Libexpat (<= 2.9.0)

libexpat through 2.9.0 is vulnerable to a denial of service attack because the billion laughs protection in accountingDiffTolerated() detects entity amplification too late.