{"id":"CVE-2026-113351","title":"expat: expat: Denial of Service via improper memory tracking in XML_ParserReset (CVE-2026-113351)","summary":"A flaw was found in expat. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by submitting a large XML document to an application that reuses parser instances. When the XML parser is reset using XML_ParserReset…","severity":"medium","cvss":5.9,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"vendor","cwe":["CWE-459","CWE-909"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","affected":["enterprise_linux 10","enterprise_linux 6","enterprise_linux 7","enterprise_linux 8","enterprise_linux 9","hardened_images","openshift_container_platform 4"],"published":"2026-10-20","updated":"2026-10-20","sourceUpdated":"2026-10-20T11:40:56+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-113351.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-113351.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-113351"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2556110"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-113351"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113351"},{"url":"https://github.com/libexpat/libexpat"},{"url":"https://github.com/libexpat/libexpat/blob/a76b1174c1ea52abb639a4c69d52b630a8a106a2/expat/lib/xmlparse.c#L1560"},{"url":"https://github.com/libexpat/libexpat/blob/a76b1174c1ea52abb639a4c69d52b630a8a106a2/expat/lib/xmlparse.c#L860-L884"},{"url":"https://github.com/libexpat/libexpat/pull/1431"},{"url":"https://www.vulncheck.com/advisories/libexpat-2.7.2-through-2.9.0-denial-of-service-via-xml-parserreset"}],"tags":["csaf","vex","red-hat","cve.org"],"ingestedAt":"2026-10-20T12:05:07.320Z","slug":"CVE-2026-113351","body":"## Overview\n\nA flaw was found in expat. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by submitting a large XML document to an application that reuses parser instances. When the XML parser is reset using XML_ParserReset, it clears the direct byte count but fails to offset tracked heap allocations. Consequently, subsequent parsing operations on the reused parser fail with out-of-memory errors until the parser is completely recreated.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Hardened Images, … · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, … · updated 2026-10-20 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-113351.json)\n\n**expat: expat: Denial of Service via improper memory tracking in XML_ParserReset** — rated Moderate by Red Hat. Released 2026-10-20.\n\nAffected:\n\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 6\n- Red Hat Enterprise Linux 7\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n- Red Hat Hardened Images\n- Red Hat OpenShift Container Platform 4\n\nNo fix planned:\n\n- Red Hat Enterprise Linux 6\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 7\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n- Red Hat OpenShift Container Platform 4\n- Red Hat Hardened Images\n\n## Remediation\n\nOut of support scope","depth":"sunlit","depthScore":32,"depthScoreParts":{"impact":32.5,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}