libexpat: Denial of Service via XML_ParserReset
Summary
libexpat versions 2.7.2 through 2.9.0 contain a denial-of-service vulnerability (CWE-909) in XML_ParserReset. The reset clears the direct byte count but not the tracked heap allocations. After a large XML document, later documents on the same reset parser fail with XML_ERROR_NO_MEMORY until the parser is recreated. Exposure exists when software parses untrusted XML over the network with long-lived, reused parser objects, and no authentication is required. No code execution or data access is described.
Affected
- libexpat 2.7.2 to 2.9.0 (upstream range per NVD and VulnCheck)
- Debian's tracker also lists bookworm 2.5.0-1+deb12u5 and trixie 2.8.3 as vulnerable; the reason is not stated, so verify with Debian
Fixed in
- Upstream fix in PR #1431; third-party reports say it is merged
- Expat 2.9.1 is planned (ETA 2026-10-26), but its release could not be verified
- Debian marks trixie and bookworm as unfixed
- Unknown: no vendor advisory with fixed version numbers found
Workaround
- No official workaround.
- Stop reusing parser objects after large documents, or recreate the parser instead of resetting it.
Exploitation
- No known exploitation in the wild; no CISA KEV listing found.
- CISA SSVC: exploitation none, not automatable, partial technical impact.
- The maintainer's PR describes a reproduction with default settings. EPSS is 0.00474.
Our recommendation
- Identify software that bundles libexpat 2.7.2 to 2.9.0 and check whether it reuses parser objects across requests.
- Ask software vendors for their patch status and apply updates as soon as they are available.
- Monitor the libexpat releases page and the Debian security tracker.
- Priority: medium.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Debian Security Tracker: CVE-2026-113351 security-tracker.debian.org
- VulnCheck advisory: libexpat 2.7.2 through 2.9.0 DoS via XML_ParserReset www.vulncheck.com
- libexpat PR #1431: Fix parser reset github.com
- libexpat releases github.com
- Tenable: CVE-2026-113351 www.tenable.com
- VulDB: CVE-2026-113351 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 15:34.
Original description (NVD)
libexpat 2.7.2 through 2.9.0 contains a denial of service vulnerability because XML_ParserReset zeroes the direct byte count but never offsets tracked heap allocations. Attackers can submit a large XML document so later documents on the same reset parser fail with XML_ERROR_NO_MEMORY until it is recreated.
NVD references (5)
- https://github.com/libexpat/libexpat
- https://github.com/libexpat/libexpat/blob/a76b1174c1ea52abb639a4c69d52b630a8a106a2/expat/lib/xmlparse.c#L1560
- https://github.com/libexpat/libexpat/blob/a76b1174c1ea52abb639a4c69d52b630a8a106a2/expat/lib/xmlparse.c#L860-…
- https://github.com/libexpat/libexpat/pull/1431
- https://www.vulncheck.com/advisories/libexpat-2.7.2-through-2.9.0-denial-of-service-via-xml-parserreset
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.