Live › vulnerability › CVE-2026-113351
Go to dashboardlibexpat versions 2.7.2 through 2.9.0 fail to reset a parser's heap accounting in XML_ParserReset, so a large XML document leaves the reset parser unable to allocate memory. Later documents parsed on that same parser fail with XML_ERROR_NO_MEMORY until the parser is recreated, which is a denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications and services that link libexpat 2.7.2 through 2.9.0 and parse untrusted XML with a long-lived parser that is reset and reused between documents. Systems that create a fresh parser per document, or that do not use libexpat, are not exposed to this issue.
No product ranges from the sources yet.
xmllint --version or check the bundled expat version with pkg-config --modversion expat on Linux systemsldd output on binaries or the expat package in your OS package manager2.9.0 once your OS or vendor ships it, the exact fixed version is unknown from the sourcesEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
libexpat 2.7.2 through 2.9.0 contains a denial of service vulnerability because XML_ParserReset zeroes the direct byte count but never offsets tracked heap allocations. Attackers can submit a large XML document so later documents on the same reset parser fail with XML_ERROR_NO_MEMORY until it is recreated.
This page as .md · .json · in your agent: get_signal("CVE-2026-113351")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.