Live › vulnerability › CVE-2026-115506
Go to dashboardlibexpat through 2.9.0 detects billion-laughs entity amplification too late (accountingDiffTolerated in xmlparse.c). A ~12 MB DTD with nested entities costs about 47 s CPU per parse, so any service parsing untrusted XML with DTDs can be stalled remotely (CVSS 3.1 7.5, v4 8.7). Fix (precomputing expanded entity sizes) is merged upstream on 2026-10-23 but not yet in a release.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| libexpat | vendor | <= 2.9.0 | – |
expat --version / xmlwf -v, pkg-config --modversion expat, or python3 -c "import pyexpat; print(pyexpat.EXPAT_VERSION)"2.9.0 is affected2.10.0 (planned 2026-11-02)2.10.0 or a distro patched build when availableEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
libexpat through 2.9.0 contains a denial of service vulnerability because billion laughs protection in accountingDiffTolerated() in xmlparse.c detects entity amplification too late. Attackers can supply a moderately sized XML document with a large DTD and nested entity expansions to consume tens of seconds of CPU per parse.
This page as .md · .json · in your agent: get_signal("CVE-2026-115506")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.