The libexpat library, when used in versions before 2.8.0, relies on an inadequate entropy source for its hash function. This weakness permits attackers to craft XML documents that deliberately trigger hash collisions, causing the parser to expend excessive time and resources. The primary consequence is a denial‑of‑service condition as the application becomes unresponsive or exhausts memory. The issue stems from CWE‑331, which marks the failure to incorporate sufficient randomness in hash generation.

The vulnerability affects all installations of the libexpat project with the libexpat library before version 2.8.0. Any software that links against these older releases is potentially vulnerable if it processes XML input from untrusted sources.

The CVSS score for this weakness is 2.9, indicating a low overall risk. The EPSS score is less than 1 %, showing that the likelihood of exploitation is very low. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to supply a crafted XML document to a system using the vulnerable libexpat version; the attack is predominantly a local or remote denial of service, depending on how the library is utilized.