CVE-2026-41080
It was discovered that Expat used insufficient entropy when generating hash salt values for its internal hash table. An attacker could use this to craft an XML document that triggers hash flooding, leading to a denial of service.
CSIRTS triage
- What
- Expat uses insufficient entropy for hash salt values, which can lead to denial of service through hash flooding.
- Who is affected
- Deployments of Expat that process XML documents are affected.
- Urgency
- Remediation is urgent due to the potential for denial of service attacks.
- Action
- Update to the latest version of Expat to resolve this issue.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch CVE-2026-41080
Get an email if CVE-2026-41080 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Low exploitation risk0.38% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 30% of all EPSS-scored CVEs.
Advisory coverage (2)
- low[UPDATE] [low] expat: Vulnerability allows Denial of Servicecert-bund · 2026-07-10
- unknownUSN-8520-1: Expat vulnerabilityubuntu · 2026-07-09
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-41080)