Skip to content
OpenAdvisories
High ELSA-2026-72448 2 CVEs

Important: expat security update (Oracle Linux 8)

Published Sep 29, 2026 · Updated Sep 29, 2026

Ecosystem: Oracle Linux

Summary

[2.5.0-4]
- Fix CVE-2026-66046 in expat
- Resolves: RHEL-260142

[2.5.0-3]
- CVE-2026-93990 expat: Expat: XML Injection via Malformed UTF-16 Input
- Resolves: RHEL-268995

Fixed packages 2

ReleasePackageFixed in
Oracle Linux · 8 expat 0:2.5.0-4.el8_10
Oracle Linux · 8 expat-devel 0:2.5.0-4.el8_10

Vulnerabilities 2

  • High 7.5
    CVE-2026-66046

    Expat Denial of Service via storeAtts() Quadratic Complexity

    Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an O(N^2) linear scan of elementTy…

    libexpat project libexpat insighttoolkit4 expat Debian Ubuntu Azure Linux Alpine
  • High 7.5
    CVE-2026-93990

    Expat before 2.8.5 Malformed UTF-16 Acceptance via Unchecked Surrogate

    Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16 sequences to be accepted. Attackers can supply UTF-16 encoded XML containing lone high surrogates that consume the following c…

    libexpat project libexpat python3 insighttoolkit4 Debian Ubuntu Azure Linux Alpine