Skip to content
OpenAdvisories
High ELSA-2026-72663 2 CVEs

Important: expat security update (Oracle Linux 9)

Published Sep 28, 2026 · Updated Sep 28, 2026

Ecosystem: Oracle Linux

Summary

[2.5.0-6.5]
- Fix CVE-2026-66046: dtdCopy out-of-bounds access via isCdata hash lookup
- Resolves: RHEL-260179

[2.5.0-6.4]
- CVE-2026-93990 expat: Expat: XML Injection via Malformed UTF-16 Input
- Resolves: RHEL-269002

Fixed packages 2

ReleasePackageFixed in
Oracle Linux · 9 expat 0:2.5.0-6.el9_8.5
Oracle Linux · 9 expat-devel 0:2.5.0-6.el9_8.5

Vulnerabilities 2

  • High 7.5
    CVE-2026-66046

    Expat Denial of Service via storeAtts() Quadratic Complexity

    Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an O(N^2) linear scan of elementTy…

    libexpat project libexpat insighttoolkit4 expat Debian Ubuntu Azure Linux Alpine
  • High 7.5
    CVE-2026-93990

    Expat before 2.8.5 Malformed UTF-16 Acceptance via Unchecked Surrogate

    Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16 sequences to be accepted. Attackers can supply UTF-16 encoded XML containing lone high surrogates that consume the following c…

    libexpat project libexpat python3 insighttoolkit4 Debian Ubuntu Azure Linux Alpine