Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a DOS in Expat (CVE-2026-66046, CVE-2026-93990)

Summary IBM Watson Speech Services Cartridge is vulnerable to a DOS in Expat caused by quadratic algorithmic complexity in the storeAtts function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an ON^2 linear scan of elementType-defaultAtts to determine...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: expat (UTSA-2026-142352)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142352 advisory. Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts function in xmlparse.c, where processing N...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: expat (UTSA-2026-142314)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142314 advisory. Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts function in xmlparse.c, where processing N...

CentOS Linux 8.5 [TuxCare] Security Update: expat / expat-devel / expat-static Multiple Vulnerabilities (CENTOS8.5:CLSA-2026:1790252568)

The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2026:1790252568 advisory. - Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts functio...

CentOS Linux 8.4 [TuxCare] Security Update: expat / expat-devel / expat-static (CENTOS8.4:CLSA-2026:1790064092)

The CentOS Linux 8.4 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.4:CLSA-2026:1790064092 advisory. - Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts function in...

CentOS Linux 7 [TuxCare] Security Update: expat / expat-devel / expat-static (CENTOS7:CLSA-2026:1790239757)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1790239757 advisory. - Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts function in...

CVE-2026-66046

Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an ON^2 linear scan of elementType-defaultAtts to determine CDATA status. ...