CVE-2026-66046 libexpat project CVE debrief

Who should care

Defenders responsible for systems that use Expat to parse untrusted XML should assess exposure and prioritize patching or mitigation. This includes operators of web applications, API services, or any software that relies on Expat for XML parsing. Vulnerability management and security teams should review the affected scope and implement compensating controls where necessary. Platform owners and security teams should also review relevant monitoring, and to

Why it matters

Defenders should care about CVE-2026-66046 because it can cause denial of service in systems that use Expat to parse untrusted XML. The vulnerability can be triggered by a remote, unauthenticated attacker supplying a crafted XML document, leading to excessive CPU consumption. Defenders responsible for systems that use Expat should assess exposure and prioritize patching or mitigation.

• Denial of service through excessive CPU consumption
• Potential for service disruption or degradation

Technical summary

The storeAtts() function in xmlparse.c has a quadratic algorithmic complexity that can be triggered by processing N specified attributes with non-normalized values in an XML document. This can cause excessive CPU consumption, leading to a denial of service. The vulnerability affects Expat through version 2.8.3 and can be exploited by a remote, unauthenticated attacker supplying a crafted XML document. The technical impact is significant, as it can lead to denial of service through excessive CPU consumption. Defenders should prioritize patching or mitigating this vulnerability, especially in systems that parse untrusted XML.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability, especially in systems that parse untrusted XML.

Recommended defensive actions

• Patch or upgrade to a version of Expat that is not vulnerable
• Implement input validation and sanitization for XML documents
• Consider using alternative XML parsing libraries or tools
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability, tracked as CVE-2026-66046, is caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c. This can be triggered by processing N specified attributes with non-normalized values in an XML document, leading to excessive CPU consumption and potential denial of service. A remote, unauthenticated attacker can exploit this by supplying a single well-formed XML document of a few megabytes to an application parsing untrusted XML. Evidence is limited to public CVE and NVD sources, which may not cover

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.