Red Hat Security Advisory

RHSA-2026:40486

Red Hat Hardened Images RPMs bug fix and enhancement update

Released 2026-07-15 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Hardened Images expat-2.8.2-1.1.hum1@aarch64, expat-2.8.2-1.1.hum1@src, expat-2.8.2-1.1.hum1@x86_64 +4

TI-2026-40765 CVE-2026-56407 · GHSA-r8qx-5vfx-8w6r

LOW 32

libexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity textLen.

CVSS 3.1MEDIUM 6.9 Local No auth No interaction EPSS 0.00174 Published 2026-06-21 Partial fix · 2.8.2 CWE-190

TI-2026-40762 CVE-2026-56404 · GHSA-h5j3-rr49-jmm6

LOW 31

libexpat before 2.8.2 has an integer overflow in addBinding.

CVSS 3.1MEDIUM 6.9 Local No auth No interaction EPSS 0.0013 Published 2026-06-21 Partial fix · 2.8.2 CWE-190

TI-2026-40509 CVE-2026-56131 · GHSA-fchf-wvcc-qf9g

LOW 22

libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation.

CVSS 3.1MEDIUM 4.9 Local No auth No interaction EPSS 0.00175 Published 2026-06-19 Partial fix · 2.8.2 CWE-416