Libexpat (<= 2.9.0) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/libexpat--2.9.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 23 Oct 2026 07:36:31 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svglibexpat: Denial of service via XML entity amplification (CVE-2026-115506)https://feed.craftedsignal.io/briefs/2026-10-libexpat-dos/Fri, 23 Oct 2026 07:36:31 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-libexpat-dos/libexpat through 2.9.0 is vulnerable to a denial of service attack because the billion laughs protection in accountingDiffTolerated() detects entity amplification too late.<p>libexpat through 2.9.0 contains a denial of service vulnerability because the billion laughs protection in accountingDiffTolerated() within xmlparse.c detects entity amplification too late. Attackers can supply a moderately sized XML document with a large DTD and nested entity expansions to consume tens of seconds of CPU per parse.</p> lowadvisory