The libexpat XML parsing library prior to version 2.7.6 uses insufficient entropy in its hashing functions, which can be exploited by an attacker supplying a crafted XML document to trigger hash flooding. This can degrade performance or cause denial of service by overwhelming hash table operations. The CVSS 3.1 base score is 2.9, reflecting low impact with local attack vector, high attack complexity, no privileges required, no user interaction, and impact limited to availability. No official patch or remediation level is currently documented.

The vulnerability allows an attacker with local access to cause a denial of service condition through hash flooding, impacting availability. There is no impact on confidentiality or integrity. The low CVSS score and lack of known exploits indicate limited practical risk at this time.

Patch status is not yet confirmed — check the libexpat project advisory or official sources for updates on remediation. Until a fix is available, avoid processing untrusted XML documents with vulnerable versions of libexpat or implement external mitigations such as input validation or resource limiting in the XML processing environment.