Summary
It was discovered that Expat used insufficient entropy when generating
hash salt values for its internal hash table. An attacker could use this
to craft an XML document that triggers hash flooding, leading to a
denial of service.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | expat | 2.1.0-7ubuntu0.16.04.5+esm12 |
Vulnerabilities 1
-
Low 2.9
libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document.
References
-
report
https://ubuntu.com/security/CVE-2026-41080