Skip to content
OpenAdvisories
High ALAS2023-2026-1913 3 CVEs

Important: expat security update (Amazon Linux 2023)

Published Jul 6, 2026 · Updated Jul 7, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-56407: libexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity textLen. CVE-2026-56406: libexpat before 2.8.2 has an integer overflow in XML_ParseBuffer because it lacked a check that was present in XML_Parse. CVE-2026-56403: libexpat before 2.8.2 has an integer overflow in storeAtts.

Fixed packages 5

ReleasePackageFixed in
Amazon Linux · 2023 expat 0:2.6.3-1.amzn2023.0.6
Amazon Linux · 2023 expat-debuginfo 0:2.6.3-1.amzn2023.0.6
Amazon Linux · 2023 expat-debugsource 0:2.6.3-1.amzn2023.0.6
Amazon Linux · 2023 expat-devel 0:2.6.3-1.amzn2023.0.6
Amazon Linux · 2023 expat-static 0:2.6.3-1.amzn2023.0.6

Vulnerabilities 3

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-56403.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-56406.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-56407.html