Medium severity5.9NVD Advisory· Published Oct 20, 2026
CVE-2026-113351
CVE-2026-113351
Description
libexpat 2.7.2 through 2.9.0 contains a denial of service vulnerability because XML_ParserReset zeroes the direct byte count but never offsets tracked heap allocations. Attackers can submit a large XML document so later documents on the same reset parser fail with XML_ERROR_NO_MEMORY until it is recreated.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: 2.7.2 - 2.9.0
Patches
Vulnerability mechanics
References
4- github.com/libexpat/libexpat/blob/a76b1174c1ea52abb639a4c69d52b630a8a106a2/expat/lib/xmlparse.cnvd
- github.com/libexpat/libexpat/blob/a76b1174c1ea52abb639a4c69d52b630a8a106a2/expat/lib/xmlparse.cnvd
- github.com/libexpat/libexpat/pull/1431nvd
- www.vulncheck.com/advisories/libexpat-2.7.2-through-2.9.0-denial-of-service-via-xml-parserresetnvd
News mentions
0No linked articles in our index yet.