Red Hat Security Advisory

RHSA-2026:72448

expat security update

Released 2026-09-28 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux BaseOS (v. 8) expat-2.5.0-4.el8_10, expat-devel-2.5.0-4.el8_10

Fixes 2 records

TI-2026-47031 CVE-2026-66046 · GHSA-m3rp-25vq-jfcv

Expat Denial of Service via storeAtts() Quadratic Complexity

MEDIUM 45

Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized values trig…

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00742 Published 2026-08-18 Partial fix CWE-407

TI-2026-63249 CVE-2026-93990 · GHSA-rfp9-ffqc-h4x8

Expat before 2.8.5 Malformed UTF-16 Acceptance via Unchecked Surrogate

MEDIUM 44

Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16 sequences to be accepted.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00403 Published 2026-09-19 Partial fix · 2.8.5 CWE-176