ALAS2-2026-3306 — Low: thunderbird security update (Amazon Linux 2)

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-41080: libexpat before 2.7.6 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document.

Fixed packages 1

Release	Package	Fixed in
Amazon Linux · 2	thunderbird	0:140.10.1-1.amzn2.0.2

Vulnerabilities 1

Low 2.9

CVE-2026-41080

libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document.

libexpat project libexpat insighttoolkit4 expat Debian Ubuntu Azure Linux Alpine Wolfi

Apr 16, 2026

References

web
https://alas.aws.amazon.com/cve/html/CVE-2026-41080.html

Low: thunderbird security update (Amazon Linux 2)

Summary

Fixed packages 1

Vulnerabilities 1

libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document.

References