In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to insufficient entropy, which results in being vulnerable to hash flooding attacks, causing a denial of service via crafted XML content.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity
    in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized
    values triggers an O(N^2) linear scan of elementType->defaultAtts to determine CDATA status. A remote
    unauthenticated attacker can supply a single well-formed XML document of a few megabytes to an application
    parsing untrusted XML to cause excessive CPU consumption, resulting in denial of service without requiring
    authentication, external entity resolution, or non-default parser options. (CVE-2026-66046)

  - Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory
    corruption by processing XML with external entity parsers created via XML_ExternalEntityParserCreate. A
    struct size mismatch between ELEMENT_TYPE members causes storeAtts to read the attIndex member past
    allocated memory boundaries, resulting in failure to normalize whitespace in non-CDATA attributes or a
    wild pointer dereference causing a segfault. This vulnerability was introduced by the fix for
    CVE-2026-66046. (CVE-2026-76641)

  - In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to
    insufficient entropy, which results in being vulnerable to hash flooding attacks, causing a denial of
    service via crafted XML content. (CVE-2026-76956)

  - libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-
    free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412.
    (CVE-2026-76957)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to     insufficient entropy, which results in being vulnerable to hash flooding attacks, causing a denial of     service via crafted XML content. (CVE-2026-76956)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
447379	Alpine: libexpat, multiple expat packages: security update to 2.8.4-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	high
447379	Alpine: libexpat, multiple expat packages: security update to 2.8.4-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	high
338289	Linux Distros Unpatched Vulnerability : CVE-2026-76956	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-76956

high

Tenable Plugins

high

high

high