CVE-2026-32777: 
Alma Linux vulnerability analysis and mitigation

CVE-2026-32777 is an infinite loop vulnerability in libexpat (the Expat XML parsing library) that allows an attacker to cause a Denial of Service (DoS) by supplying specially crafted Document Type Definition (DTD) content. It affects all versions of libexpat before 2.7.5, as well as downstream products including IBM AIX (Python 3.9/3.11 packages, VIOS), Microsoft Azure Linux 3 (expat packages prior to 2.6.4-5), and IBM HTTP Server shipped with IBM DevOps Code ClearCase. The vulnerability was discovered via OSS-Fuzz/ClusterFuzz (finding 486993411) and publicly disclosed on March 16, 2026, with a patch released on March 17, 2026. It carries a CVSS v3.1 base score of 5.5 (Medium) per Red Hat's assessment (Red Hat CVE, libexpat Issue #1161, Microsoft MSRC).

The root cause is classified as CWE-835 (Loop with Unreachable Exit Condition / Infinite Loop). The flaw exists in the entityValueProcessor function within libexpat's XML parser: when processing DTD content, the tokenizer function XmlPrologTok can return XML_TOK_INSTANCE_START (token value 29) while failing to advance the next pointer, causing the parser to loop indefinitely without making progress. The sibling function entityValueInitProcessor already contained a guard against this condition, but entityValueProcessor lacked the equivalent check. The fix, applied in pull request #1162, adds the same rejection logic to entityValueProcessor. The vulnerability was originally discovered through automated fuzzing (OSS-Fuzz testcase ID 5419974373212160), and a concrete reproducer is publicly available: extracting infloop_123.zip and running xmlwf -x -p against the extracted primary.txt triggers the infinite loop (libexpat Issue #1161, libexpat PR #1162).

Successful exploitation causes the affected application to hang indefinitely, consuming 100% CPU on the parsing thread and rendering the application unresponsive — a classic Denial of Service condition. There is no confidentiality or integrity impact; only availability is affected. Any application or service that parses untrusted XML input using a vulnerable version of libexpat (including Python, Firefox, Splunk, IBM HTTP Server, and many others that bundle the library) is potentially at risk of being hung by a malicious XML document containing crafted DTD content (Red Hat CVE, libexpat Issue #1161).

1. Prepare the malicious DTD payload: Craft or obtain a specially formed XML file containing DTD content that causes XmlPrologTok to return XML_TOK_INSTANCE_START without advancing the parser position. The publicly available infloop_123.zip from the libexpat issue tracker contains a ready-made reproducer (primary.txt).
2. Identify a target application: Locate an application or service that uses a vulnerable version of libexpat (< 2.7.5) to parse XML input — this could be a web service accepting XML uploads, a document processor, or any application exposing an XML parsing interface.
3. Deliver the malicious XML: Submit the crafted XML file to the target application through any available input channel (file upload, API endpoint accepting XML, command-line argument, etc.).
4. Trigger the infinite loop: The application's libexpat parser enters entityValueProcessor, where XmlPrologTok repeatedly returns XML_TOK_INSTANCE_START without advancing, causing the parsing thread to spin indefinitely.
5. Achieve DoS: The target application hangs, consuming excessive CPU resources and becoming unresponsive to legitimate requests until manually restarted (libexpat Issue #1161, libexpat PR #1162).

• Process Behavior: Application process consuming near-100% CPU on a single thread for an extended, abnormal duration with no corresponding legitimate workload; process becomes unresponsive to signals or requests.
• Logs: Application logs showing an XML parsing operation that started but never completed; timeout errors or watchdog alerts triggered by the hung process; absence of a parsing completion log entry after a parsing start entry.
• Network: For network-facing services, incoming connections or requests that remain open/pending indefinitely without a response; potential accumulation of half-open connections if the parser is invoked per request.
• File System: Presence of suspicious XML files with unusual or deeply nested DTD declarations in upload directories or temporary processing folders.

The primary remediation is to upgrade libexpat to version 2.7.5 or later, which contains the fix applied in pull request #1162 (libexpat PR #1162). For IBM AIX systems, apply the security updates provided in IBM's advisory for Python and AIX packages (IBM Advisory). For Microsoft Azure Linux 3, update the expat package to version 2.6.4-5 or later (Microsoft MSRC). As a workaround where patching is not immediately possible, restrict or sanitize untrusted XML input before it reaches the parser, enforce parsing timeouts at the application level, and monitor for abnormal CPU consumption that may indicate exploitation.

The vulnerability received broad attention from Linux distribution maintainers, with security updates issued by Red Hat, SUSE/openSUSE, Slackware, Amazon Linux 2, Mageia, OpenBSD, and FreeBSD ports shortly after disclosure. IBM issued advisories covering AIX and IBM HTTP Server (IBM DevOps Code ClearCase), and Splunk published advisories (SVD-2026-0507, SVD-2026-0512) addressing the impact on their products. CISA also published an ICS advisory (ICSA-26-155-04) referencing the vulnerability in the context of Hitachi Energy RTU500 devices, indicating reach into industrial control system environments (Red Hat CVE, IBM Advisory).