EUVD-2026-81015

A vulnerability in the offline profiler feed service of Cisco ISE could allow an authenticated, remote attacker to read arbitrary files that are stored on an affected device. This vulnerability is due to the parsing of attacker-controlled feed metadata with an XML parser that does not disable...

tinyxml

/ @mainpage TinyXML TinyXML is a simple, small, C++ XML parser that can be easily integrated into other programs. What it does. In brief, TinyXML parses an XML document, and builds from that a Document Object Model DOM that can be read, modified, and saved. XML stands for "eXtensible Markup...

external_expat_2.1.0_CVE-2022-43680

Expat, Release 2.1.0 This is Expat, a C library for parsing XML, written by James Clark. Expat is a stream-oriented XML parser. This means that you register handlers with the parser before starting the parse. These handlers are called when the parser discovers the associated structures in the...

CVE-2026-66046

A flaw was found in the Expat XML parsing library. A remote, unauthenticated attacker can supply a specially crafted XML document to trigger quadratic algorithmic complexity in the storeAtts function, causing excessive CPU consumption and a denial of service Mitigation To mitigate, avoid parsing...

Astra Linux – Vulnerability in libxml-parser-perl

Versions of XML::Parser from 2.45 onwards for Perl may overflow the pre-allocated buffer size, leading to heap corruption double-free or corruption and crashes. The A:utf8 PerlIO layer, using the parsestream function in Expat.xs, may cause the XML input buffer to overflow. This is because Perl’s...

Astra Linux – Vulnerability in libxml-parser-perl

XML::Parser versions up to 2.47 for Perl have a heap buffer overflow issue in stserialstack. In the case where stackptr == stacksize - 1, the stack will NOT be expanded. As a result, the new value will be written at location ++stackptr, which equals stacksize. This means that the new value falls...

Astra Linux – Vulnerability in OpenCV

A issue was discovered in OpenCV prior to version 4.1.1. There is a NULL pointer dereferencing in the function cv::XMLParser::parse, located in modules/core/src/persistence.cpp...

Important: expat

Issue Overview: libexpat before 2.8.2 lacks handler call depth tracking for calls to XMLGetBuffer, XMLParse, XMLParseBuffer, XMLParserFree, or XMLParserReset from within handlers in cases of a policy violation. Thus, a use-after-free can occur, CVE-2026-50219 libexpat before 2.8.2 lacks handler...

CLSA-2026-1789289706 TuxCare security update for fast-xml-parser (1 CVE)

TuxCare rebuilt fast-xml-parser to address 1 CVE. Fixed in 4.5.1-tuxcare.1...

[SECURITY] Fedora 43 Update: mingw-expat-2.8.4-1.fc43

This is expat, the C library for parsing XML, written by James Clark. Expat is a stream oriented XML parser. This means that you register handlers with the parser prior to starting the parse. These handlers are called when the parser discovers the associated structures in the document being parse...

[SECURITY] Fedora 44 Update: mingw-expat-2.8.4-1.fc44

This is expat, the C library for parsing XML, written by James Clark. Expat is a stream oriented XML parser. This means that you register handlers with the parser prior to starting the parse. These handlers are called when the parser discovers the associated structures in the document being parse...

[SECURITY] Fedora 45 Update: mingw-expat-2.8.4-1.fc45

This is expat, the C library for parsing XML, written by James Clark. Expat is a stream oriented XML parser. This means that you register handlers with the parser prior to starting the parse. These handlers are called when the parser discovers the associated structures in the document being parse...

[SECURITY] Fedora 45 Update: perl-XML-Bare-0.53-47.fc45

This module is a 'Bare' XML parser. It is implemented in C. The parser itself is a simple state engine that is less than 500 lines of C. The parser builds a C struct tree from input text. That C struct tree is converted to a Perl hash by a Perl function that makes basic calls back to the C to go...

ROOT-APP-NPM-CVE-2026-33036 CVE-2026-33036 in fast-xml-parser - Patched by Root

Root has patched CVE-2026-33036 in the fast-xml-parser package for Root:npm. Multiple fixed versions available...

USN-8744-1: Python vulnerabilities

It was discovered that Python's http.cookies module incorrectly handled control characters in certain cookie operations. An attacker could possibly use this issue to inject arbitrary content. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu...

RLSA-2026:64810 Moderate: expat security update

Expat is a C library for parsing XML documents. Security Fixes: expat: libexpat: Use-after-free vulnerability due to improper handler call depth tracking CVE-2026-50219 expat: libexpat: Arbitrary Code Execution via Heap-based Buffer Overflow CVE-2026-56132 For more details about the security...

expat security update

An update is available for expat. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Expat is a C library for parsing XML documents. Security Fixes: expat: libexpa...

expat security update

An update is available for expat. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Expat is a C library for parsing XML documents. Security Fixes: expat: libexpat...

RLSA-2026:64812 Moderate: expat security update

Expat is a C library for parsing XML documents. Security Fixes: expat: libexpat: Use-after-free vulnerability due to improper handler call depth tracking CVE-2026-50219 expat: libexpat: Arbitrary Code Execution via Heap-based Buffer Overflow CVE-2026-56132 For more details about the security...

RLSA-2026:64809 Moderate: expat security update

Expat is a C library for parsing XML documents. Security Fixes: expat: libexpat: Use-after-free vulnerability due to improper handler call depth tracking CVE-2026-50219 expat: libexpat: Arbitrary Code Execution via Heap-based Buffer Overflow CVE-2026-56132 For more details about the security...