Bug 2517901 (CVE-2026-66046) - CVE-2026-66046 expat: Expat: Denial of Service via quadratic complexity in attribute processing
Summary: CVE-2026-66046 expat: Expat: Denial of Service via quadratic complexity in at...
Keywords:
Status: NEW
Alias: CVE-2026-66046
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2533650 2533648
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-08-18 14:28 UTC by OSIDB Bzimport
Modified: 2026-11-11 11:59 UTC (History)
20 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2026:72619 0 None None None 2026-09-28 15:23:07 UTC
Red Hat Product Errata RHBA-2026:72622 0 None None None 2026-09-28 15:34:10 UTC
Red Hat Product Errata RHBA-2026:74151 0 None None None 2026-09-30 22:20:43 UTC
Red Hat Product Errata RHBA-2026:74467 0 None None None 2026-10-01 12:00:08 UTC
Red Hat Product Errata RHBA-2026:75686 0 None None None 2026-10-05 08:07:48 UTC
Red Hat Product Errata RHBA-2026:75766 0 None None None 2026-10-05 12:45:24 UTC
Red Hat Product Errata RHSA-2026:72448 0 None None None 2026-09-28 11:13:28 UTC
Red Hat Product Errata RHSA-2026:72663 0 None None None 2026-09-28 20:47:30 UTC
Red Hat Product Errata RHSA-2026:74001 0 None None None 2026-09-30 16:31:24 UTC
Red Hat Product Errata RHSA-2026:89197 0 None None None 2026-10-27 22:03:05 UTC
Red Hat Product Errata RHSA-2026:98478 0 None None None 2026-11-11 11:59:30 UTC
Red Hat Product Errata RHSA-2026:98582 0 None None None 2026-11-11 11:23:35 UTC

Description OSIDB Bzimport 2026-08-18 14:28:17 UTC 
Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an O(N^2) linear scan of elementType->defaultAtts to determine CDATA status. A remote unauthenticated attacker can supply a single well-formed XML document of a few megabytes to an application parsing untrusted XML to cause excessive CPU consumption, resulting in denial of service without requiring authentication, external entity resolution, or non-default parser options.
Comment 3 Jon Orris 2026-09-28 11:13:26 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:72448 https://access.redhat.com/errata/RHSA-2026:72448
Comment 4 Jon Orris 2026-09-28 20:47:28 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:72663 https://access.redhat.com/errata/RHSA-2026:72663
Comment 5 Jon Orris 2026-09-30 16:31:22 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:74001 https://access.redhat.com/errata/RHSA-2026:74001
Comment 7 Jon Orris 2026-10-27 22:03:03 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.22

Via RHSA-2026:89197 https://access.redhat.com/errata/RHSA-2026:89197
Comment 8 errata-xmlrpc 2026-11-11 11:23:31 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:98582 https://access.redhat.com/errata/RHSA-2026:98582
Comment 9 errata-xmlrpc 2026-11-11 11:59:28 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:98478 https://access.redhat.com/errata/RHSA-2026:98478
Note You need to log in before you can comment on or make changes to this bug.