CVE-2026-76956

A flaw was found in libexpat. This vulnerability arises from the software misinterpreting a return code, leading to insufficient randomness (entropy) for hash functions. A remote attacker could exploit this by sending specially crafted XML content, triggering hash flooding attacks. This can result in a denial of service (DoS), making the affected system or application unavailable to legitimate users.

Red Hat ships libexpat (packaged as "expat") across many products. This vulnerability was introduced in libexpat 2.8.2. Most Red Hat products ship expat versions prior to 2.8.2 and are therefore not affected. Only products shipping expat 2.8.2 or 2.8.3 are vulnerable to this hash flooding denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

There is no mitigation for this flaw other than updating to libexpat 2.8.4 or later.