boxscore/security
CVE · referencelatest edition

Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-45186

CVE-2026-45186HIGH
libexpat project libexpat — In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized…
  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  N  N  H    7.5   .0048   39.2     —
AFFECTED
  Product   Versions     Fixed
  libexpat  unspecified  —
TIMELINE
  May 10  Reserved by mitre
  May 10  Published (CNA: mitre)
  Aug 25  EXPLOIT PUBLISHED — CVE-2026-45186 (libexpat project libexpat). Public exploit reference added.
  Aug 25  RESCORED — CVE-2026-45186 (libexpat project libexpat). CVSS 2.9 → 7.5 (NVD).
  Sep 16  EXPLOIT PUBLISHED — CVE-2026-45186 (libexpat project libexpat). Public exploit reference added.
CWE-407 · CNA: mitre · CVSS v3.1 · 13 references · NVD status: Modified

Description

In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input.

Lifecycle

Complete event history — 5 events, chronological
DateEventDetail
May 10, 2026ReservedReserved by mitre
May 10, 2026PublishedPublished (CNA: mitre)
August 25, 2026EXPLOIT PUBLISHEDEXPLOIT PUBLISHED — CVE-2026-45186 (libexpat project libexpat). Public exploit reference added.
August 25, 2026RESCOREDRESCORED — CVE-2026-45186 (libexpat project libexpat). CVSS 2.9 → 7.5 (NVD).
September 16, 2026EXPLOIT PUBLISHEDEXPLOIT PUBLISHED — CVE-2026-45186 (libexpat project libexpat). Public exploit reference added.

Affected

Affected products and packages — 1 row
VendorProduct / PackageEcosystemVersion introducedFixed
libexpat projectlibexpat———

Weaknesses

CWE-407

References (13)

Related

Authoritative record: CVE-2026-45186 at cve.org

Vendors: libexpat project

Weaknesses: CWE-407

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-45186 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.