{"id":"CVE-2026-115506","kind":"vulnerability","aliases":["CVE-2026-115506"],"related":[],"title":"libexpat: late billion-laughs check lets XML cause long CPU stalls","description":"libexpat through 2.9.0 contains a denial of service vulnerability because billion laughs protection in accountingDiffTolerated() in xmlparse.c detects entity amplification too late. Attackers can supply a moderately sized XML document with a large DTD and nested entity expansions to consume tens of seconds of CPU per parse.","summary":"libexpat through 2.9.0 detects billion-laughs entity amplification too late (accountingDiffTolerated in xmlparse.c). A ~12 MB DTD with nested entities costs about 47 s CPU per parse, so any service parsing untrusted XML with DTDs can be stalled remotely (CVSS 3.1 7.5, v4 8.7). Fix (precomputing expanded entity sizes) is merged upstream on 2026-10-23 but not yet in a release.","severity":"high","cvss":8.7,"epss":0.0035,"exploited":false,"exploited_at":null,"products":[{"name":"libexpat","fixed":[],"affected":"<= 2.9.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["infrastructure","libexpat","perl","php","python","self-hosted"],"not_affected_if":["dtd-disabled","no-untrusted-xml","no-untrusted-xml-input"],"how_to_check":"Find the libexpat version in use: 'expat --version' / 'xmlwf -v', 'pkg-config --modversion expat', or 'python3 -c \"import pyexpat; print(pyexpat.EXPAT_VERSION)\"'. Any version <= 2.9.0 is affected. Also check bundled copies (Python, PHP, Perl XML::Parser, Apache, Firefox, etc.) and your distro's advisory. Only exposed if you parse untrusted XML with DTD/entity processing enabled.","fix":"No released fix yet. Upstream fix is PR #1433 (merge commit c30145b2), expected in Expat 2.10.0 (planned 2026-11-02). Until then: reject or disable DTDs/entity expansion for untrusted XML (e.g. defusedxml in Python), cap input size and parse CPU time/timeouts, or backport the patch if your distro ships one. Move to 2.10.0 or a distro patched build when available.","status":"open","published_at":"2026-10-22T20:17:06+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-23T22:35:09+00:00","updated_at":"2026-10-24T07:15:51+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-23T22:35:09Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"libexpat: late billion-laughs check lets XML cause long CPU stalls","impact":"low","summary":"libexpat through 2.9.0 detects entity expansion amplification too late in accountingDiffTolerated(). A moderately sized XML document with a large DTD and nested entities can consume tens of seconds of CPU per parse, which is a denial of service.","category":"infrastructure","who_cares":["libexpat","python","perl","php","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Parser ties up CPU for tens of seconds per request, causing denial of service.","analyst_note":"Source gives no fixed version; check the libexpat release notes and NVD CPE data for the patched release after 2.9.0.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-untrusted-xml-input"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000471,"input_tokens":2916,"output_tokens":358,"severity_before":"high"},"analyst_status":"done","analyst_note":"Source gives no fixed version; check the libexpat release notes and NVD CPE data for the patched release after 2.9.0.","search":"'-10':83B '-115506':15A,18A '-2026':14A,17A '-23':84B '12':43B '2.9.0':30B,93C '2026':82B '3.1':69B '47':51B '7.5':70B '8.7':72B 'accountingdifftoler':39B,105C 'amplif':36B,110C 'attack':113C 'billion':4A,33B,101C 'billion-laugh':3A,32B 'caus':9A 'check':6A 'consum':130C 'contain':94C 'cost':49B 'cpu':11A,53B,135C 'cve':13A,16A 'cvss':68B 'denial':96C 'detect':31B,108C 'document':120C 'dtd':45B,124C 'dtds':63B 'entiti':35B,48B,76B,109C,127C 'expand':75B 'expans':128C 'fix':73B 'host':27B 'infrastructur':20B 'larg':123C 'late':2A,38B,112C 'laugh':5A,34B,102C 'let':7A 'libexpat':1A,19A,21B,28B,91C 'long':10A 'mb':44B 'merg':79B 'moder':117C 'nest':47B,126C 'pars':55B,59B,137C 'per':54B,136C 'perl':22B 'php':23B 'precomput':74B 'protect':103C 'python':24B 'releas':90B 'remot':67B 'second':133C 'self':26B 'self-host':25B 'servic':58B,98C 'size':77B,118C 'stall':12A,66B 'suppli':115C 'ten':131C 'untrust':60B 'upstream':80B 'v4':71B 'vulner':99C 'xml':8A,61B,119C 'xmlparse.c':41B,107C 'yet':87B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T20:17:06+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-115506","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115506","severity":null,"published_at":"2026-10-22T20:17:06+00:00","modified_at":"2026-10-23T21:17:22+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-115506:486","url":null,"severity":null,"published_at":"2026-10-23T23:38:46+00:00","modified_at":"2026-10-23T23:38:46+00:00","first_seen_at":"2026-10-23T23:38:46+00:00","fetched_at":"2026-10-23T23:38:46+00:00","note":"CVE record + libexpat PR #1433: fix merged to master 2026-10-23 but NO released version yet; Expat 2.10.0 planned ETA 2026-11-02 (issue #1416, per PR timeline). 2.9.0 is latest release and affected. No in-the-wild exploitation found; finder Hanno Böck's fuzzer is public (not a ready PoC). Did not search social posts. Follow-up PRs #1436/#1439 touch the fix, so check 2.10.0 notes."},{"source":"epss","external_id":"CVE-2026-115506","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115506","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[{"id":2085,"url":"https://github.com/libexpat/libexpat/pull/1433","title":"libexpat PR #1433: Precompute entity expanded sizes (fix, merged 2026-10-23)","kind":"issue","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":2086,"url":"https://github.com/hannob/lololol","title":"hannob/lololol: billion laughs mutator/fuzzer (finder's tool)","kind":"poc","source":"analyst","text":null,"published_at":null,"relation":"poc","confidence":null,"note":null},{"id":2087,"url":"https://github.com/libexpat/libexpat/blob/master/expat/Changes","title":"libexpat Changes (latest release 2.9.0)","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":2088,"url":"https://www.cve.org/CVERecord?id=CVE-2026-115506","title":"CVE record CVE-2026-115506","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}