https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-29T13:31:14.941365+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/alsa-2026:72448 ALSA-2026:72448 — Important: expat security update 2026-09-29T13:31:14.954116+00:00

Affected: AlmaLinux:8: expat, AlmaLinux:8: expat-devel

Expat is a C library for parsing XML documents.

Security Fix(es):

* expat: Expat: Denial of Service via quadratic complexity in attribute processing (CVE-2026-66046) * expat: Expat: XML Injection via Malformed UTF-16 Input (CVE-2026-93990)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://vulnerability.circl.lu/vuln/bell-cve-2026-93990 BELL-CVE-2026-93990 2026-09-29T13:31:14.954237+00:00

Affected: Alpaquita:23: expat, Alpaquita:25: expat, Alpaquita:stream: expat, BellSoft Hardened Containers:23: expat, BellSoft Hardened Containers:25: expat, BellSoft Hardened Containers:stream: expat

 https://vulnerability.circl.lu/vuln/fkie_cve-2026-93990 fkie_cve-2026-93990 2026-09-29T13:31:14.954306+00:00

Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16 sequences to be accepted. Attackers can supply UTF-16 encoded XML containing lone high surrogates that consume the following code unit, causing Expat to pass unpaired surrogates to applications built with XML_UNICODE and to silently replace input characters in other builds.

 https://vulnerability.circl.lu/vuln/ghsa-rfp9-ffqc-h4x8 GHSA-rfp9-ffqc-h4x8 2026-09-29T13:31:14.954372+00:00

Expat through 2.8.4 fails to validate low surrogates following high surrogates in UTF-16 input, allowing malformed UTF-16 sequences to be accepted. Attackers can craft UTF-16 encoded XML with lone high surrogates that consume following code units, hiding markup characters from the parser and enabling XML injection attacks.

 https://vulnerability.circl.lu/vuln/msrc_cve-2026-93990 msrc_CVE-2026-93990 — Expat through 2.8.4 Malformed UTF-16 Acceptance via Unchecked Surrogate 2026-09-29T13:31:14.954406+00:00 msrc_CVE-2026-93990 https://vulnerability.circl.lu/vuln/rhsa-2026:71655 RHSA-2026:71655 — Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update 2026-09-29T13:31:14.954449+00:00

expat: Expat: XML Injection via Malformed UTF-16 Input

 https://vulnerability.circl.lu/vuln/rhsa-2026:72448 RHSA-2026:72448 — security update for expat 2026-09-29T13:31:14.954482+00:00

security update for expat

 https://vulnerability.circl.lu/vuln/rlsa-2026:72448 RLSA-2026:72448 — Important: expat security update 2026-09-29T13:31:14.954506+00:00

Affected: Rocky Linux:8: expat

Expat is a C library for parsing XML documents.

Security Fix(es):

* expat: Expat: Denial of Service via quadratic complexity in attribute processing (CVE-2026-66046)

* expat: Expat: XML Injection via Malformed UTF-16 Input (CVE-2026-93990)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://vulnerability.circl.lu/vuln/ubuntu-cve-2026-93990 UBUNTU-CVE-2026-93990 2026-09-29T13:31:14.954556+00:00

Affected: Ubuntu:Pro:14.04:LTS: coin3, Ubuntu:Pro:14.04:LTS: expat, Ubuntu:Pro:14.04:LTS: vnc4, Ubuntu:Pro:14.04:LTS: vtk, Ubuntu:Pro:14.04:LTS: xmlrpc-c, Ubuntu:Pro:16.04:LTS: expat, Ubuntu:Pro:16.04:LTS: ayttm, Ubuntu:Pro:16.04:LTS: cableswig, Ubuntu:16.04:LTS: cadaver, Ubuntu:Pro:16.04:LTS: coin3 and 57 more

Expat through 2.8.4 fails to validate low surrogates following high surrogates in UTF-16 input, allowing malformed UTF-16 sequences to be accepted. Attackers can craft UTF-16 encoded XML with lone high surrogates that consume following code units, hiding markup characters from the parser and enabling XML injection attacks.