CVE-2026-41080 is a denial of service vulnerability in libexpat caused by insufficient entropy in the hash function used during XML parsing. An attacker can exploit this by providing a specially crafted XML document that triggers hash flooding, leading to excessive resource consumption and potential program unresponsiveness or crashes. This vulnerability affects Red Hat Hardened Images RPMs, specifically expat-2.8.0-0.1.hum1 packages for aarch64 and x86_64. The advisory recommends input validation and access restrictions as mitigations. No patch or official fix has been explicitly provided in the Red Hat advisory at this time.

The vulnerability allows a remote attacker to cause a denial of service by making the program consuming libexpat unresponsive or crash due to resource exhaustion from hash flooding. There is no impact on confidentiality or integrity. The severity is low based on Red Hat's assessment, and no known exploits are reported in the wild.

Red Hat advises implementing robust input validation to filter out malicious XML structures in applications processing untrusted XML documents using libexpat. Additionally, restricting access to services that process untrusted XML can reduce the attack surface. If affected services become unresponsive, restarting them after applying mitigations may be necessary. Patch status is not yet confirmed; users should monitor Red Hat advisories for updates.