libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document.

🗓️ 18 Apr 2026 08:01:25Reported by MicrosoftType

Libexpat before 2.8.0 uses insufficient entropy, causing hash flooding from crafted XML documents.

Reporter	Title	Published	Views	Family All 54
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities have been identified in IBM HTTP Server shipped with IBM DevOps Code ClearCase [CVE-2026-24072, CVE-2026-28780, CVE-2026-34059, CVE-2026-33523, CVE-2026-41080, CVE-2026-33857, CVE-2026-34032]	22 May 202605:57	–	ibm
IBM Security Bulletins	Security Bulletin: IBM HTTP Server is affected by multiple vulnerabilities	11 May 202622:12	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities have been identified in IBM HTTP Server shipped with IBM WebSphere Remote Server	18 May 202615:31	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities within IBM HTTP Server, affect IBM Tivoli Monitoring.	8 Jun 202616:44	–	ibm
FreeBSD	(lib)expat -- Insufficient entropy	16 Apr 202600:00	–	freebsd
ATTACKERKB	CVE-2026-41080	16 Apr 202616:52	–	attackerkb
Tenable Nessus	Amazon Linux 2023 : firefox (ALAS2023-2026-1706)	16 May 202600:00	–	nessus
Tenable Nessus	Amazon Linux 2 : thunderbird, --advisory ALAS2-2026-3306 (ALAS-2026-3306)	27 May 202600:00	–	nessus
Tenable Nessus	Amazon Linux 2 : firefox, --advisory ALAS2FIREFOX-2026-059 (ALASFIREFOX-2026-059)	27 May 202600:00	–	nessus
Tenable Nessus	Fedora 44 : mingw-expat (2026-163d1fe6c0)	20 May 202600:00	–	nessus