Medium [CVE-2026-76956] Denial of Service via hash flooding attack with crafted XML

In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to insufficient entropy, which results in being vulnerable to hash flooding attacks, causing a denial of service via crafted XML content. A flaw was found in libexpat.

This vulnerability arises from the software misinterpreting a return code, leading to insufficient randomness (entropy) for hash functions. A remote attacker could exploit this by sending specially crafted XML content, triggering hash flooding attacks.

This can result in a denial of service (DoS), making the affected system or application unavailable to legitimate users. Red Hat ships libexpat (packaged as "expat") across many products.

Most Red Hat products ship expat versions prior to 2.8.2 and are therefore not affected. Only products shipping expat 2.8.2 or 2.8.3 are vulnerable to this hash flooding denial of service.

Red Hat severity: Moderate — CVSS 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-331.

Affected Red Hat products: Red Hat Hardened Images. Red Hat lists Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat OpenShift Container Platform 4 as not affected.

Red Hat does not currently list a fixing RHSA for this CVE.