CVE-2026-76956
CVE-2026-76956: 1 tracked advisory record across Red Hat. Compare vendor sources and published fix guidance.
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
Vendor advisory comparison
Red Hat
1 advisory- Advisory severityMedium5.9
Medium [CVE-2026-76956] Denial of Service via hash flooding attack with crafted XML
CVE-2026-76956Source published Source updated
In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to insufficient entropy, which results in being vulnerable to hash flooding attacks, causing a denial of service via crafted XML content. A flaw was found in libexpat. This vulnerability arises from the software misinterpreting a return code, leading to insufficient randomness (entropy) for hash functions. A remote attacker could exploit this by sending specially crafted XML content, triggering hash flooding attacks. This can result in a denial of service (DoS), making the affected system or application unavailable to legitimate users. Red Hat ships libexpat (packaged as "expat") across many products. Most Red Hat products ship expat versions prior to 2.8.2 and are therefore not affected. Only…
- Affected products in this advisory
- Red Hat Hardened Images
- Source-reported affected versions
- < 2.8.2
- < 2.8.3
- < 2.8.4
- Source-reported fixed versions
- expat-main-2.8.3-0.1.1.hum1
- expat-main-2.8.4-0.1.hum1
- RHSA-2026:60451
- RHSA-2026:65568
- Mitigation guidance
- There is no mitigation for this flaw other than updating to libexpat 2.8.4 or later.
Android app · Google Play
Monitor future Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.