PT-2026-121580

CVE-2026-115506

Published

2026-10-22

Updated

2026-11-03

Description by

CVSS 4.0

8.7

High

MetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions libexpat versions prior to 2.9.1

Description A denial of service issue exists where the billion laughs protection in the accountingDiffTolerated() function within xmlparse.c detects entity amplification too late. This allows attackers to provide a moderately sized XML document containing a large Document Type Definition (DTD) and nested entity expansions, causing the system to consume significant CPU resources for tens of seconds during parsing.

Recommendations Update libexpat to version 2.9.1 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Hanno Böck

Shani Yosef

Vendors

Affected products

Weakness enumeration

CWE-776: Improper Restriction of Recursive Entity References in DTDs (\'XML Entity Expansion\')