CVE-2026-76956 is a medium severity (5.9) flaw in libexpat 2.8.2 and 2.8.3. The code misreads getentropy's return value, so the hash seed gets too little randomness and crafted XML can cause hash flooding and a denial of service. libexpat 2.8.4 fixes it.
What's affected
The record says libexpat 2.8.2 and 2.8.3 are affected, and 2.8.4 is the release that fixes it. Earlier versions are not named in the record. The fix is a merged pull request titled as a correction of an inverted getentropy return in the random byte writer, and the 2.8.4 release preparation pull request was merged on 31 August 2026.
Because the narrow affected range is only two releases, many systems will not be affected. The ones that are will usually be recent builds that picked up 2.8.2 or 2.8.3 early.
Where sources differ. We found no vendor advisory that gives its own score. The record's 5.9 Medium and the pull request titles are the only sources, and they agree on the fix version. Check your distribution's security notes for backports.
How to check if you're exposed
Find the expat in your systems. It is often bundled inside other software, so check more than one place:
pkg-config --modversion expat
python3 -c "import pyexpat; print(pyexpat.EXPAT_VERSION)"
dpkg -l libexpat1
rpm -q expat
apk info expat
Distribution packages frequently carry backported fixes under an older version string, so check your vendor's tracker for the CVE as well. Also look for vendored copies of expat inside language runtimes, browsers, PDF tools and firmware, which do not appear in package lists. Only 2.8.2 and 2.8.3 are named as affected, so a build outside that range is not in scope per the record. A dependency scan is the quickest way to find this kind of component across many projects. Safeguard's free in-browser scan at gold.safeguard.sh/scan checks your dependencies against known CVEs, and reachability analysis helps you separate libraries your code actually calls from ones that only sit in the tree.
What to do now
- Find every copy of libexpat, and note which are 2.8.2 or 2.8.3.
- Upgrade those to 2.8.4 or later, or to a distribution package that states the fix.
- Rebuild and redeploy software that bundles or statically links expat.
- For services that parse XML from the internet, add input size limits and timeouts as ordinary defenses against denial of service.
- Record versions after the update.
Why it matters
Expat randomizes its internal hash table seed so an attacker cannot predict which XML names collide. The record says that, on 2.8.2 and 2.8.3, the code misinterprets getentropy's return code, which leads to insufficient entropy. A predictable seed makes hash flooding possible: crafted XML with many colliding names slows parsing until it stalls. The record files it under CWE-394, which covers unexpected return values that code mishandles.
It is a good example of a bug that tests do not catch, because the parser works correctly in every normal run. The harm is only visible to an attacker who knows the seed is weak. The impact is availability only, according to the record's vector, and the record does not mark it as a CISA KEV entry.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is libexpat 2.8.1 affected?
The record names only 2.8.2 and 2.8.3 as affected. Check your vendor's notes for anything else.
What can an attacker do?
Cause a denial of service through crafted XML content, according to the record. The impact is on availability.
Sources
Last reviewed: 18 October 2026.
