CVE-2026-66046: Expat XML Parser DOS Vulnerability

CVE-2026-66046 Overview

CVE-2026-66046 is a denial of service vulnerability in the Expat XML parser library through version 2.8.3. The flaw resides in the storeAtts() function in xmlparse.c, which performs an O(N^2) linear scan of elementType->defaultAtts when processing attributes with non-normalized values. A remote unauthenticated attacker can submit a single well-formed XML document of a few megabytes to trigger excessive CPU consumption. Exploitation does not require authentication, external entity resolution, or non-default parser options. The issue is classified under [CWE-407: Inefficient Algorithmic Complexity].

Critical Impact
Any application parsing untrusted XML with Expat can be forced into sustained high CPU load, degrading or halting service availability.

Affected Products

libexpat (Expat XML parser) through version 2.8.3
Applications and language runtimes bundling Expat for XML parsing
Downstream distributions shipping vulnerable Expat releases

Discovery Timeline

2026-08-18 - CVE-2026-66046 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-66046

Vulnerability Analysis

The defect is an algorithmic complexity flaw in Expat's attribute-processing path. When Expat encounters an element with N attributes whose values are not normalized, storeAtts() iterates each attribute and performs a linear search across elementType->defaultAtts to determine whether the attribute is declared as CDATA. The nested behavior yields quadratic runtime relative to attribute count. Because attribute counts in a single element are bounded only by document size, a compact multi-megabyte XML payload can drive CPU utilization to saturation on a single core. The parser blocks on synchronous work, so a single request can stall a worker thread until the payload is fully processed.

Root Cause

The root cause is the absence of an efficient lookup structure for default attribute declarations inside storeAtts(). Instead of using a hash table or presorted index, Expat rescans elementType->defaultAtts for every input attribute. This design assumption breaks when attacker-controlled input can inflate the attribute list arbitrarily within a well-formed document that already passes structural validation.

Attack Vector

An unauthenticated remote attacker delivers a crafted XML document to any endpoint that parses XML using Expat with default options. The document contains a single element populated with a large number of attributes bearing non-normalized values. No external entities, DTD fetches, or unusual parser flags are required. The attacker's cost is one HTTP request of a few megabytes; the victim's cost is prolonged CPU work per request. Repeated submissions across worker processes produce a full denial of service. See the VulnCheck Advisory on Expat DoS for exploitation characteristics.

Detection Methods for CVE-2026-66046

Indicators of Compromise

Sustained single-core CPU saturation in processes linked against libexpat following inbound XML requests.
Inbound XML payloads of several megabytes containing a single element with an unusually large attribute count.
Increased request latency or worker thread starvation coinciding with XML endpoint traffic.

Detection Strategies

Inspect XML request bodies for elements exceeding a reasonable attribute-count threshold before dispatching to the parser.
Instrument XML parsing paths with per-request CPU-time budgets and log outliers for review.
Correlate high CPU events on API gateways with request source IP, URI, and content length to surface abusive callers.

Monitoring Recommendations

Track process-level CPU time for services that expose XML endpoints and alert on sustained deviations.
Monitor Expat library versions across the fleet using software bill of materials data to identify unpatched instances.
Log rejected or truncated XML documents at the WAF or ingress layer for retrospective threat hunting.

How to Mitigate CVE-2026-66046

Immediate Actions Required

Inventory all applications and containers that link against libexpat through version 2.8.3.
Apply the upstream fix once a patched Expat release is available and rebuild dependent packages.
Enforce request size limits and attribute-count ceilings on XML ingress points until patches are deployed.
Rate-limit unauthenticated XML endpoints and isolate parsing workers behind CPU quotas.

Patch Information

The upstream fix is tracked in GitHub Pull Request #1321 against the libexpat repository. Consult distribution advisories for backported updates and rebuild any statically linked binaries. Language runtimes and applications that vendor Expat, including several Python, PHP, and Perl XML modules, must be updated independently once their maintainers ship refreshed builds.

Workarounds

Reject XML documents above a defined size threshold at the load balancer or WAF before they reach the parser.
Enforce a maximum attribute count per element in a pre-parsing validation step.
Run XML parsing in sandboxed workers with strict CPU-time limits so a single request cannot exhaust shared capacity.
Disable XML endpoints that accept untrusted input where XML support is not required.

bash

# Configuration example: nginx request size ceiling for XML endpoints
client_max_body_size 512k;
limit_req_zone $binary_remote_addr zone=xmlzone:10m rate=5r/s;

location /api/xml {
    limit_req zone=xmlzone burst=10 nodelay;
    proxy_read_timeout 5s;
    proxy_pass http://xml_backend;
}