PT-2026-33342 · Libexpat · Libexpat

Sebastian Pipping · Published 2026-04-16 · Updated 2026-05-16 · CVE-2026-41080

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions libexpat versions prior to 2.7.6

Description The software uses insufficient entropy, which allows hash flooding to occur through a specially crafted XML document. Hash flooding is a technique where many different inputs are designed to produce the same hash value, causing a collision that degrades the performance of hash tables.

Recommendations Update to version 2.7.6.

Fix

Weakness Enumeration

CWE-331

Related Identifiers

CVE-2026-41080

ECHO-35D6-A603-460E

OESA-2026-2293

OESA-2026-2294

OESA-2026-2295

OPENSUSE-SU-2026:10787-1

RHSA-2026:11004

Affected Products

Libexpat

References · 25

• https://github.com/libexpat/libexpat/pull/1183 · Patch
• https://ubuntu.com/security/CVE-2026-41080 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2293 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-41080 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10787-1 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2294 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2295 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2026-41080 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-41080 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41080 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-41080 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-41080 · Vendor Advisory
• https://github.com/libexpat/libexpat/issues/47 · Note
• https://openwall.com/lists/oss-security/2026/04/26/1 · Note
• https://openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2293 · Note