Red Hat Security Advisory

RHSA-2026:90325

Red Hat Hardened Images RPMs Security Update

Released 2026-10-26 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Hardened Images expat-2.9.0-1.1.hum1@aarch64, expat-2.9.0-1.1.hum1@s390x, expat-2.9.0-1.1.hum1@src +7

Fixes 1 record

TI-2026-76800 CVE-2026-113351 · GHSA-6r6q-9jmv-gg3h

Denial of service in libexpat via XML_ParserReset

LOW 36

libexpat 2.7.2 through 2.9.0 contains a denial of service vulnerability because XML_ParserReset zeroes the direct byte count but never offsets tracked heap allocations.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00494 Published 2026-10-20 Partial fix CWE-909