Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-66046

CVE-2026-66046HIGH

libexpat project libexpat — Expat Denial of Service via storeAtts() Quadratic Complexity

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   N   N   H    8.7   .0074   53.1     —

AFFECTED
  Product   Versions     Fixed
  libexpat  unspecified  —

TIMELINE
  Jul 23  Reserved by VulnCheck
  Aug 18  Published (CNA: VulnCheck)
  Sep 18  EXPLOIT PUBLISHED — CVE-2026-66046 (libexpat project libexpat). Public exploit reference added.

CWE-407 · CNA: VulnCheck · CVSS v4.0 · 2 references · NVD status: Analyzed

Description

Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an O(N^2) linear scan of elementType->defaultAtts to determine CDATA status. A remote unauthenticated attacker can supply a single well-formed XML document of a few megabytes to an application parsing untrusted XML to cause excessive CPU consumption, resulting in denial of service without requiring authentication, external entity resolution, or non-default parser options.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
July 23, 2026	Reserved	Reserved by VulnCheck
August 18, 2026	Published	Published (CNA: VulnCheck)
September 18, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-66046 (libexpat project libexpat). Public exploit reference added.

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
libexpat project	libexpat	—	—	—

Weaknesses

CWE-407

References (2)

https://github.com/libexpat/libexpat/pull/1321 [issue-tracking]
https://www.vulncheck.com/advisories/expat-denial-of-service-via-storeatts-quadratic-complexity [third-party-advisory]

Authoritative record: CVE-2026-66046 at cve.org

Vendors: libexpat project

Weaknesses: CWE-407

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-66046 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.