5.9
Moyenne
CVE-2026-76956 In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to insufficient entropy,…
Description
In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to insufficient entropy, which results in being vulnerable to hash flooding attacks, causing a denial of service via crafted XML content.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| libexpat 2.8 | 2.8.2 → < 2.8.4 | 2.8.4 |
Autres CVE de libexpat
Les 26 CVE de libexpat →
CVE-2026-76957
libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks
4.9
Moyenne
CVE-2026-66046
Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the…
8.7
Élevée
CVE-2026-72522
libexpat before 2.8.3 has an out-of-bounds read and resultant infinite loop because low surrogates are treated the…
6.2
Moyenne
CVE-2026-56412
libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call depth…
4.9
Moyenne