GHSA-HQMJ-33CM-GQPQ vulnerabilities

Vulnerabilities for packages: expat...

GHSA-H5J3-RR49-JMM6 vulnerabilities

Vulnerabilities for packages: expat...

GHSA-FCHF-WVCC-QF9G vulnerabilities

Vulnerabilities for packages: expat...

GHSA-9JQ5-63HM-6Q5G vulnerabilities

Vulnerabilities for packages: expat...

GHSA-638V-9W3R-GH6Q vulnerabilities

Vulnerabilities for packages: expat...

GHSA-68VW-XV3C-52VP vulnerabilities

Vulnerabilities for packages: expat...

GHSA-425R-VWQ2-26QV vulnerabilities

Vulnerabilities for packages: expat...

CVE-2026-56412 vulnerabilities

Vulnerabilities for packages: expat...

CVE-2026-56411 vulnerabilities

Vulnerabilities for packages: expat...

CVE-2026-56408 vulnerabilities

Vulnerabilities for packages: expat...

CVE-2026-56405 vulnerabilities

Vulnerabilities for packages: expat...

CVE-2026-56403 vulnerabilities

Vulnerabilities for packages: expat...

CVE-2026-56404 vulnerabilities

Vulnerabilities for packages: expat...

CVE-2026-56131 vulnerabilities

Vulnerabilities for packages: expat...

Astra Linux – Vulnerability in Python 3.11

When an Expat parser with a registered ElementDeclHandler parses an inline document type definition containing a deeply nested content model, a C stack overflow occurs...

Oracle Linux 9 : expat (ELSA-2026-23230)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-23230 advisory. - Fix CVE-2026-45186 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessus has not tested fo...

ALPINE-CVE-2026-56412

libexpat before 2.8.2 does not consider XMLTOKDATACHARS in doCdataSection and thus lacks handler call depth tracking for various calls from within handlers in cases of a policy violation. Thus, a use-after-free can occur. NOTE: this issue exists because of an incomplete fix for CVE-2026-50219...

UBUNTU-CVE-2026-56412

libexpat before 2.8.2 does not consider XMLTOKDATACHARS in doCdataSection and thus lacks handler call depth tracking for various calls from within handlers in cases of a policy violation. Thus, a use-after-free can occur. NOTE: this issue exists because of an incomplete fix for CVE-2026-50219...

CVE-2026-56407

libexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity textLen...

ALPINE-CVE-2026-56404

libexpat before 2.8.2 has an integer overflow in addBinding...