Summary
[2.7.3-63]
- CVE-2026-102633 expat: expat: Denial of Service via integer overflow in
expat_realloc
[2.7.3-62]
- CVE-2026-77214 expat: expat: Information disclosure via heap buffer over-
read in XML_ParseBuffer
[2.7.3-61]
- CVE-2026-66046 expat: Expat: Denial of Service via quadratic complexity
in attribute processing
[2.7.3-60]
- CVE-2026-93990 expat: Expat: XML Injection via Malformed UTF-16 Input
[2.7.3-59]
- Fix CVE-2026-56132: out-of-bound scaffolding index store in doProlog
[2.7.3-58]
- Fix CVE-2026-50219: forbid XML_ParserFree/Reset from handlers
[2.7.3-57]
- expat: backport CVE-2026-45186 fix (attribute collision check DoS)
[2.7.3-56]
- Rebase to 2.7.3 and add VCS tag
* Thu Jun 05 2025 psklenar@redhat.com <psklenar@redhat.com>
- https://issues.redhat.com/browse/RHELMISC-13073
* Fri Mar 28 2025 Tomas Korbar <tkorbar@redhat.com>
- Fix behavior change caused by fix for CVE-2024-8176
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 10 | expat | 0:2.7.3-1.el10_2.7 |
| Oracle Linux · 10 | expat-devel | 0:2.7.3-1.el10_2.7 |
Vulnerabilities 2
-
High 8.2
libexpat Heap Buffer Over-read in xmlparse.c via XML_ParseBuffer
libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XML_ParseBuffer advances the parse buffer end with parser->m_bufferEnd += len using a caller-supplied length that is not validated against the allocated buffer size, …
-
Medium 5.9
libexpat 2.7.2 through 2.8.5 Integer Overflow in expat_realloc
libexpat versions 2.7.2 through 2.8.5 contain an integer overflow vulnerability in expat_realloc() function on 32-bit platforms when computing allocation sizes. Attackers supplying malicious XML to applications parsing with vulnerable libexpat can cause heap …