PT-2026-80475

libexpat before 2.8.2 has an integer overflow in copyString...

PT-2026-80473

libexpat before 2.8.2 has an integer overflow in XML ParseBuffer because it lacked a check that was present in XML Parse...

PT-2026-80476

xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used...

PT-2026-80467

In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input...

PT-2026-80472

libexpat before 2.8.2 has an integer overflow in getAttributeId...

PT-2026-80478

xmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations...

PT-2026-80471

libexpat before 2.8.2 has an integer overflow in addBinding...

PT-2026-80474

libexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity textLen...

CVE-2026-56131

A use-after-free vulnerability in libexpat occurs because handler call depth isn't properly tracked when XMLResumeParser is invoked during policy violations. This flaw can lead to information disclosure, data corruption, or denial of service. Mitigation To mitigate this vulnerability, avoid...

CVE-2026-56404

A flaw was found in libexpat. This vulnerability, an integer overflow in the addBinding function, could allow a local attacker to execute arbitrary code. By exploiting this, an attacker could gain control over the affected system, compromising its confidentiality and integrity. Mitigation Do not...

LibExpat Vulnerable to Denial-of-Service (DoS) via Uncontrolled Resource Consumption in 'xmlparse.c' File

libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing...

OESA-2026-3178 python3 security update

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C...

OESA-2026-3179 python3 security update

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C...

Security Bulletin: Multiple vulnerabilities have been identified in IBM HTTP Server used by IBM Rational ClearQuest

Summary IBM HTTP Server IHS is used by the IBM Rational ClearQuest server and web components. Information about security vulnerabilities affecting IHS have been published in multiple security bulletins. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section...

EulerOS Virtualization 2.12.0 : expat (EulerOS-SA-2026-2771)

According to the versions of the expat package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : libexpat before 2.7.5 allows an infinite loop while parsing DTD content.CVE-2026-32777 libexpat before 2.7.5 allows a NULL pointer...

CentOS 9 : expat-2.5.0-7.el9

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the expat-2.5.0-7.el9 build changelog. - In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XM...

Amazon Linux 2023 : expat, expat-devel, expat-static (ALAS2023-2026-1913)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1913 advisory. libexpat before 2.8.2 has an integer overflow in storeAtts. CVE-2026-56403 libexpat before 2.8.2 has an integer overflow in XMLParseBuffer because it lacked a check that was present in XMLPars...

Amazon Linux 2023 : expat, expat-devel, expat-static (ALAS2023-2026-1900)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1900 advisory. In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold backing array reallocation is mishandled when there is data-structure sharing across parsers...

Amazon Linux 2023 : python3.12, python3.12-devel, python3.12-idle (ALAS2023-2026-1931)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1931 advisory. The tarfile module would still apply normalization of AREGTYPE \x00 blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPELONGNAME or GNUTYPELONGLINK. This could result ...

libexpat: libexpat: Arbitrary code execution due to integer overflow

An integer overflow exists in libexpat's doProlog function due to improper handling of entity value lengths. A local attacker could exploit this to execute arbitrary code or access sensitive system data...