CVE-2026-76956: libexpat Hash Flooding DoS Vulnerability

CVE-2026-76956 Overview

CVE-2026-76956 affects libexpat versions 2.8.2 and 2.8.3 before 2.8.4. The library misinterprets the return code of getentropy(), which produces insufficient entropy during hash table initialization. Attackers exploit this weakness by submitting crafted XML content that triggers hash flooding, degrading parser performance to the point of denial of service.

Critical Impact
Remote attackers can cause denial of service against applications parsing untrusted XML through libexpat, exhausting CPU resources without requiring authentication or user interaction.

Affected Products

libexpat 2.8.2
libexpat 2.8.3
Applications embedding libexpat prior to version 2.8.4

Discovery Timeline

2026-08-20 - CVE CVE-2026-76956 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-76956

Vulnerability Analysis

The flaw resides in how libexpat interprets the return value of getentropy(). The library treats the return code incorrectly, causing the hash seed to be initialized with predictable or insufficient randomness. This misuse falls under [CWE-394] (Unexpected Status Code or Return Value).

When the hash seed lacks sufficient entropy, an attacker can precompute XML element names, attributes, or entity references that collide within libexpat's internal hash tables. Repeated collisions degrade hash table lookups from expected constant time to linear time, forcing the parser into pathological performance behavior.

The result is a hash flooding attack. A single crafted XML document can consume disproportionate CPU cycles inside any application relying on libexpat for XML parsing.

Root Cause

The root cause is the misinterpretation of getentropy()'s return code. The getentropy() function returns 0 on success and -1 on failure. Incorrect handling of this contract causes the entropy source to be effectively unused, leaving the hash seed weak and predictable.

Attack Vector

Exploitation requires no authentication and no user interaction. An attacker delivers crafted XML content to any network-facing service that parses XML through the vulnerable libexpat versions. The parser then consumes CPU resources processing hash collisions, denying service to legitimate requests.

No verified public exploit code has been released. The upstream fixes are documented in libexpat Pull Request #1326 and libexpat Pull Request #1329.

Detection Methods for CVE-2026-76956

Indicators of Compromise

Sustained CPU spikes in processes linked against libexpat when handling XML input from untrusted sources
XML payloads containing large numbers of unique element or attribute names sharing hash collisions
Slow response times or timeouts on endpoints that accept XML uploads or SOAP requests

Detection Strategies

Inventory installed libexpat versions across servers, containers, and bundled application dependencies to identify 2.8.2 and 2.8.3 instances
Monitor XML-parsing services for anomalous CPU utilization tied to specific request payloads
Inspect application logs for parser latency outliers correlated with inbound XML traffic

Monitoring Recommendations

Alert on sustained single-thread CPU saturation in XML-processing services
Track request size and processing time distributions for XML endpoints to identify outliers
Integrate SBOM scanning into CI/CD pipelines to flag vulnerable libexpat versions before deployment

How to Mitigate CVE-2026-76956

Immediate Actions Required

Upgrade libexpat to version 2.8.4 or later across all systems and container images
Rebuild and redistribute applications that statically link libexpat after upgrading the library
Apply distribution security updates as vendors publish patched packages

Patch Information

The fix is included in libexpat 2.8.4. The corrective changes are tracked in libexpat Pull Request #1326 and libexpat Pull Request #1329, which correct handling of the getentropy() return value and restore proper hash seed initialization.

Workarounds

Restrict XML input size and enforce request rate limits on services that parse untrusted XML
Place XML-parsing services behind a validating gateway that rejects malformed or oversized documents
Isolate XML processing workloads so that a single abusive request cannot exhaust shared resources

bash

# Verify installed libexpat version on Linux
ldconfig -p | grep libexpat
rpm -q expat   # RHEL / CentOS / Fedora
dpkg -l | grep expat   # Debian / Ubuntu

# Upgrade to a fixed version
sudo apt-get update && sudo apt-get install --only-upgrade libexpat1
sudo dnf upgrade expat