CVE-2026-115506

Versions of libexpat through 2.9.0 are vulnerable to a Denial of Service (DoS) attack caused by a detection delay in the Billion Laughs protection mechanism. The root cause is located in the accountingDiffTolerated() function within xmlparse.c, which identifies entity amplification too late. An a...