Skip to content
OpenAdvisories
High ALAS2023-2026-2157 11 CVEs

Important: expat security update (Amazon Linux 2023)

Published Sep 14, 2026 · Updated Sep 14, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-76957: libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412. CVE-2026-66046: Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an O(N^2) linear scan of elementType->defaultAtts to determine CDATA status. A remote unauthenticated attacker can supply a single well-formed XML document of a few megabytes to an application parsing untrusted XML to cause excessive CPU consumption, resulting in denial of service without requiring authentication, external entity resolution, or non-default parser options. CVE-2026-56412: libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call depth tracking for various calls from within handlers in cases of a policy violation. Thus, a use-after-free can occur. NOTE: this issue exists because of an incomplete fix for CVE-2026-50219. CVE-2026-56411: xmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations. CVE-2026-56410: xmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId. CVE-2026-56409: xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used. CVE-2026-56408: libexpat before 2.8.2 has an integer overflow in copyString. CVE-2026-56405: libexpat before 2.8.2 has an integer overflow in getAttributeId. CVE-2026-56404: libexpat before 2.8.2 has an integer overflow in addBinding. CVE-2026-56131: libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation. Thus, a use-after-free can occur (similar to the CVE-2026-50219 situation). CVE-2026-50219: libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_GetBuffer, XML_Parse, XML_ParseBuffer, XML_ParserFree, or XML_ParserReset from within handlers in cases of a policy violation. Thus, a use-after-free can occur,

Fixed packages 5

ReleasePackageFixed in
Amazon Linux · 2023 expat 0:2.8.3-1.amzn2023.0.1
Amazon Linux · 2023 expat-debuginfo 0:2.8.3-1.amzn2023.0.1
Amazon Linux · 2023 expat-debugsource 0:2.8.3-1.amzn2023.0.1
Amazon Linux · 2023 expat-devel 0:2.8.3-1.amzn2023.0.1
Amazon Linux · 2023 expat-static 0:2.8.3-1.amzn2023.0.1

Vulnerabilities 11

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-50219.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-56131.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-56404.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-56405.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-56408.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-56409.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-56410.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-56411.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-56412.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-66046.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-76957.html