libexpat through 2.9.0 contains a denial of service vulnerability because billion laughs protection in accountingDiffTolerated() in xmlparse.c detects entity amplification too late. Attackers can supply a moderately sized XML document with a large DTD and nested entity expansions to consume tens of seconds of CPU per parse.

Multiple Vulnerabilities in Libexpat

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-a83294f5ab advisory.

    Update to 2.9.0, fixes CVE-2026-115506.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - libexpat through 2.9.0 contains a denial of service vulnerability because billion laughs protection in
    accountingDiffTolerated() in xmlparse.c detects entity amplification too late. Attackers can supply a
    moderately sized XML document with a large DTD and nested entity expansions to consume tens of seconds of
    CPU per parse. (CVE-2026-115506)

The version of expat installed on the remote host is prior to 2.10.0. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2026-306-01 advisory.

    New expat packages are available for Slackware 15.0 and -current to fix security issues.

Tenable has extracted the preceding description block directly from the expat security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - libexpat 2.7.2 through 2.9.0 contains a denial of service vulnerability because XML_ParserReset zeroes the
    direct byte count but never offsets tracked heap allocations. Attackers can submit a large XML document so
    later documents on the same reset parser fail with XML_ERROR_NO_MEMORY until it is recreated.
    (CVE-2026-113351)

  - libexpat through 2.9.0 contains a denial of service vulnerability because billion laughs protection in
    accountingDiffTolerated() in xmlparse.c detects entity amplification too late. Attackers can supply a
    moderately sized XML document with a large DTD and nested entity expansions to consume tens of seconds of
    CPU per parse. (CVE-2026-115506)

  - libexpat through 2.9.0 contains a NULL pointer dereference vulnerability in externalEntityInitProcessor2()
    in lib/xmlparse.c that mishandles the XML_TOK_NONE token from empty input. Attackers who control stream
    chunking can force an empty non-final first parse on an external entity subparser, causing a later parse
    to crash the application. (CVE-2026-117610)

  - libexpat through 2.9.0 contains a signed integer overflow vulnerability in storeAtts() in lib/xmlparse.c
    that allows attackers to trigger out-of-bounds writes via oversized attribute counts. Attackers can supply
    a multi-gigabyte document with a start tag carrying over 2^30 attributes to overflow attIndex and
    nPrefixes, crashing applications or corrupting heap memory. (CVE-2026-118370)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - libexpat through 2.9.0 contains a denial of service vulnerability because billion laughs protection in     accountingDiffTolerated() in xmlparse.c detects entity amplification too late. Attackers can supply a     moderately sized XML document with a large DTD and nested entity expansions to consume tens of seconds of     CPU per parse. (CVE-2026-115506)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
378076	Fedora 43 : mingw-expat (2026-a83294f5ab)	Nessus	Fedora Local Security Checks	Local	high
478205	Chainguard: libexpat1, multiple expat packages: security update to 2.10.0-r0	Tenable Cloud Security	Chainguard Local Security Checks	Local	high
478205	Chainguard: libexpat1, multiple expat packages: security update to 2.10.0-r0	Tenable Self-Hosted Container Security	Chainguard Local Security Checks	Local	high
375415	Slackware Linux 15.0 / current expat Multiple Vulnerabilities (SSA:2026-306-01)	Nessus	Slackware Local Security Checks	Local	high
478182	Alpine: libexpat, multiple expat packages: security update to 2.10.0-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	high
478182	Alpine: libexpat, multiple expat packages: security update to 2.10.0-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	high
477143	Echo: expat: security update to 2.10.0-1	Tenable Cloud Security	Echo Local Security Checks	Local	high
477143	Echo: expat: security update to 2.10.0-1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
371288	Linux Distros Unpatched Vulnerability : CVE-2026-115506	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-115506

high

Tenable Plugins

Coming Soon

high

high

high

high

high

high

high

high

high