CVE-2026-41080

LowCVSS 2.9

Published: 16/04/2026(UTC)Updated: 14/07/2026(UTC)Translated: 16/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.38%

30th percentile - higher than 30% of all known CVEs

Summary

The vulnerability in libexpat before version 2.8.0 is due to insufficient entropy, allowing a hash flooding attack via a crafted XML document.

Risk Assessment

An attacker can exploit this vulnerability to overload the server or application processing XML, leading to denial of service (DoS) and potential disruption of system operations.

Recommendation

Immediately update the libexpat library to version 2.8.0 or later, which includes a fix that increases entropy.

Original NVD description (English source)

libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document.