libexpat: Denial of service via billion laughs detection delay
Summary
libexpat through version 2.9.0 is an XML parsing library used by many applications and runtimes. Its billion laughs protection detects entity amplification too late, so a moderately sized XML document with a large DTD and nested entity expansions can consume tens of seconds of CPU per parse. An unauthenticated remote attacker who can submit XML to an affected service can therefore cause a denial of service, and repeated requests make the effect worse.
Affected
- libexpat 0 to 2.9.0 (per the CVE record and VulnCheck)
- Debian bookworm 2.5.0-1+deb12u5 and trixie 2.9.0-1~deb13u1 are listed as vulnerable
- Azure Linux expat 2.8.3-2 is also tracked
- Applications and runtimes that bundle libexpat may also be affected
Fixed in
Unknown. No fixed upstream libexpat version is confirmed in the sources. Debian lists the fix as unfixed.
Workaround
- Limit XML input size at the application or proxy layer
- Enforce request timeouts and CPU limits for XML-parsing services
- Reject untrusted DTDs where the application allows it
- The billion laughs parameters added in 2.9.0 may help, but this has not been confirmed for this flaw; test them in a lab first
Exploitation
- CISA SSVC: exploitation status 'poc', automatable: yes, technical impact: partial
- EPSS 0.00455 (low)
- Not marked as known exploited in the sources reviewed
- No public proof of concept found in the searches performed
Our recommendation
- Inventory systems and applications that use libexpat, including bundled copies in Python, Perl or container images
- Prioritise internet-facing services that parse untrusted XML, such as SOAP or XML APIs
- Apply limits on XML size, DTD handling and request timeouts now
- Install vendor updates as soon as a fixed version is published; check Debian and your distribution regularly
- Monitor services for CPU spikes and repeated slow XML requests
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE record advisory (VulnCheck) www.vulncheck.com
- Debian Security Tracker security-tracker.debian.org
- libexpat upstream issue 1160 github.com
- libexpat upstream pull request 1433 github.com
- libexpat repository github.com
- Azure Linux OSV entry vulners.com
- OSV Debian entry osv.dev
- Tenable CVE entry www.tenable.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 00:35.
Original description (NVD)
libexpat through 2.9.0 contains a denial of service vulnerability because billion laughs protection in accountingDiffTolerated() in xmlparse.c detects entity amplification too late. Attackers can supply a moderately sized XML document with a large DTD and nested entity expansions to consume tens of seconds of CPU per parse.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.