CVE-2026-115506

What it actually does

The vulnerability allows a moderately sized XML document containing a large DTD and deeply nested entity expansions to bypass early amplification checks in accountingDiffTolerated(), resulting in excessive CPU consumption during parsing in libexpat through 2.9.0.

Why it matters to the business

Systems that parse untrusted XML may experience sudden resource exhaustion, leading to degraded performance, timeouts, or temporary service outages until the malicious input is processed.

How an attack unfolds

An attacker crafts an XML document with a large internal DTD and multiple layers of entity references that expand significantly, submits it to any service using the vulnerable parser, and forces the CPU-bound amplification to occur after the protection check has already passed.

How to fix it

Upgrade libexpat to the first release after 2.9.0 that corrects the late detection in accountingDiffTolerated(). Until a patched version is available, enforce strict limits on DTD size, entity expansion depth, and total parsed XML size at the application layer.

How to confirm the fix worked

Recompile or redeploy with the updated library and re-test using known amplification test cases to confirm CPU time remains bounded; monitor parser CPU metrics under load to verify exposure is removed.

Typical attack path

1. Locate an application endpoint or service that accepts and parses XML documents from untrusted sources
2. Generate a moderately sized XML payload containing an oversized DTD and nested entity expansions
3. Transmit the payload to the target parser
4. Observe sustained high CPU utilization on the affected process for tens of seconds per parse

How to detect it

Inspect application and system logs for spikes in CPU usage correlated with XML parsing activity; review inbound XML payloads for unusually large DTD sections or repeated entity references; correlate with process-level resource monitoring.

What your security team should do

• Prioritize updating libexpat in all products as soon as a fixed release is published
• Add defensive XML parsing controls (entity expansion limits, DTD disabling) where feasible
• Review and harden any public or internal endpoints that accept XML input