Search: CVE-2026-115506

CVE-2026-115506 is a denial of service vulnerability in libexpat through version 2.9.0. It arises from improper restriction of recursive entity references in DTDs, where the billion laughs protection triggers too late during XML parsing. An attacker can craft a moderately sized XML document with a large DTD and nested entity expansions to cause excessive CPU consumption during parsing.