CVE-2026-66046 (High) detected in libexpatR_2_7_5

[mend-bolt-for-github]

CVE-2026-66046 - High Severity Vulnerability

Vulnerable Library - libexpatR_2_7_5

https://github.com/libexpat/libexpat

Library home page: https://github.com/sailfishos-mirror/libexpat.git

Found in base branches: stable/4.0, master

Vulnerable Source Files (1)

/contrib/expat/lib/xmlparse.c

Vulnerability Details

Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an O(N^2) linear scan of elementType->defaultAtts to determine CDATA status. A remote unauthenticated attacker can supply a single well-formed XML document of a few megabytes to an application parsing untrusted XML to cause excessive CPU consumption, resulting in denial of service without requiring authentication, external entity resolution, or non-default parser options.

Publish Date: 2026-08-18

URL: CVE-2026-66046

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

---

Step up your Open Source Security Game with Mend here