CVE-2026-115506

7.5 HIGHpublic exploit available

Published 2026-10-22 · Updated 2026-10-23

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

libexpat through 2.9.0 contains a denial of service vulnerability because billion laughs protection in accountingDiffTolerated() in xmlparse.c detects entity amplification too late. Attackers can supply a moderately sized XML document with a large DTD and nested entity expansions to consume tens of seconds of CPU per parse.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses

CWE-776

Public exploit & PoC references

https://github.com/hannob/lololol
https://github.com/libexpat/libexpat
https://github.com/libexpat/libexpat/issues/1160
https://github.com/libexpat/libexpat/pull/1433

All references

https://github.com/hannob/lololol
https://github.com/libexpat/libexpat
https://github.com/libexpat/libexpat/issues/1160
https://github.com/libexpat/libexpat/pull/1433
https://www.vulncheck.com/advisories/libexpat-through-2.9.0-denial-of-service-via-billion-laughs-detection-delay

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

HIGHCVE-2026-108039
UNSCOREDCVE-2026-108086
UNSCOREDCVE-2026-108357PoC
UNSCOREDCVE-2026-108358PoC
MEDIUMCVE-2026-111252PoC
MEDIUMCVE-2026-74030PoC
MEDIUMCVE-2026-92001

Related by shared AI tags and CWE weakness class. Browse the full archive.