Skip to content
OpenAdvisories
High ALAS2-2026-3800 3 CVEs

Important: expat security update (Amazon Linux 2)

Published Jul 20, 2026 · Updated Jul 20, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-56407: libexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity textLen. CVE-2026-56406: libexpat before 2.8.2 has an integer overflow in XML_ParseBuffer because it lacked a check that was present in XML_Parse. CVE-2026-56403: libexpat before 2.8.2 has an integer overflow in storeAtts.

Fixed packages 4

ReleasePackageFixed in
Amazon Linux · 2 expat 0:2.1.0-15.amzn2.0.8
Amazon Linux · 2 expat-debuginfo 0:2.1.0-15.amzn2.0.8
Amazon Linux · 2 expat-devel 0:2.1.0-15.amzn2.0.8
Amazon Linux · 2 expat-static 0:2.1.0-15.amzn2.0.8

Vulnerabilities 3

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-56403.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-56406.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-56407.html