Critical Photon OS Security Update - PHSA-2026-4.0-1002

Updates of 'expat', 'nghttp2', 'protobuf', 'sudo', 'ImageMagick', 'linux', 'openssh' packages of Photon OS have been released...

Critical Photon OS Security Update - PHSA-2026-5.0-0830

Updates of 'python3-tornado', 'vim', 'openssh', 'linux', 'xz', 'linux-esx', 'ImageMagick', 'expat', 'go' packages of Photon OS have been released...

Critical Photon OS Security Update - PHSA-2026-5.0-91-0830

Updates of 'linux-esx', 'expat', 'linux', 'vim', 'ImageMagick', 'go', 'python3-tornado', 'xz', 'openssh' packages of Photon OS have been released...

CLSA-2026-1776776980 Fix CVE(s): CVE-2023-52425

SECURITY UPDATE: quadratic re-parsing DoS with large tokens - debian/patches/CVE-2023-52425.patch: add callProcessor wrapper with reparse deferral heuristic in expat/lib/xmlparse.c, add XMLSetReparseDeferralEnabled API in expat/lib/expat.h. - CVE-2023-52425...

Important: Red Hat Security Advisory: perl-XML-Parser security update

An update for perl-XML-Parser is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

cpython: Stack overflow parsing XML with deeply nested DTD content models

A stack overflow flaw has been discovered in the python pyexpat module. When an Expat parser with a registered ElementDeclHandler parses an inline document type definition containing a deeply nested content model a C stack overflow occurs. This will result in a program crash...

CLSA-2026-1773928447 expat: Fix of CVE-2026-25210

CVE-2026-25210: fix integer overflow in tag buffer reallocation in doContent function...

CVE-2026-41080

A flaw was found in libexpat. A remote attacker could exploit this vulnerability by providing a specially crafted XML document that leverages insufficient entropy in the hash function. This can lead to hash flooding, a type of Denial of Service DoS attack, where the system becomes unresponsive or...

CVE-2026-41080

libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document...

CVE-2026-41080

libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document...

CVE-2026-41080

CVE-2026-41080 affects libexpat prior to 2.7.6, where insufficient entropy in the hash function allows hash flooding when processing crafted XML documents. The CVE is broadly referenced across OSV, Debian, Red Hat, and Ubuntu entries, with the core impact described as a potential DoS due to resou...

CLSA-2026-1776243051 expat: Fix of 2 CVEs

CVE-2022-25313: prevent stack exhaustion in buildmodel - CVE-2024-50602: make XMLStopParser refuse to stop/suspend an unstarted parser...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.19.28 bug fix and security update

Red Hat OpenShift Container Platform release 4.19.28 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.19. Red Hat Product Security has rated this update as having a...

(lib)expat -- Insufficient entropy

https://github.com/libexpat/libexpat/pull/1183 reports: libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document...

SUSE SLED15 / SLES15 Security Update : expat (SUSE-SU-2026:1352-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1352-1 advisory. - CVE-2026-32776: NULL pointer dereference when processing empty external parameter entities inside an entity...

Security Bulletin: Multiple vulnerabilities in Python affect AIX

Summary Vulnerabilities in Python could allow a null pointer dereference CVE-2026-32776, CVE-2026-32778, an infinite loop CVE-2026-32777, or impact availability CVE-2025-12084. Python is used by AIX as part of Ansible node management automation. Vulnerability Details CVEID:CVE-2026-32776...

Security update for expat

This update for expat fixes the following issues: CVE-2026-32776: NULL pointer dereference when processing empty external parameter entities inside an entity declaration value bsc1259726. CVE-2026-32777: denial of service due to infinite loop in DTD content parsing bsc1259711. CVE-2026-32778: NUL...

SUSE-SU-2026:1352-1 Security update for expat

This update for expat fixes the following issues: - CVE-2026-32776: NULL pointer dereference when processing empty external parameter entities inside an entity declaration value bsc1259726. - CVE-2026-32777: denial of service due to infinite loop in DTD content parsing bsc1259711. - CVE-2026-3277...

Important: Red Hat Security Advisory: perl-XML-Parser security update

An update for perl-XML-Parser is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerabilit...

Amazon Linux 2023 : perl-XML-Parser, perl-XML-Parser-tests (ALAS2023-2026-1536)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1536 advisory. XML::Parser versions through 2.47 for Perl could overflow the pre-allocated buffer size cause a heap corruption double free or corruption and crashes. A :utf8 PerlIO layer, parsestream in...