The libexpat XML parsing library prior to version 2.8.0 uses insufficient entropy in its hash function, making it vulnerable to hash flooding attacks. An attacker can craft a malicious XML document that triggers excessive hash collisions, potentially causing a denial of service by degrading performance. The CVSS 3.1 base score is 2.9, reflecting a low impact primarily on availability with local attack vector, high attack complexity, and no privileges or user interaction required.

This vulnerability allows an attacker with local access to supply a specially crafted XML document that causes hash flooding, leading to degraded performance or denial of service in applications using vulnerable libexpat versions. There is no impact on confidentiality or integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid processing untrusted XML documents with vulnerable versions of libexpat or implement application-level protections against hash flooding.