CVE-2026-66046

Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an ON^2 linear scan of elementType-defaultAtts to determine CDATA status. ...

Security update for python

This update for python fixes the following issues: CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the configparser module is used bsc1269066. CVE-2026-1703: files may be extracted outside the installation directory when installing and...

SUSE-SU-2026:3635-1 Security update for python

This update for python fixes the following issues: - CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the configparser module is used bsc1269066. - CVE-2026-1703: files may be extracted outside the installation directory when installing and...

PT-2026-77055

Name of the Vulnerable Software and Affected Versions Expat versions prior to 2.8.4 Description A denial of service issue exists due to quadratic algorithmic complexity within the storeAtts function in xmlparse.c. When processing N specified attributes with non-normalized values, the system...

Debian dsa-6446 : expat - security update

The remote Debian 13 host has packages installed that are affected by a vulnerability as referenced in the dsa-6446 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6446-1 [email protected] https://www.debian.org/security/ Aron X...

ANT-2026-X3EB6DN3 · expat · heap-buffer-overflow

heap-buffer-overflow medium CVE-2026-56132 GHSA-425r-vwq2-26qv Severity Claude high · Security research firm high · Maintainer medium Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Trail of Bits. ANT-2026-X3EB6DN3...

Unity Linux 20.1070e Security Update: expat (UTSA-2026-099480)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099480 advisory. libexpat before 2.8.2 lacks handler call depth tracking for calls to XMLGetBuffer, XMLParse, XMLParseBuffer, XMLParserFree, or XMLParserReset from within handlers in...

Unity Linux 20.1070e Security Update: expat (UTSA-2026-099458)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099458 advisory. libexpat before 2.8.2 lacks handler call depth tracking for calls to XMLResumeParser from within handlers in cases of a policy violation. Thus, a use-after-free can...

Unity Linux 20.1070e Security Update: expat (UTSA-2026-099488)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099488 advisory. xmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId. Tenable has extracted the preceding description block directly from the Unity Linux securi...

Unity Linux 20.1070e Security Update: expat (UTSA-2026-099515)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099515 advisory. xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used. Tenable has extracted the preceding description block...

Unity Linux 20.1070e Security Update: expat (UTSA-2026-099486)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099486 advisory. libexpat before 2.8.2 has an integer overflow in addBinding. Tenable has extracted the preceding description block directly from the Unity Linux security advisory...

Unity Linux 20.1070e Security Update: expat (UTSA-2026-099462)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099462 advisory. libexpat before 2.8.2 has an integer overflow in storeAtts. Tenable has extracted the preceding description block directly from the Unity Linux security advisory. No...

Unity Linux 20.1070e Security Update: expat (UTSA-2026-099475)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099475 advisory. libexpat before 2.8.2 has an integer overflow in copyString. Tenable has extracted the preceding description block directly from the Unity Linux security advisory...

Unity Linux 20.1070e Security Update: expat (UTSA-2026-099518)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099518 advisory. libexpat before 2.8.2 has an integer overflow in XMLParseBuffer because it lacked a check that was present in XMLParse. Tenable has extracted the preceding descripti...

Unity Linux 20.1070e Security Update: expat (UTSA-2026-099452)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099452 advisory. libexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity textLen. Tenable has extracted the preceding description blo...

Unity Linux 20.1070e Security Update: expat (UTSA-2026-099461)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099461 advisory. xmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations. Tenable has extracted the preceding description block directly fr...

Unity Linux 20.1070e Security Update: expat (UTSA-2026-099520)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099520 advisory. libexpat before 2.8.2 has an integer overflow in getAttributeId. Tenable has extracted the preceding description block directly from the Unity Linux security advisor...

Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: expat: expat-2.8.3-0.1.hum1 aarch64, x8664 expat-devel-2.8.3-0.1.hum1 aarch64, x8664 expat-static-2.8.3-0.1.hum1 aarch64, x8664 expat-2.8.3-0.1.hum1.src src Security Fixes: expat: CVE-2026-72522...

Slackware Linux 15.0 / current expat Vulnerability (SSA:2026-223-01)

The version of expat installed on the remote host is prior to 2.7.5 / 2.8.3. It is, therefore, affected by a vulnerability as referenced in the SSA:2026-223-01 advisory. New expat packages are available for Slackware 15.0 and -current to fix a security issue. Tenable has extracted the preceding...

[slackware-security] expat

New expat packages are available for Slackware 15.0 and -current to fix a security issue. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/expat-2.7.5-i586-3slack15.0.txz: Rebuilt. This update fixes a security issue: Fix an out-of-bounds read and the resulting infinite loo...