Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
A high severity denial of service vulnerability exists in the Expat XML parsing library used in Red Hat Hardened Images RPMs. The flaw involves a quadratic algorithmic complexity in the storeAtts() function when processing XML attributes, which can be triggered by a remote, unauthenticated attacker supplying a specially crafted XML document. This leads to excessive CPU consumption and potential service unavailability. The vulnerability affects multiple expat RPM packages and is addressed in version 2.8.4-0.1.hum1. Mitigation includes applying the update or restricting and limiting untrusted XML parsing.
AI Analysis
Technical Summary
The vulnerability CVE-2026-66046 in the Expat XML parsing library causes a denial of service due to inefficient algorithmic complexity (quadratic complexity) in the storeAtts() function when processing XML attributes. An attacker can remotely trigger excessive CPU consumption by supplying a specially crafted XML document, leading to service unavailability. This issue affects Red Hat Hardened Images RPMs including expat, expat-devel, and expat-static packages. The Red Hat advisory provides updated RPMs (version 2.8.4-0.1.hum1) that address this vulnerability. The advisory also references related CVEs (CVE-2026-76641, CVE-2026-76956, CVE-2026-76957, CVE-2026-56411) fixed in the same update. Red Hat scores this vulnerability as important with a CVSS v3 base score of 7.5, indicating high impact on availability with no confidentiality or integrity impact.
Potential Impact
The vulnerability allows a remote, unauthenticated attacker to cause excessive CPU consumption by exploiting quadratic algorithmic complexity in XML attribute processing, resulting in denial of service and service unavailability. There is no impact on confidentiality or integrity. The affected component is the Expat XML parsing library used in Red Hat Hardened Images RPMs.
Mitigation Recommendations
A fix is available via updated RPM packages (expat-2.8.4-0.1.hum1 and related packages). Users should apply this update to remediate the vulnerability. If immediate patching is not possible, mitigate by avoiding parsing untrusted XML, restricting XML sources via network controls, enforcing strict limits on document size, attribute counts, and request rates, and applying execution timeouts to prevent excessive CPU consumption.
Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
Description
A high severity denial of service vulnerability exists in the Expat XML parsing library used in Red Hat Hardened Images RPMs. The flaw involves a quadratic algorithmic complexity in the storeAtts() function when processing XML attributes, which can be triggered by a remote, unauthenticated attacker supplying a specially crafted XML document. This leads to excessive CPU consumption and potential service unavailability. The vulnerability affects multiple expat RPM packages and is addressed in version 2.8.4-0.1.hum1. Mitigation includes applying the update or restricting and limiting untrusted XML parsing.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability CVE-2026-66046 in the Expat XML parsing library causes a denial of service due to inefficient algorithmic complexity (quadratic complexity) in the storeAtts() function when processing XML attributes. An attacker can remotely trigger excessive CPU consumption by supplying a specially crafted XML document, leading to service unavailability. This issue affects Red Hat Hardened Images RPMs including expat, expat-devel, and expat-static packages. The Red Hat advisory provides updated RPMs (version 2.8.4-0.1.hum1) that address this vulnerability. The advisory also references related CVEs (CVE-2026-76641, CVE-2026-76956, CVE-2026-76957, CVE-2026-56411) fixed in the same update. Red Hat scores this vulnerability as important with a CVSS v3 base score of 7.5, indicating high impact on availability with no confidentiality or integrity impact.
Potential Impact
The vulnerability allows a remote, unauthenticated attacker to cause excessive CPU consumption by exploiting quadratic algorithmic complexity in XML attribute processing, resulting in denial of service and service unavailability. There is no impact on confidentiality or integrity. The affected component is the Expat XML parsing library used in Red Hat Hardened Images RPMs.
Mitigation Recommendations
A fix is available via updated RPM packages (expat-2.8.4-0.1.hum1 and related packages). Users should apply this update to remediate the vulnerability. If immediate patching is not possible, mitigate by avoiding parsing untrusted XML, restricting XML sources via network controls, enforcing strict limits on document size, attribute counts, and request rates, and applying execution timeouts to prevent excessive CPU consumption.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:65568
- Cve Count
- 5
- Additional Cves
- ["CVE-2026-66046","CVE-2026-76641","CVE-2026-76956","CVE-2026-76957"]
- State
- PUBLISHED
Threat ID: 6abc27d5680226ef6846f990
Added to database: 09/29/2026, 21:04:21 UTC
Last enriched: 09/29/2026, 21:27:05 UTC
Last updated: 09/30/2026, 03:28:29 UTC
Views: 11
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.