Most recent entries from all

ALSA-2026:72448 — Important: expat security update

Affected: AlmaLinux:8: expat, AlmaLinux:8: expat-devel

Expat is a C library for parsing XML documents.

Security Fix(es):

* expat: Expat: Denial of Service via quadratic complexity in attribute processing (CVE-2026-66046) * expat: Expat: XML Injection via Malformed UTF-16 Input (CVE-2026-93990)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

BELL-CVE-2026-93990

Affected: Alpaquita:23: expat, Alpaquita:25: expat, Alpaquita:stream: expat, BellSoft Hardened Containers:23: expat, BellSoft Hardened Containers:25: expat, BellSoft Hardened Containers:stream: expat

fkie_cve-2026-93990

Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16 sequences to be accepted. Attackers can supply UTF-16 encoded XML containing lone high surrogates that consume the following code unit, causing Expat to pass unpaired surrogates to applications built with XML_UNICODE and to silently replace input characters in other builds.

GHSA-rfp9-ffqc-h4x8

Expat through 2.8.4 fails to validate low surrogates following high surrogates in UTF-16 input, allowing malformed UTF-16 sequences to be accepted. Attackers can craft UTF-16 encoded XML with lone high surrogates that consume following code units, hiding markup characters from the parser and enabling XML injection attacks.

msrc_CVE-2026-93990 — Expat through 2.8.4 Malformed UTF-16 Acceptance via Unchecked Surrogate

msrc_CVE-2026-93990

RHSA-2026:71655 — Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

expat: Expat: XML Injection via Malformed UTF-16 Input

RHSA-2026:72448 — security update for expat

security update for expat

RLSA-2026:72448 — Important: expat security update

Affected: Rocky Linux:8: expat

Expat is a C library for parsing XML documents.

Security Fix(es):

* expat: Expat: Denial of Service via quadratic complexity in attribute processing (CVE-2026-66046)

* expat: Expat: XML Injection via Malformed UTF-16 Input (CVE-2026-93990)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

UBUNTU-CVE-2026-93990

Affected: Ubuntu:Pro:14.04:LTS: coin3, Ubuntu:Pro:14.04:LTS: expat, Ubuntu:Pro:14.04:LTS: vnc4, Ubuntu:Pro:14.04:LTS: vtk, Ubuntu:Pro:14.04:LTS: xmlrpc-c, Ubuntu:Pro:16.04:LTS: expat, Ubuntu:Pro:16.04:LTS: ayttm, Ubuntu:Pro:16.04:LTS: cableswig, Ubuntu:16.04:LTS: cadaver, Ubuntu:Pro:16.04:LTS: coin3 and 57 more