Read the docs
TI-2025-36934 Aliases CVE-2025-59375GHSA-vjqp-pjp6-xcxx

Resource allocation without limits in libexpat

Priority LOW 36CWE-770Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 50 fixed, 3 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-770.

Summary

libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0138 72nd percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Partial libexpat (libexpat project): 2.7.2Red Hat: 53 advisoriesRed Hat: 50 fixed, 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
libexpat projectlibexpatbefore 2.7.22.7.2Patch availableCNA
  • libexpat Vendorlibexpat project Affected before 2.7.2 Fixed in 2.7.2 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:libexpat_project:libexpat:*:*:*:*:*:*:*:*before 2.7.2Vulnerablelibexpat project
  • cpe:2.3:a:libexpat_project:libexpat:*:*:*:*:*:*:*:* Versions before 2.7.2 Vulnerable ·libexpat project

Remediation

  • Fix · CNA libexpat (libexpat project) Fixed in 2.7.2

Red Hat 53 advisories

  • RHSA-2026:58981 Released 2026-08-24 · Red Hat rating Critical
    Red Hat Update Infrastructure 5.3 Technology Preview security update
    • Red Hat Update Infrastructure 5 registry.redhat.io/rhui5/cds-kubernetes-tp-rhel9, registry.redhat.io/rhui5/installer-tp-rhel9, registry.redhat.io/rhui5/rhua-tp-rhel9
  • RHSA-2026:21275 Released 2026-05-27 · Red Hat rating Critical
    Red Hat Update Infrastructure 5.1 security update
    • Red Hat Update Infrastructure 5 registry.redhat.io/rhui5/cds-rhel9, registry.redhat.io/rhui5/haproxy-rhel9, registry.redhat.io/rhui5/installer-rhel9 +1
  • RHSA-2026:19177 Released 2026-05-19 · Red Hat rating Important
    python3.12 security update
    • Red Hat Enterprise Linux AppStream (v. 9) python3.12-3.12.13-2.el9_8, python3.12-devel-3.12.13-2.el9_8, python3.12-libs-3.12.13-2.el9_8 +1
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) python3.12-3.12.13-2.el9_8, python3.12-debug-3.12.13-2.el9_8, python3.12-idle-3.12.13-2.el9_8 +2
Show 50 more Red Hat advisories
  • RHSA-2026:19064 Released 2026-05-19 · Red Hat rating Important
    python3.12 security update
    • Red Hat Enterprise Linux AppStream (v. 10) python-unversioned-command-3.12.13-2.el10_2, python3-devel-3.12.13-2.el10_2, python3-tkinter-3.12.13-2.el10_2
    • Red Hat Enterprise Linux BaseOS (v. 10) python3-3.12.13-2.el10_2, python3-libs-3.12.13-2.el10_2, python3.12-3.12.13-2.el10_2
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) python3-debug-3.12.13-2.el10_2, python3-idle-3.12.13-2.el10_2, python3-test-3.12.13-2.el10_2
  • RHSA-2026:10950 Released 2026-04-27 · Red Hat rating Important
    python3.12 security update
    • Red Hat Enterprise Linux AppStream (v. 8) python3.12-3.12.13-2.el8_10, python3.12-devel-3.12.13-2.el8_10, python3.12-libs-3.12.13-2.el8_10 +2
    • Red Hat Enterprise Linux CRB (v. 8) python3.12-3.12.13-2.el8_10, python3.12-debug-3.12.13-2.el8_10, python3.12-idle-3.12.13-2.el8_10 +2
  • RHSA-2026:5396 Released 2026-03-23 · Red Hat rating Important
    Red Hat Hardened Images RPM Release
    • Red Hat Hardened Images expat-2.7.5-1.hum1@aarch64, expat-2.7.5-1.hum1@src, expat-2.7.5-1.hum1@x86_64 +4
  • RHSA-2026:3462 Released 2026-02-27 · Red Hat rating Critical
    Red Hat AI Inference Server 3.2.2 (ROCm)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-rocm-rhel9
  • RHSA-2026:3461 Released 2026-02-27 · Red Hat rating Critical
    Red Hat AI Inference Server 3.2.2 (CUDA)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-cuda-rhel9
  • RHSA-2026:3407 Released 2026-02-26 · Red Hat rating Important
    mingw-fontconfig security update
    • Red Hat Enterprise Linux CRB (v. 8) mingw-fontconfig-2.12.6-4.el8_10, mingw32-fontconfig-2.12.6-4.el8_10, mingw64-fontconfig-2.12.6-4.el8_10
  • RHSA-2026:1541 Released 2026-02-05 · Red Hat rating Important
    OpenShift Container Platform 4.15.61 bug fix and security update
    • Red Hat OpenShift Container Platform 4.15 rhcos-aarch64-415.92.202601271320-0, rhcos-ppc64le-415.92.202601271320-0, rhcos-s390x-415.92.202601271320-0 +1
  • RHSA-2026:1652 Released 2026-02-02 · Red Hat rating Important
    Red Hat Ceph Storage
    • Red Hat Ceph Storage 8 registry.redhat.io/rhceph/rhceph-8-rhel9
  • RHSA-2026:0996 Released 2026-01-30 · Red Hat rating Important
    OpenShift Container Platform 4.14.61 bug fix and security update
    • Red Hat OpenShift Container Platform 4.14 rhcos-aarch64-414.92.202601191325-0, rhcos-ppc64le-414.92.202601191325-0, rhcos-s390x-414.92.202601191325-0 +1
  • RHSA-2026:0674 Released 2026-01-22 · Red Hat rating Important
    OpenShift Container Platform 4.19.22 bug fix and security update
    • Red Hat OpenShift Container Platform 4.19 rhcos-aarch64-4.19.9.6.202601130152-0, rhcos-ppc64le-4.19.9.6.202601130152-0, rhcos-s390x-4.19.9.6.202601130152-0 +1
  • RHSA-2026:0677 Released 2026-01-22 · Red Hat rating Important
    OpenShift Container Platform 4.13.63 bug fix and security update
    • Red Hat OpenShift Container Platform 4.13 rhcos-x86_64-413.92.202601130113-0
  • RHSA-2026:0702 Released 2026-01-22 · Red Hat rating Important
    OpenShift Container Platform 4.17.47 bug fix and security update
    • Red Hat OpenShift Container Platform 4.17 rhcos-aarch64-417.94.202601120213-0, rhcos-ppc64le-417.94.202601120213-0, rhcos-s390x-417.94.202601120213-0 +1
  • RHSA-2026:0934 Released 2026-01-22 · Red Hat rating Important
    Release of OpenShift Serverless Logic 1.36.0 security update & enhancements
    • 8Base-Openshift-Serverless-1.36 openshift-serverless-1/logic-data-index-ephemeral-rhel8, openshift-serverless-1/logic-data-index-postgresql-rhel8, openshift-serverless-1/logic-db-migrator-tool-rhel8 +8
  • RHSA-2026:0332 Released 2026-01-15 · Red Hat rating Important
    OpenShift Container Platform 4.18.31 bug fix and security update
    • Red Hat OpenShift Container Platform 4.18 rhcos-aarch64-418.94.202601071817-0, rhcos-ppc64le-418.94.202601071817-0, rhcos-s390x-418.94.202601071817-0 +1
  • RHSA-2026:0326 Released 2026-01-15 · Red Hat rating Important
    OpenShift Container Platform 4.16.55 bug fix and security update
    • Red Hat OpenShift Container Platform 4.16 rhcos-aarch64-416.94.202601071926-0, rhcos-ppc64le-416.94.202601071926-0, rhcos-s390x-416.94.202601071926-0 +1
  • RHSA-2026:0316 Released 2026-01-15 · Red Hat rating Important
    OpenShift Container Platform 4.12.84 bug fix and security update
    • Red Hat OpenShift Container Platform 4.12 rhcos-x86_64-412.86.202601061735-0
  • RHSA-2026:0420 Released 2026-01-14 · Red Hat rating Important
    OpenShift Container Platform 4.20.10 bug fix and security update
    • Red Hat OpenShift Container Platform 4.20 rhcos-aarch64-4.20.9.6.202601052146-0, rhcos-ppc64le-4.20.9.6.202601052146-0, rhcos-s390x-4.20.9.6.202601052146-0 +1
  • RHSA-2026:0518 Released 2026-01-13 · Red Hat rating Important
    Red Hat Quay 3.16.1
    • Red Hat Quay 3.16 registry.redhat.io/quay/quay-builder-rhel9, registry.redhat.io/quay/quay-rhel9
  • RHSA-2026:0414 Released 2026-01-08 · Red Hat rating Important
    A Subscription Management tool for finding and reporting Red Hat product usage
    • Red Hat Discovery 2 registry.redhat.io/discovery/discovery-server-rhel9, registry.redhat.io/discovery/discovery-ui-rhel9
  • RHSA-2026:0077 Released 2026-01-05 · Red Hat rating Important
    spice-client-win security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) spice-client-win-8.10-3.el8_4.1, spice-client-win-x64-8.10-3.el8_4.1, spice-client-win-x86-8.10-3.el8_4.1
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) spice-client-win-8.10-3.el8_4.1, spice-client-win-x64-8.10-3.el8_4.1, spice-client-win-x86-8.10-3.el8_4.1
  • RHSA-2026:0076 Released 2026-01-05 · Red Hat rating Important
    spice-client-win security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) spice-client-win-8.10-3.el8_6.1, spice-client-win-x64-8.10-3.el8_6.1, spice-client-win-x86-8.10-3.el8_6.1
    • Red Hat Enterprise Linux AppStream E4S (v.8.6) spice-client-win-8.10-3.el8_6.1, spice-client-win-x64-8.10-3.el8_6.1, spice-client-win-x86-8.10-3.el8_6.1
    • Red Hat Enterprise Linux AppStream TUS (v.8.6) spice-client-win-8.10-3.el8_6.1, spice-client-win-x64-8.10-3.el8_6.1, spice-client-win-x86-8.10-3.el8_6.1
  • RHSA-2026:0078 Released 2026-01-05 · Red Hat rating Important
    spice-client-win security update
    • Red Hat Enterprise Linux AppStream AUS (v. 8.2) spice-client-win-8.10-3.el8_2.1, spice-client-win-x64-8.10-3.el8_2.1, spice-client-win-x86-8.10-3.el8_2.1
  • RHSA-2026:0001 Released 2026-01-05 · Red Hat rating Important
    spice-client-win security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) spice-client-win-8.10-3.el8_8.1, spice-client-win-x64-8.10-3.el8_8.1, spice-client-win-x86-8.10-3.el8_8.1
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) spice-client-win-8.10-3.el8_8.1, spice-client-win-x64-8.10-3.el8_8.1, spice-client-win-x86-8.10-3.el8_8.1
  • RHSA-2025:23550 Released 2025-12-17 · Red Hat rating Important
    RHSA 4.8.7 security and bug fix update
    • Red Hat Advanced Cluster Security 4.8 registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-slim-rhel8
  • RHSA-2025:23449 Released 2025-12-17 · Red Hat rating Important
    Red Hat AI Inference Server 3.2.5 (ROCm)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-rocm-rhel9
  • RHSA-2025:23248 Released 2025-12-16 · Red Hat rating Important
    RHSA 4.7.9 security and bug fix update
    • Red Hat Advanced Cluster Security 4.7 registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8 +8
  • RHSA-2025:23227 Released 2025-12-16 · Red Hat rating Important
    Red Hat Ceph Storage
    • Red Hat Ceph Storage 8 registry.redhat.io/rhceph/rhceph-8-rhel9
  • RHSA-2025:23209 Released 2025-12-15 · Red Hat rating Important
    Red Hat AI Inference Server 3.2.5 (TPU)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-tpu-rhel9
  • RHSA-2025:23205 Released 2025-12-15 · Red Hat rating Important
    Red Hat AI Inference Server 3.2.5 (ROCm)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-rocm-rhel9
  • RHSA-2025:23204 Released 2025-12-15 · Red Hat rating Important
    Red Hat AI Inference Server 3.2.5 (CUDA)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-cuda-rhel9
  • RHSA-2025:23202 Released 2025-12-15 · Red Hat rating Important
    Red Hat AI Inference Server Model Optimization Tools 3.2.5 (CUDA)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/model-opt-cuda-rhel9
  • RHSA-2025:23080 Released 2025-12-10 · Red Hat rating Important
    Red Hat AI Inference Server Model Optimization Tools 3.2.2 (CUDA)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/model-opt-cuda-rhel9
  • RHSA-2025:23079 Released 2025-12-10 · Red Hat rating Important
    Red Hat AI Inference Server 3.2.2 (ROCm)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-rocm-rhel9
  • RHSA-2025:23078 Released 2025-12-10 · Red Hat rating Important
    Red Hat AI Inference Server 3.2.2 (CUDA)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-cuda-rhel9
  • RHSA-2025:22935 Released 2025-12-09 · Red Hat rating Important
    Red Hat Update Infrastructure 5 security update
    • Red Hat Update Infrastructure 5 registry.redhat.io/rhui5/cds-rhel9, registry.redhat.io/rhui5/haproxy-rhel9, registry.redhat.io/rhui5/installer-rhel9 +1
  • RHSA-2025:22871 Released 2025-12-09 · Red Hat rating Important
    expat security update
    • Red Hat Enterprise Linux BaseOS AUS (v. 8.2) expat-2.2.10-1.el8_2
  • RHSA-2025:22842 Released 2025-12-09 · Red Hat rating Important
    expat security update
    • Red Hat Enterprise Linux BaseOS AUS (v.8.6) expat-2.2.10-1.el8_6
    • Red Hat Enterprise Linux BaseOS E4S (v.8.6) expat-2.2.10-1.el8_6
    • Red Hat Enterprise Linux BaseOS TUS (v.8.6) expat-2.2.10-1.el8_6
  • RHSA-2025:22785 Released 2025-12-04 · Red Hat rating Important
    expat security update
    • Red Hat Enterprise Linux BaseOS AUS (v.8.4) expat-2.2.10-1.el8_4
    • Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) expat-2.2.10-1.el8_4
  • RHSA-2025:22618 Released 2025-12-02 · Red Hat rating Important
    Red Hat OpenShift distributed tracing platform (Tempo) 3.8.0 release
    • Red Hat OpenShift distributed tracing 3.8.0 registry.redhat.io/rhosdt/tempo-gateway-opa-rhel8, registry.redhat.io/rhosdt/tempo-gateway-rhel8, registry.redhat.io/rhosdt/tempo-jaeger-query-rhel8 +4
  • RHSA-2025:22607 Released 2025-12-02 · Red Hat rating Important
    expat security update
    • Red Hat Enterprise Linux BaseOS E4S (v.8.8) expat-2.2.10-1.el8_8
    • Red Hat Enterprise Linux BaseOS TUS (v.8.8) expat-2.2.10-1.el8_8
  • RHSA-2025:22175 Released 2025-11-26 · Red Hat rating Important
    expat security update
    • Red Hat Enterprise Linux AppStream (v. 9) expat-devel-2.5.0-5.el9_7.1
    • Red Hat Enterprise Linux BaseOS (v. 9) expat-2.5.0-5.el9_7.1
  • RHSA-2025:22033 Released 2025-11-25 · Red Hat rating Important
    expat security update
    • Red Hat Enterprise Linux BaseOS EUS (v.9.4) expat-2.5.0-2.el9_4.3
  • RHSA-2025:22034 Released 2025-11-25 · Red Hat rating Important
    expat security update
    • Red Hat Enterprise Linux BaseOS E4S (v.9.2) expat-2.5.0-1.el9_2.3
  • RHSA-2025:22035 Released 2025-11-25 · Red Hat rating Important
    expat security update
    • Red Hat Enterprise Linux BaseOS E4S (v.9.0) expat-2.2.10-12.el9_0.4
  • RHSA-2025:21974 Released 2025-11-24 · Red Hat rating Important
    mingw-expat security update
    • Red Hat Enterprise Linux CRB (v. 8) mingw-expat-2.5.0-1.el8_10, mingw32-expat-2.5.0-1.el8_10, mingw64-expat-2.5.0-1.el8_10
  • RHSA-2025:21776 Released 2025-11-19 · Red Hat rating Important
    expat security update
    • Red Hat Enterprise Linux BaseOS (v. 8) expat-2.5.0-1.el8_10, expat-devel-2.5.0-1.el8_10
  • RHSA-2025:21773 Released 2025-11-19 · Red Hat rating Important
    expat security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) expat-devel-2.5.0-5.el9_6.1
    • Red Hat Enterprise Linux BaseOS EUS (v.9.6) expat-2.5.0-5.el9_6.1
  • RHSA-2025:21030 Released 2025-11-11 · Red Hat rating Important
    expat security update
    • Red Hat Enterprise Linux AppStream (v. 10) expat-devel-2.7.1-1.el10_1.3
    • Red Hat Enterprise Linux BaseOS (v. 10) expat-2.7.1-1.el10_1.3
  • RHSA-2025:19403 Released 2025-11-03 · Red Hat rating Important
    expat security update
    • Red Hat Enterprise Linux AppStream (v. 10) expat-devel-2.7.1-1.el10_0.3
    • Red Hat Enterprise Linux BaseOS (v. 10) expat-2.7.1-1.el10_0.3
  • RHSA-2025:19020 Released 2025-10-27 · Red Hat rating Important
    Red Hat JBoss Core Services Apache HTTP Server 2.4.62 SP2 security update
    • Red Hat JBoss Core Services 2.4.62.SP2

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 10AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 8AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 9AffectedNo fix planned: Will not fix
8Base-Openshift-Serverless-1.36Fixed RHSA-2026:0934
Red Hat AI Inference Server 3.2Fixed RHSA-2025:23078, RHSA-2025:23079, RHSA-2025:23080, RHSA-2025:23202, RHSA-2025:23204, RHSA-2025:23205, RHSA-2025:23209, RHSA-2025:23449, RHSA-2026:3461, RHSA-2026:3462
Red Hat Advanced Cluster Security 4.7Fixed RHSA-2025:23248
Red Hat Advanced Cluster Security 4.8Fixed RHSA-2025:23550
Red Hat Ceph Storage 8Fixed RHSA-2025:23227, RHSA-2026:1652
Red Hat Discovery 2Fixed RHSA-2026:0414
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2025:19403, RHSA-2025:21030, RHSA-2026:19064
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:10950
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2025:22175, RHSA-2026:19177
Red Hat Enterprise Linux AppStream AUS (v. 8.2)Fixed RHSA-2026:0078
Red Hat Enterprise Linux AppStream AUS (v.8.4)Fixed RHSA-2026:0077
Red Hat Enterprise Linux AppStream AUS (v.8.6)Fixed RHSA-2026:0076
Red Hat Enterprise Linux AppStream E4S (v.8.6)Fixed RHSA-2026:0076
Red Hat Enterprise Linux AppStream E4S (v.8.8)Fixed RHSA-2026:0001
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2025:21773
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)Fixed RHSA-2026:0077
Red Hat Enterprise Linux AppStream TUS (v.8.6)Fixed RHSA-2026:0076
Red Hat Enterprise Linux AppStream TUS (v.8.8)Fixed RHSA-2026:0001
Red Hat Enterprise Linux BaseOS (v. 10)Fixed RHSA-2025:19403, RHSA-2025:21030, RHSA-2026:19064
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2025:21776
Red Hat Enterprise Linux BaseOS (v. 9)Fixed RHSA-2025:22175
Red Hat Enterprise Linux BaseOS AUS (v. 8.2)Fixed RHSA-2025:22871
Red Hat Enterprise Linux BaseOS AUS (v.8.4)Fixed RHSA-2025:22785
Red Hat Enterprise Linux BaseOS AUS (v.8.6)Fixed RHSA-2025:22842
Red Hat Enterprise Linux BaseOS E4S (v.8.6)Fixed RHSA-2025:22842
Red Hat Enterprise Linux BaseOS E4S (v.8.8)Fixed RHSA-2025:22607
Red Hat Enterprise Linux BaseOS E4S (v.9.0)Fixed RHSA-2025:22035
Red Hat Enterprise Linux BaseOS E4S (v.9.2)Fixed RHSA-2025:22034
Red Hat Enterprise Linux BaseOS EUS (v.9.4)Fixed RHSA-2025:22033
Red Hat Enterprise Linux BaseOS EUS (v.9.6)Fixed RHSA-2025:21773
Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)Fixed RHSA-2025:22785
Red Hat Enterprise Linux BaseOS TUS (v.8.6)Fixed RHSA-2025:22842
Red Hat Enterprise Linux BaseOS TUS (v.8.8)Fixed RHSA-2025:22607
Red Hat Enterprise Linux CRB (v. 8)Fixed RHSA-2025:21974, RHSA-2026:10950, RHSA-2026:3407
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)Fixed RHSA-2026:19064
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)Fixed RHSA-2026:19177
Red Hat Hardened ImagesFixed RHSA-2026:5396
Red Hat JBoss Core Services 2.4.62.SP2Fixed RHSA-2025:19020
Red Hat OpenShift Container Platform 4.12Fixed RHSA-2026:0316
Red Hat OpenShift Container Platform 4.13Fixed RHSA-2026:0677
Red Hat OpenShift Container Platform 4.14Fixed RHSA-2026:0996
Red Hat OpenShift Container Platform 4.15Fixed RHSA-2026:1541
Red Hat OpenShift Container Platform 4.16Fixed RHSA-2026:0326
Red Hat OpenShift Container Platform 4.17Fixed RHSA-2026:0702
Red Hat OpenShift Container Platform 4.18Fixed RHSA-2026:0332
Red Hat OpenShift Container Platform 4.19Fixed RHSA-2026:0674
Red Hat OpenShift Container Platform 4.20Fixed RHSA-2026:0420
Red Hat OpenShift distributed tracing 3.8.0Fixed RHSA-2025:22618
Red Hat Quay 3.16Fixed RHSA-2026:0518
Red Hat Update Infrastructure 5Fixed RHSA-2025:22935, RHSA-2026:21275, RHSA-2026:58981
Not affected: 22 products
  • Red Hat Advanced Cluster Security 4.7
  • Red Hat Advanced Cluster Security 4.8
  • Red Hat Ceph Storage 8
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux AppStream E4S (v.9.0)
  • Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • Red Hat Enterprise Linux AppStream EUS (v.9.4)
  • Red Hat Enterprise Linux BaseOS AUS (v. 8.2)
  • Red Hat Enterprise Linux BaseOS AUS (v.8.4)
  • Red Hat Enterprise Linux BaseOS AUS (v.8.6)
  • Red Hat Enterprise Linux BaseOS E4S (v.8.6)
  • Red Hat Enterprise Linux BaseOS E4S (v.8.8)
  • Red Hat Enterprise Linux BaseOS E4S (v.9.0)
  • Red Hat Enterprise Linux BaseOS E4S (v.9.2)
  • Red Hat Enterprise Linux BaseOS EUS (v.9.4)
  • Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)
  • Red Hat Enterprise Linux BaseOS TUS (v.8.6)
  • Red Hat Enterprise Linux BaseOS TUS (v.8.8)
  • Red Hat Quay 3.16
  • Red Hat Update Infrastructure 5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-59375
  2. 2026-10-03 Alias added: GHSA-vjqp-pjp6-xcxx
  3. 2026-10-09 Fix available: RHSA-2025:19020 · Red Hat
  4. 2026-10-09 Fix available: Red Hat JBoss Core Services 2.4.62.SP2 · Red Hat

References

Exploit 2

Other 3

  • TI-2022-09008 In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames. CVSS 3.1CRITICAL 9.8
  • TI-2026-79488 Billion laughs detection delay in libexpat enables denial of service CVSS 4.0HIGH 8.7
  • TI-2022-08947 xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert… CVSS 3.1CRITICAL 9.8
  • TI-2021-20962 In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the… CVSS 3.1HIGH 8.8
  • TI-2021-21076 In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for m_groupSize. CVSS 3.1HIGH 8.1
  • TI-2016-00645 Expat allows context-dependent attackers to cause a denial of service (crash) or possibly… CVSS 3.1CRITICAL 9.8
See all 67 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences