well-formed XML document of only a few megabytes. This input forces the parser to consume excessive CPU resources, leading to service degradation or complete denial of service. The vulnerability does not require external entity resolution or specific non-default parser settings, making it easily exploitable in any application that processes untrusted XML data using affected Expat versions.

Impact

The vulnerability poses a high risk to any service or application utilizing the Expat library for processing incoming XML data. Successful exploitation results in high CPU utilization on the host system, which can cause significant latency or total service outage. Given the prevalence of Expat across various software ecosystems, the potential impact includes widespread disruption of critical infrastructure and business-critical applications. Because it requires only a few megabytes of data and no special configuration, the threshold for exploitation is low.

Recommendation

• Upgrade the Expat library to a patched version once released by the maintainers.
• Audit all applications and infrastructure components to identify those linking against libexpat versions up to 2.8.3.
• Implement request size limiting and resource quotas at the application or WAF layer to prevent processing of excessively complex or oversized XML documents.
• Monitor host-level CPU utilization for spikes associated with XML processing services to identify potential ongoing exploitation attempts.