p PatchFirst

ALPINE-CVE-2026-76956

ALPINE-CVE-2026-76956

This page contains facts from public vulnerability sources. Check the original advisory before updating.

In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to insufficient entropy, which results in being vulnerable to hash flooding attacks, causing a denial of service via crafted XML content.

CVSS 7.5 · High · Fix available

Published
Updated

Stack: system

Affected products and versions

  • expat Alpine:v3.21

    Affected ranges
    • ECOSYSTEM: < 2.8.4-r0

    Update to 2.8.4-r0

  • expat Alpine:v3.22

    Affected ranges
    • ECOSYSTEM: < 2.8.4-r0

    Update to 2.8.4-r0

  • expat Alpine:v3.23

    Affected ranges
    • ECOSYSTEM: < 2.8.4-r0

    Update to 2.8.4-r0

  • expat Alpine:v3.24

    Affected ranges
    • ECOSYSTEM: < 2.8.4-r0

    Update to 2.8.4-r0

Original sources

Check your server →