CVE-2026-113351

A flaw was found in expat. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by submitting a large XML document to an application that reuses parser instances. When the XML parser is reset using XML_ParserReset, it clears the direct byte count but fails to offset tracked heap allocations. Consequently, subsequent parsing operations on the reused parser fail with out-of-memory errors until the parser is completely recreated.

This vulnerability is rated as having Moderate impact because successful exploitation is limited to a denial of service condition and requires applications to explicitly reuse parser handles using parser reset functions rather than reallocating them for fresh inputs. In typical Red Hat Enterprise Linux environments, most services and system utilities instantiate fresh parser contexts for incoming data streams, significantly reducing exposure. In the worst case, an affected service fails to parse subsequent documents until restarted, with no risk of code execution or data leakage.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.