The libexpat XML parsing library versions prior to 2.8.1 contain an inefficient algorithmic complexity issue in the attribute name collision checking mechanism. This flaw allows an attacker to cause a denial of service by submitting moderately sized crafted XML input that triggers excessive computational resource consumption. Red Hat has released updated expat packages (version 2.7.3-1.el10_2.1) for Red Hat Enterprise Linux 10 across multiple architectures to fix this vulnerability. The CVSS v3.1 base score is 2.9, reflecting a low severity denial of service via local attack with high attack complexity and no privileges required.

An attacker with local access can cause a denial of service by exploiting inefficient attribute name collision checks in libexpat, leading to excessive CPU usage and potential application or system unavailability. There is no impact on confidentiality or integrity. The vulnerability is rated low severity with a CVSS score of 2.9.

Red Hat has released updated expat packages that fix this vulnerability. Users of affected Red Hat Enterprise Linux 10 versions should apply the security update expat-2.7.3-1.el10_2.1 or later as provided in advisory RHSA-2026:22715. For detailed update instructions, refer to https://access.redhat.com/articles/11258. No additional mitigation is required beyond applying the official patch.