The vulnerability in libexpat (up to version 2.8.3) is caused by quadratic algorithmic complexity in the storeAtts() function within xmlparse.c. When parsing XML documents containing N specified attributes with non-normalized values, the function performs an O(N^2) linear scan of elementType->defaultAtts to determine CDATA status. This inefficiency can be exploited remotely by an unauthenticated attacker who supplies a single well-formed XML document of a few megabytes, leading to excessive CPU consumption and denial of service. The attack does not require authentication, external entity resolution, or non-default parser options.

A remote unauthenticated attacker can cause a denial of service by sending a specially crafted XML document that triggers excessive CPU consumption due to the quadratic complexity in attribute processing. This results in resource exhaustion and service disruption without needing any privileges or special parser configurations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. Until a fix is available, consider limiting exposure to untrusted XML inputs or applying application-level mitigations to detect and block large or suspicious XML documents.