Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Fixed packages 3

Vulnerabilities 5

• High 7.5
  CVE-2026-66046

  Expat Denial of Service via storeAtts() Quadratic Complexity

  Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an O(N^2) linear scan of elementTy…

  libexpat project libexpat insighttoolkit4 expat Debian Ubuntu Azure Linux Alpine
  Aug 18, 2026
• High 7.5
  CVE-2026-76641

  Expat Out-of-Bounds Read via dtdCopy

  Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory corruption by processing XML with external entity parsers created via XML_ExternalEntityParserCreate. A struct size mismatch between ELEMENT_TYPE members …

  libexpat project libexpat insighttoolkit4 matanza Ubuntu Azure Linux Alpine
  Aug 20, 2026
• Medium 6.9
  CVE-2026-56411

  xmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations.

  libexpat project libexpat insighttoolkit4 expat Debian Ubuntu Azure Linux Alpine Wolfi
  Jun 21, 2026
• Medium 5.9
  CVE-2026-76956

  In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to insufficient entropy, …

  libexpat project libexpat insighttoolkit4 expat Debian Ubuntu Azure Linux Alpine
  Aug 20, 2026
• Medium 4.9
  CVE-2026-76957

  libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occu…

  libexpat project libexpat insighttoolkit4 expat Debian Ubuntu Azure Linux Alpine
  Aug 20, 2026

References

• report
  https://access.redhat.com/security/cve/CVE-2026-66046
• report
  https://access.redhat.com/security/cve/CVE-2026-76641
• report
  https://access.redhat.com/security/cve/CVE-2026-76956
• report
  https://access.redhat.com/security/cve/CVE-2026-76957
• article
  https://access.redhat.com/security/updates/classification/
• article
  https://images.redhat.com/
• report
  https://access.redhat.com/security/cve/CVE-2026-56411
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_65568.json
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2491202
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-56411
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-56411
• article
  https://github.com/libexpat/libexpat/pull/1263
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2517901
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-66046
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-66046
• article
  https://github.com/libexpat/libexpat/pull/1321
• article
  https://www.vulncheck.com/advisories/expat-denial-of-service-via-storeatts-quadratic-complexity
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2520649
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-76641
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-76641
• article
  https://github.com/libexpat/libexpat/commit/98599f6dcc2b460410881fe420f5f55d6bec63bf
• article
  https://github.com/libexpat/libexpat/pull/1331
• article
  https://www.vulncheck.com/advisories/expat-out-of-bounds-read-via-dtdcopy
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2520124
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-76956
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-76956
• article
  https://github.com/libexpat/libexpat/pull/1326
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2520125
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-76957
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-76957
• article
  https://github.com/libexpat/libexpat/pull/1322
• article
  https://github.com/libexpat/libexpat/pull/1329