CVE-2026-117610

A flaw was found in expat. A remote attacker who controls input stream chunking can trigger a NULL pointer dereference by forcing an empty initial parse on an external entity subparser. Successful exploitation causes the application to crash, resulting in a Denial of Service (DoS).

This vulnerability is rated Moderate. Confirmed impact is denial of service (NULL dereference / crash) when an empty non-final first parse is performed on an external-entity subparser. Red Hat scores CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H (5.9): Attack Complexity is High because exploitation needs uncommon stream-chunking behavior together with external entity parsing, which is not the default posture for most RHEL XML consumers. Hardening (ASLR/NX/FORTIFY/SELinux) does not prevent the crash DoS; Availability remains High. No confidentiality or integrity impact is demonstrated.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Avoid enabling external entity / DTD processing for untrusted XML; prefer parsers configured without external entity resolution. Do not expose stream-chunked XML parse APIs to untrusted clients. Restrict network access to XML-processing services (CME-202 ↗, CME-203 ↗). Upgrade to libexpat 2.10.0 or later when available.