PT-2026-39913 · Julia · Expat Jll

Published 2026-05-01 · Updated 2026-05-01

OSV

libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document.

Related Identifiers

JLSEC-2026-384

Affected Products

Expat Jll

References · 6

• https://osv.dev/vulnerability/JLSEC-2026-384 · Vendor Advisory
• https://github.com/libexpat/libexpat/pull/1183 · Note
• https://github.com/libexpat/libexpat/issues/47 · Note
• http://openwall.com/lists/oss-security/2026/04/26/1 · Note
• https://blog.hartwork.org/posts/expat-2-8-0-released · Note
• https://openwall.com/lists/oss-security/2026/04/26/1 · Note