OESA-2026-2430 expat security update

expat is a stream-oriented XML parser library written in C. expat excels with files too large to fit RAM, and where performance and flexibility are crucial. Security Fixes: In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via...

CLSA-2026-1779359157 Fix CVE(s): CVE-2026-45186

SECURITY UPDATE: Denial of service via quadratic attribute-name collision check in libexpat before 2.8.1 - debian/patches/CVE-2026-45186.patch: introduce per-element defaultAttsNames hash table and use it for O1 attribute collision detection in defineAttribute - CVE-2026-45186...

Astra Linux – Vulnerabilities in Firefox, Thunderbird, Expat, LibXMLTok

LibExpat through version 2.5.0 causes a denial of service resource consumption because multiple reparings are required when dealing with large tokens, resulting in multiple buffer fills...

Astra Linux – Vulnerabilities in Firefox, Thunderbird, and Expat

In libexpat through version 2.4.9, there was a use-after-free issue caused by excessive destruction of a shared DTD in the XMLExternalEntityParserCreate function, especially in out-of-memory situations...

Astra Linux – Vulnerabilities in Firefox, Thunderbird, and Expat

The issue with integer overflow occurs in storeAtts in the xmlparse.c file, within the Expat library also known as libexpat, before version 2.4.3...

Astra Linux – Vulnerabilities in Firefox, Thunderbird, and Expat

The nextScaffoldPart function in xmlparse.c of Expat also known as libexpat, prior to version 2.4.3, has an integer overflow issue...

Astra Linux – Vulnerabilities in Firefox, Thunderbird, and Expat

In libexpat before version 2.7.4, XMLExternalEntityParserCreate does not copy unknown encoding handler user data...

Astra Linux – Vulnerability in Firefox, expat, libxmltok, Thunderbird

The libexpat library before version 2.4.9 has a use-after-free issue in the doContent function of the xmlparse.c file...

CVE-2026-45186

A flaw was found in libexpat. When processing a specially crafted XML input containing a specific pattern of attributes, the parsing time increases quadratically due to checks for attribute name collisions. This consumes excessive CPU resources and eventually results in a denial of service...

firefox: thunderbird: expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing

A memory amplification vulnerability in libexpat allows attackers to trigger excessive dynamic memory allocations by submitting specially crafted XML input. A small input 250 KiB can cause the parser to allocate hundreds of megabytes, leading to denial-of-service DoS through memory exhaustion...

firefox: thunderbird: expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing

A memory amplification vulnerability in libexpat allows attackers to trigger excessive dynamic memory allocations by submitting specially crafted XML input. A small input 250 KiB can cause the parser to allocate hundreds of megabytes, leading to denial-of-service DoS through memory exhaustion...

ALSA-2026:19064 Important: python3.12 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

SUSE SLES15 Security Update : mozjs78 (SUSE-SU-2026:1956-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1956-1 advisory. This update for mozjs78 fixes the following issues - CVE-2026-32776: libexpat: NULL pointer dereference when processing empty...

Security Bulletin: IBM Storage Defender: Data Protect critical vulnerabilities resolved in release Defender 2.1.4/Data Protect 7.4

Summary IBM Storage Defender: Data Protect critical vulnerabilities resolved in release Defender 2.1.4/Data Protect 7.4. The vulnerabilities have been addressed in Data Protect 7.4, which is included in IBM Storage Defender 2.1.4 Vulnerability Details CVEID:CVE-2021-45960 DESCRIPTION: In Expat ak...

Security update for mozjs78

This update for mozjs78 fixes the following issues CVE-2026-32776: libexpat: NULL pointer dereference when processing empty external parameter entities inside an entity declaration value bsc1259728. CVE-2026-32777: libexpat: denial of service due to infinite loop in DTD content parsing bsc1259713...

SUSE-SU-2026:1956-1 Security update for mozjs78

This update for mozjs78 fixes the following issues - CVE-2026-32776: libexpat: NULL pointer dereference when processing empty external parameter entities inside an entity declaration value bsc1259728. - CVE-2026-32777: libexpat: denial of service due to infinite loop in DTD content parsing...

Updated firefox & thunderbird packages fix security vulnerabilities

LZ4 compression library issue. CVE-2025-62813 libexpat before 2.7.5 allows a NULL pointer dereference with empty external parameter entity content. CVE-2026-32776 libexpat before 2.7.5 allows an infinite loop while parsing DTD content. CVE-2026-32777 libexpat before 2.7.5 allows a NULL pointer...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : mozjs115 (SUSE-SU-2026:1870-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1870-1 advisory. This update for mozjs115 fixes the following issues - CVE-2026-32776: libexpat: NULL pointer...

Amazon Linux 2023 : firefox (ALAS2023-2026-1706)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1706 advisory. libexpat before 2.7.6 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document. CVE-2026-41080 Tenable has extracted the preceding description block directly from the test...

SUSE SLED15 / SLES15 Security Update : mozjs60 (SUSE-SU-2026:1817-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1817-1 advisory. This update for mozjs60 fixes the following issues - CVE-2026-32776: libexpat: NULL pointer dereference when...