CVE-2026-45186 LOW

CVE-2026-45186

Vendor Libexpat Project

Product libexpat

Weakness CWE-407

Published May 10, 2026

Last update June 30, 2026

View on NVD All CVEs

CVSS base score

2.9/10

Attack vector Local

Attack complexity High

Privileges required None

User interaction None

Confidentiality None

Integrity None

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

What the vulnerability does

01Description

In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input.

Key dates

02Disclosure timeline

May 10, 2026 CVE published

June 30, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-45186 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/407.html

Related vulnerabilities

04Related CVE

CVE-2026-11312 bytedance InfiniStore KV Map infinistore.h purge_kv_map algorithmic complexity CVE-2026-33033 Potential denial-of-service vulnerability in MultiPartParser via base64-encoded file upload CVE-2025-14831 Gnutls: gnutls: denial of service via excessive resource consumption during certificate verification CVE-2024-12243 Gnutls: gnutls impacted by inefficient der decoding in libtasn1 leading to remote dos CVE-2026-48959 IO::Uncompress::Unzip versions before 2.220 for Perl allow CPU exhaustion via per-byte read loop in fastForward