Description

Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an O(N^2) linear scan of elementType->defaultAtts to determine CDATA status. A remote unauthenticated attacker can supply a single well-formed XML document of a few megabytes to an application parsing untrusted XML to cause excessive CPU consumption, resulting in denial of service without requiring authentication, external entity resolution, or non-default parser options.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-18T15:16:57.000Z",
  "pubdate": "2026-08-18T15:16:57.000Z",
  "executiveSummary": "A denial of service vulnerability exists in Expat through 2.8.3, stemming from algorithmic complexity issues within the attribute parsing logic.\nThe vulnerability is characterized by quadratic algorithmic complexity during the processing of specified attributes with non-normalized values.\nAffected systems include applications utilizing the Expat XML parser to process untrusted XML input.\nThe risk implication is severe CPU resource exhaustion leading to application denial of service.\nA remote, unauthenticated attacker can exploit this flaw by supplying a single, well-formed XML document of a few megabytes.\nExploitation does not require authentication, external entity resolution, or the modification of non-default parser options.",
  "technicalDetails": "The root cause of the vulnerability resides in the storeAtts() function located in xmlparse.c.\nWhen processing N specified attributes containing non-normalized values, the function triggers an O(N^2) linear scan of elementType->defaultAtts to determine CDATA status.\nThe vulnerable component is the attribute handling and storage mechanism within the Expat XML parser library, affecting versions through 2.8.3.\nAttack execution begins when a remote, unauthenticated attacker transmits a meticulously crafted, well-formed XML document to an application that parses untrusted input.\nThe payload behavior leverages the quadratic complexity by packing the XML document with a high volume of specified attributes having non-normalized values.\nAs the parser evaluates each attribute, the repeated linear scans against defaultAtts consume disproportionate amounts of CPU cycles, scaling quadratically with the number of attributes.\nNo special privileges, authentication credentials, or non-default parser configurations are necessary to trigger the condition.\nThe post-exploitation impact is a localized denial of service caused by resource starvation, rendering the host application unresponsive due to maximum CPU consumption."
}