In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input.

🗓️ 11 May 2026 08:03:23Reported by MicrosoftType

Libexpat before 2.8.1 allows denial of service via crafted XML due to attribute collision checks.

Reporter	Title	Published	Views	Family All 120
IBM Security Bulletins	Security Bulletin:IBM HTTP Server shipped with IBM OpenPages is vulnerable to multiple vulnerabilities	23 Jun 202617:57	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities have been identified in IBM HTTP Server shipped with IBM DevOps Code ClearCase.	8 Jun 202605:18	–	ibm
IBM Security Bulletins	Security Bulletin: IBM HTTP Server is affected by multiple vulnerabilities	26 May 202618:38	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image	29 Jun 202603:07	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in python (CVE-2026-45186) affects AIX/VIOS.	15 Jul 202607:52	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities have been identified in IBM HTTP Server shipped with IBM WebSphere Remote Server	28 May 202619:28	–	ibm
ATTACKERKB	CVE-2026-45186	10 May 202606:36	–	attackerkb
Tenable Nessus	Amazon Linux 2023 : firefox (ALAS2023-2026-1725)	27 May 202600:00	–	nessus
Tenable Nessus	Amazon Linux 2 : thunderbird, --advisory ALAS2-2026-3315 (ALAS-2026-3315)	27 May 202600:00	–	nessus
Tenable Nessus	Amazon Linux 2 : firefox, --advisory ALAS2FIREFOX-2026-060 (ALASFIREFOX-2026-060)	27 May 202600:00	–	nessus