EUVD-2026-108338

libexpat through 2.9.0 contains a denial of service vulnerability because billion laughs protection in accountingDiffTolerated in xmlparse.c detects entity amplification too late. Attackers can supply a moderately sized XML document with a large DTD and nested entity expansions to consume tens of...

CVE-2026-115506

Versions of libexpat through 2.9.0 are vulnerable to a Denial of Service (DoS) attack caused by a detection delay in the Billion Laughs protection mechanism. The root cause is located in the accountingDiffTolerated() function within xmlparse.c, which identifies entity amplification too late. An a...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: expat (UTSA-2026-142300)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142300 advisory. libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XMLParseBuffer advances the parse buffer end with parser-mbufferEnd += l...

CVE-2026-113351

libexpat 2.7.2 through 2.9.0 contains a denial of service vulnerability because XMLParserReset zeroes the direct byte count but never offsets tracked heap allocations. Attackers can submit a large XML document so later documents on the same reset parser fail with XMLERRORNOMEMORY until it is...

CVE-2026-113351 libexpat 2.7.2 through 2.9.0 Denial of Service via XML_ParserReset

libexpat 2.7.2 through 2.9.0 contains a denial of service vulnerability because XMLParserReset zeroes the direct byte count but never offsets tracked heap allocations. Attackers can submit a large XML document so later documents on the same reset parser fail with XMLERRORNOMEMORY until it is...

EUVD-2026-104922

libexpat 2.7.2 through 2.9.0 contains a denial of service vulnerability because XMLParserReset zeroes the direct byte count but never offsets tracked heap allocations. Attackers can submit a large XML document so later documents on the same reset parser fail with XMLERRORNOMEMORY until it is...

CVE-2026-113351

The libexpat library, versions 2.7.2 through 2.9.0 , is vulnerable to a Denial of Service (DoS) condition. The root cause is located in the XML_ParserReset function, which zeroes the direct byte count but fails to offset tracked heap allocations. An attacker can exploit this by submitting a large...

PT-2026-118335

libexpat 2.7.2 through 2.9.0 contains a denial of service vulnerability because XML ParserReset zeroes the direct byte count but never offsets tracked heap allocations. Attackers can submit a large XML document so later documents on the same reset parser fail with XML ERROR NO MEMORY until it is...

Linux Distros Unpatched Vulnerability : CVE-2026-113351

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libexpat 2.7.2 through 2.9.0 contains a denial of service vulnerability because XMLParserReset zeroes the direct byte count but never offsets tracked heap...

OESA-2026-4350 expat security update

expat is a stream-oriented XML parser library written in C. expat excels with files too large to fit RAM, and where performance and flexibility are crucial. Security Fixes: libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XMLParseBuffer advances the par...

OESA-2026-4351 expat security update

expat is a stream-oriented XML parser library written in C. expat excels with files too large to fit RAM, and where performance and flexibility are crucial. Security Fixes: libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XMLParseBuffer advances the par...

OESA-2026-4349 expat security update

expat is a stream-oriented XML parser library written in C. expat excels with files too large to fit RAM, and where performance and flexibility are crucial. Security Fixes: libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XMLParseBuffer advances the par...

OESA-2026-4348 expat security update

expat is a stream-oriented XML parser library written in C. expat excels with files too large to fit RAM, and where performance and flexibility are crucial. Security Fixes: libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XMLParseBuffer advances the par...

Astra Linux – Vulnerabilities in Firefox, Thunderbird, and Expat

A issue was discovered in libexpat before version 2.6.4. There is a crash within the XMLResumeParser function, as XMLStopParser can stop/suspend a parser that has not been started...

Unity Linux 20.1070e Security Update: expat (UTSA-2026-130352)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130352 advisory. libexpat before 2.8.3 has an out-of-bounds read and resultant infinite loop because low surrogates are treated the same as high surrogates during Unicode processing ...

Security Bulletin: IBM HTTP Server is affected by multiple vulnerabilities due to the included Apache HTTP Server and libexpat

Summary IBM HTTP Server used by IBM WebSphere Application Server is affected by multiple vulnerabilities due to libexpat and the included Apache HTTP Server. Vulnerability Details CVEID:CVE-2026-66046 DESCRIPTION: Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic...

Unity Linux 20.1070a Security Update: expat (UTSA-2026-130159)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130159 advisory. libexpat before 2.8.2 lacks handler call depth tracking for calls to XMLGetBuffer, XMLParse, XMLParseBuffer, XMLParserFree, or XMLParserReset from within handlers in...

Security Bulletin: IBM Integrated Analytics System (IIAS) is affected by multiple vulnerabilities in system and open source components

Summary IBM Integrated Analytics System IIAS includes various open source packages, runtimes, and system libraries as part of its underlying platform. Multiple security vulnerabilities have been identified across components including Oracle Java SE, cryptography, Apache HttpComponents, libssh,...

EulerOS 2.0 SP13 : expat (EulerOS-SA-2026-4135)

According to the versions of the expat packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : libexpat before 2.8.2 has an integer overflow in getAttributeId.CVE-2026-56405 Expat through 2.8.3 contains an out-of-bounds read vulnerability tha...

TencentOS Server 4: expat (TSSA-2026:1071)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:1071 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...