---
id: CVE-2026-41080
title: >-
  libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can
  occur via a crafted XML document.
summary: >-
  libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can
  occur via a crafted XML document.
severity: low
cvss: 2.9
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L'
cvssSource: cna
cwe:
  - CWE-331
vendor: libexpat project
product: libexpat
affected:
  - libexpat < 2.8.0
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-04-18T02:32:34.525022Z'
published: '2026-04-16'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T01:18:28.535Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-41080'
references:
  - url: 'https://github.com/libexpat/libexpat/pull/1183'
  - url: 'https://github.com/libexpat/libexpat/issues/47'
  - url: 'https://www.openwall.com/lists/oss-security/2026/04/26/1'
  - url: 'https://blog.hartwork.org/posts/expat-2-8-0-released/'
tags:
  - cve.org
epss: 0.00398
epssPercentile: 0.32342
ingestedAt: '2026-10-15T05:52:46.019Z'
---

## Overview

libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document.

## Affected

- `libexpat < 2.8.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.