CVE-2026-45186

HighCVSS 7.5/10Last modified Nov 10, 2026

Description

In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-407

Affected software

VendorProductVersions
libexpat projectlibexpat< 2.8.1
Red HatRed Hat Enterprise Linux 10—
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat JBoss Core Services 2.4.62.SP4—
Red HatRed Hat Discovery 2—
Red HatRed Hat Discovery 2—
Red HatRed Hat Update Infrastructure 5—
Red HatRed Hat Update Infrastructure 5—
Red HatRed Hat Update Infrastructure 5—
Red HatRed Hat Update Infrastructure 5—
Red HatRed Hat Update Infrastructure 5—
Red HatRed Hat Update Infrastructure 5—
Red HatRed Hat Update Infrastructure 5—
Red HatRed Hat Enterprise Linux 10—
Red HatRed Hat Enterprise Linux 10—
Red HatRed Hat Enterprise Linux 6—
Red HatRed Hat Enterprise Linux 6—
Red HatRed Hat Enterprise Linux 7—
Red HatRed Hat Enterprise Linux 7—
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat Enterprise Linux 9—
SiemensSIMATIC S7-1500 CPU 1518-4 PN/DP MFP>= V3.1.5, < V3.1.6
SiemensSIMATIC S7-1500 CPU 1518-4 PN/DP MFP>= V3.1.5, < V3.1.6
SiemensSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP>= V3.1.5, < V3.1.6
SiemensSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP>= V3.1.5, < V3.1.6
SiemensSIPLUS S7-1500 CPU 1518-4 PN/DP MFP>= V3.1.5, < V3.1.6

References

Timeline

Published
May 10, 2026
Last modified
Nov 10, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-451876.5Improper Authorization vulnerability in Apache OFBiz Webtools. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to CVE-2026-451882.4Relative Path Traversal vulnerability in Apache Kvrocks. This issue affects Apache Kvrocks: from 1.0.0 through 2.15.0. Users are recommendCVE-2026-45193.3The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. NCVE-2026-451906.5Net::CIDR::Lite versions before 0.24 for Perl does not properly validate IP address and CIDR mask inputs, which may allow IP ACL bypass. InCVE-2026-451916.5Net::CIDR::Lite versions before 0.24 for Perl does not properly consider extraneous zero characters in CIDR mask values, which may allow IP CVE-2026-451926.5A bug in the GET `/api/v2/connections/{connection_id}` REST API endpoint in Apache Airflow allowed an authenticated UI/API user with ConnectCVE-2026-451957.8Kernel software installed and running inside a Host VM may post improper commands to the GPU Firmware to trigger a memory read or write outsCVE-2026-451967.8Kernel software installed and running inside a Host VM may post improper commands to the GPU Firmware to trigger a GPU register access whichCVE-2026-451972.5Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a read and/or write data oCVE-2026-451987.8Kernel software from a non-secure operating system on a platform with Trusted Execution Environment support, may cause GPU Firmware to boot CVE-2026-451997.8Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write of data outside thCVE-2026-452007.8Software installed and run as a non-privileged user may conduct improper GPU driver IOCTL calls to create an allocation scenario that when f