CVE-2026-66046

Name of the Vulnerable Software and Affected Versions Expat versions prior to 2.8.4

Description A denial of service issue exists due to quadratic algorithmic complexity within the storeAtts() function in xmlparse.c. When processing N specified attributes with non-normalized values, the system triggers an O(N^2) linear scan of elementType->defaultAtts to determine CDATA status. A remote unauthenticated attacker can cause excessive CPU consumption by providing a single well-formed XML document of a few megabytes to an application parsing untrusted XML.

Recommendations Update to version 2.8.4 or later.