Back Linuxsecurity

Ubuntu 16.04 Expat Important Denial of Service CVE-2026-41080 USN-8520

Linuxsecurity •LinuxSecurity Advisories • July 9, 2026

Expat could be made to crash if it received specially crafted input. Software Description: - expat: XML parsing C library Details: It was discovered that Expat used insufficient entropy when generating hash salt values for its internal hash table. An attacker could use this to craft an XML document that triggers hash flooding, leading to a denial of service.

Expat could be made to crash if it received specially crafted input.

Software Description:

- expat: XML parsing C library

It was discovered that Expat used insufficient entropy when generating

hash salt values for its internal hash table. An attacker could use this

to craft an XML document that triggers hash flooding, leading to a

The problem can be corrected by updating your system to the following package versions: Ubuntu 16.04 LTS libexpat1 2.1.0-7ubuntu0.16.04.5+esm12 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes.

Ubuntu Security Notice USN-8520-1

Get the latest Linux and open source security news straight to your inbox.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Python and Expat Vulnerabilities Enable Denial of Service Attacks Two vulnerabilities affecting Python and Expat have been discovered, both related to insufficient entropy in hash generation. The Python vulnerability affects the xml.parsers.expat and xml.etree.ElementTree modules, allowing attackers to exploit crafted XML documents for denial of service (DoS) attacks. Similarly, the Expat vulnerability involves inadequate entropy when generating hash salt values, also leading to potential DoS via crafted XML. Both vulnerabilities were published on July 9, 2026, and can be mitigated by updating to the latest package versions. Users are advised to perform standard system updates to ensure protection. No specific CVEs were mentioned in the articles. The vulnerabilities could impact a wide range of systems using these libraries. 4 sources 57

Extracted Entities

CVEs (1)

CVE-2026-41080