High severity7.5NVD Advisory· Published Oct 22, 2026
CVE-2026-115506
CVE-2026-115506
Description
libexpat through 2.9.0 contains a denial of service vulnerability because billion laughs protection in accountingDiffTolerated() in xmlparse.c detects entity amplification too late. Attackers can supply a moderately sized XML document with a large DTD and nested entity expansions to consume tens of seconds of CPU per parse.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- Range: <=2.9.0
Patches
Vulnerability mechanics
References
3News mentions
0No linked articles in our index yet.