CVE-2026-76956

In libexpat 2.8.2 and 2.8.3, a flawed check of the getentropy() return code yields insufficient entropy for hash randomization, enabling remote, unauthenticated DoS via crafted XML. The fix is in libexpat 2.8.4; see the upstream PR at https://github.com/libexpat/libexpat/pull/1326. No in-the-wild...