12 matches found
CVE-2026-118370
libexpat through 2.9.0 contains a signed integer overflow vulnerability in storeAtts in lib/xmlparse.c that allows attackers to trigger out-of-bounds writes via oversized attribute counts. Attackers can supply a multi-gigabyte document with a start tag carrying over 2^30 attributes to overflow...
DEBIAN-CVE-2026-118370
libexpat through 2.9.0 contains a signed integer overflow vulnerability in storeAtts in lib/xmlparse.c that allows attackers to trigger out-of-bounds writes via oversized attribute counts. Attackers can supply a multi-gigabyte document with a start tag carrying over 2^30 attributes to overflow...
AZL-111145 CVE-2026-117610 affecting package expat 2.8.3-2
libexpat through 2.9.0 contains a NULL pointer dereference vulnerability in externalEntityInitProcessor2 in lib/xmlparse.c that mishandles the XMLTOKNONE token from empty input. Attackers who control stream chunking can force an empty non-final first parse on an external entity subparser, causing...
CVE-2026-117610
libexpat through 2.9.0 contains a NULL pointer dereference vulnerability in externalEntityInitProcessor2 in lib/xmlparse.c that mishandles the XMLTOKNONE token from empty input. Attackers who control stream chunking can force an empty non-final first parse on an external entity subparser, causing...
CVE-2026-117610
The libexpat library (versions through 2.9.0 ) is vulnerable to a NULL pointer dereference in the externalEntityInitProcessor2() function within lib/xmlparse.c. The flaw occurs because the software mishandles the XML_TOK_NONE token when processing empty input. An attacker capable of controlling s...
CVE-2026-117610 libexpat through 2.9.0 NULL Pointer Dereference via External Entity Subparser
libexpat through 2.9.0 contains a NULL pointer dereference vulnerability in externalEntityInitProcessor2 in lib/xmlparse.c that mishandles the XMLTOKNONE token from empty input. Attackers who control stream chunking can force an empty non-final first parse on an external entity subparser, causing...
CVE-2026-117610 libexpat through 2.9.0 NULL Pointer Dereference via External Entity Subparser
libexpat through 2.9.0 contains a NULL pointer dereference vulnerability in externalEntityInitProcessor2 in lib/xmlparse.c that mishandles the XMLTOKNONE token from empty input. Attackers who control stream chunking can force an empty non-final first parse on an external entity subparser, causing...
EUVD-2026-111545
libexpat through 2.9.0 contains a NULL pointer dereference vulnerability in externalEntityInitProcessor2 in lib/xmlparse.c that mishandles the XMLTOKNONE token from empty input. Attackers who control stream chunking can force an empty non-final first parse on an external entity subparser, causing...
PT-2026-127734
libexpat through 2.9.0 contains a NULL pointer dereference vulnerability in externalEntityInitProcessor2 in lib/xmlparse.c that mishandles the XML TOK NONE token from empty input. Attackers who control stream chunking can force an empty non-final first parse on an external entity subparser, causi...
PT-2026-127736
libexpat through 2.9.0 contains a signed integer overflow vulnerability in storeAtts in lib/xmlparse.c that allows attackers to trigger out-of-bounds writes via oversized attribute counts. Attackers can supply a multi-gigabyte document with a start tag carrying over 2^30 attributes to overflow...
CLSA-2026-1790248267 Fix CVE(s): CVE-2026-66046, CVE-2026-93990
SECURITY UPDATE: quadratic runtime in the default-attribute lookup of storeAtts, and an out-of-bounds read in the same lookup for parsers created by XMLExternalEntityParserCreate - debian/patches/CVE-2026-66046.patch: in lib/xmlparse.c, replace the linear scan over ELEMENTTYPE.defaultAtts in...
CLSA-2026-1780663178 Fix CVE(s): CVE-2026-41080
SECURITY UPDATE: hash flooding via crafted XML caused by insufficient entropy in the hash secret salt - debian/patches/CVE-2026-41080.patch: migrate hash salt storage to a full 128-bit struct sipkey and extract 16 bytes of entropy instead of 4 to 8 in expat/lib/xmlparse.c; add XMLSetHashSalt16Byt...