Red Hat Security Advisory: expat security update

Fixed packages 4

Vulnerabilities 2

• Medium 6.9
  CVE-2026-56132

  In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold backing arra…

  libexpat project libexpat insighttoolkit4 expat Debian Ubuntu Azure Linux Alpine Wolfi
  Jun 19, 2026
• Medium 4.9
  CVE-2026-50219

  libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_GetBuffer, XML_Parse, XML_ParseBuffer, XML_Par…

  libexpat project libexpat insighttoolkit4 expat Debian Ubuntu Azure Linux Alpine Wolfi
  Jun 4, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2484620
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2490669
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_64810.json
• report
  https://access.redhat.com/security/cve/CVE-2026-50219
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-50219
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-50219
• article
  https://github.com/libexpat/libexpat/pull/1246
• report
  https://access.redhat.com/security/cve/CVE-2026-56132
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-56132
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-56132
• article
  https://github.com/libexpat/libexpat/pull/1272