https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-09T20:36:46.563763+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2026-66046 CVE-2026-66046 — Expat Denial of Service via storeAtts() Quadratic Complexity 2026-10-09T20:36:46.597391+00:00

Affected: libexpat project libexpat

Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an O(N^2) linear scan of elementType->defaultAtts to determine CDATA status. A remote unauthenticated attacker can supply a single well-formed XML document of a few megabytes to an application parsing untrusted XML to cause excessive CPU consumption, resulting in denial of service without requiring authentication, external entity resolution, or non-default parser options.

 https://vulnerability.circl.lu/vuln/usn-8813-1 USN-8813-1 — expat vulnerabilities 2026-10-09T20:36:46.597502+00:00

Affected: Ubuntu:Pro:14.04:LTS: expat, Ubuntu:Pro:16.04:LTS: expat, Ubuntu:Pro:18.04:LTS: expat, Ubuntu:Pro:20.04:LTS: expat, Ubuntu:22.04:LTS: expat, Ubuntu:24.04:LTS: expat, Ubuntu:26.04:LTS: expat

It was discovered that Expat did not correctly handle certain integer arithmetic. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-56406, CVE-2026-56407, CVE-2026-56409, CVE-2026-56410, CVE-2026-56411)

It was discovered that Expat did not correctly track handler call depth. An attacker could possibly use this issue to cause Expat to crash or execute arbitrary code. (CVE-2026-56131)

It was discovered that Expat did not correctly handle certain memory operations. An attacker could possibly use this issue to cause Expat to crash or execute arbitrary code. (CVE-2026-56132)

It was discovered that Expat did not correctly handle certain Unicode characters. An attacker could possibly use this issue to cause Expat to use excessive resources, leading to a denial of service. (CVE-2026-72522)

It was discovered that Expat did not correctly process certain XML attributes. A remote attacker could possibly use this issue to cause Expat to use excessive resources, leading to a denial of service. (CVE-2026-66046)

It was discovered that Expat did not correctly handle certain external entities. An attacker could possibly use this issue to cause Expat to crash or execute arbitrary code. (CVE-2026-76641)

It was discovered that Expat did not correctly track handler call depth with custom encodings. An attacker could possibly use this issue to cause Expat to crash or execute arbitrary code. (CVE-2026-76957)