The libexpat XML parsing library versions prior to 2.8.1 contain an inefficient algorithmic complexity issue (CWE-407) in the handling of attribute name collision checks. This flaw allows an attacker to craft XML input that causes excessive computational resource consumption, leading to a denial of service condition. The vulnerability has a CVSS 3.1 base score of 2.9, reflecting low severity due to local attack vector, high complexity, and no impact on confidentiality or integrity.

The vulnerability impacts availability by enabling denial of service through resource exhaustion when parsing specially crafted XML input. There is no impact on confidentiality or integrity. The attack requires local access and has high complexity, limiting the likelihood of exploitation. No known exploits are currently reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting exposure to untrusted XML input or applying application-level mitigations to detect and block suspicious XML data. Monitor libexpat project communications for updates on patches or official mitigations.