CVE-2026-41080

Description

libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document.

Affected Platforms

Weakness Type

CWE-331

References

• https://blog.hartwork.org/posts/expat-2-8-0-released/
• https://github.com/libexpat/libexpat/issues/47
• https://github.com/libexpat/libexpat/pull/1183
• https://www.openwall.com/lists/oss-security/2026/04/26/1
• http://www.openwall.com/lists/oss-security/2026/04/26/1
• https://cert-portal.siemens.com/productcert/html/ssa-082556.html