Every CVE Search/ Get API key

CVE-2026-45186

In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows...

2.9 LowFix available

In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

0.48%Up 0.5 points since May 10, 2026
90%50%10%1%

What each source reports

CVE List Score used 2.9

In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input.

Record
CVE-2026-45186
CVSS 3.1
2.9 LowCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-407, CWE-407
Updated
2026-11-02
EUVDEUVD-2026-28985 7.5

In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input.

Record
EUVD-2026-28985
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-r396-2q2c-pjhr 2.9

In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows...

In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input.

Record
GHSA-r396-2q2c-pjhr
CVSS 3.1
2.9 LowCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-407
Updated
2026-11-02
NVD 2.9

In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input.

Record
CVE-2026-45186
CVSS 3.1
2.9 LowCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-407
Updated
2026-11-02
OSVALPINE-CVE-2026-45186 7.5

In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input.

Record
ALPINE-CVE-2026-45186
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVBELL-CVE-2026-45186 7.5
Record
BELL-CVE-2026-45186
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 48 moreShow less
OSV 2.9

In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input.

Record
CVE-2026-45186
CVSS 3.1
2.9 LowCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-407
Updated
2026-11-07
OSVDEBIAN-CVE-2026-45186 7.5

In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input.

Record
DEBIAN-CVE-2026-45186
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVJLSEC-2026-1223 7.5

In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input.

Record
JLSEC-2026-1223
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2026-2430 7.5

expat security update

expat is a stream-oriented XML parser library written in C. expat excels with files too large to fit RAM, and where performance and flexibility are crucial.

Security Fix(es):

In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input.(CVE-2026-45186)

Record
OESA-2026-2430
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2026-2431 7.5

expat security update

expat is a stream-oriented XML parser library written in C. expat excels with files too large to fit RAM, and where performance and flexibility are crucial.

Security Fix(es):

In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input.(CVE-2026-45186)

Record
OESA-2026-2431
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2026-2432 7.5

expat security update

expat is a stream-oriented XML parser library written in C. expat excels with files too large to fit RAM, and where performance and flexibility are crucial.

Security Fix(es):

In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input.(CVE-2026-45186)

Record
OESA-2026-2432
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2026-2433 7.5

expat security update

expat is a stream-oriented XML parser library written in C. expat excels with files too large to fit RAM, and where performance and flexibility are crucial.

Security Fix(es):

In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input.(CVE-2026-45186)

Record
OESA-2026-2433
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2026-2500 7.5

expat security update

expat is a stream-oriented XML parser library written in C. expat excels with files too large to fit RAM, and where performance and flexibility are crucial.

Security Fix(es):

In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input.(CVE-2026-45186)

Record
OESA-2026-2500
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:22715 7.5

Red Hat Security Advisory: expat security update

Record
RHSA-2026:22715
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:22721 7.5

Red Hat Security Advisory: expat security update

Record
RHSA-2026:22721
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:23230 7.5

Red Hat Security Advisory: expat security update

Record
RHSA-2026:23230
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:77236 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:77236
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:22715 7.5

Important: expat security update

Expat is a C library for parsing XML documents.

Security Fix(es):

  • libexpat: denial of service via crafted XML input (CVE-2026-45186)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:22715
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:22721 7.5

Important: expat security update

Expat is a C library for parsing XML documents.

Security Fix(es):

  • libexpat: denial of service via crafted XML input (CVE-2026-45186)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:22721
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:23230 7.5

Important: expat security update

Expat is a C library for parsing XML documents.

Security Fix(es):

  • libexpat: denial of service via crafted XML input (CVE-2026-45186)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:23230
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:89756 7.5

Important: firefox security, bug fix, and enhancement update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

  • libexpat: denial of service via crafted XML input (CVE-2026-45186)

  • firefox: thunderbird: Privilege escalation in the Application Update component (CVE-2026-109704)

  • firefox: Use-after-free in the XML component (CVE-2026-109718)

  • firefox: Information disclosure in the PDF Viewer component (CVE-2026-109742)

  • firefox: Incorrect boundary conditions in the JavaScript Engine component (CVE-2026-109715)

  • firefox: firefox: Sandbox escape via incorrect boundary conditions in Win32 widget (CVE-2026-109740)

  • firefox: Use-after-free in the Storage: IndexedDB component (CVE-2026-109706)

  • firefox: Use-after-free in the Crash Reporting component (CVE-2026-109713)

  • firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-109724)

  • firefox: Sandbox escape due to uninitialized memory in the DOM: Web Serial component (CVE-2026-109745)

  • firefox: Mitigation bypass in the File Handling component (CVE-2026-109782)

  • firefox: Information disclosure, privilege escalation in the Security: Process Sandboxing component (CVE-2026-109709)

  • firefox: Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component (CVE-2026-109705)

  • firefox: Use-after-free in the Audio/Video: Playback component (CVE-2026-109738)

  • firefox: Use-after-free in the Storage: Bucket File System component (CVE-2026-109741)

  • firefox: Use-after-free in the JavaScript Engine: JIT component (CVE-2026-109729)

  • firefox: Other issue in the DOM: File component (CVE-2026-109744)

  • firefox: Incorrect boundary conditions in the JavaScript Engine component (CVE-2026-109716)

  • firefox: Race condition, use-after-free in the Graphics: CanvasWebGL component (CVE-2026-109719)

  • firefox: Incorrect boundary conditions in the Layout component (CVE-2026-109753)

  • firefox: Integer overflow in the Layout: Text and Fonts component (CVE-2026-109723)

  • firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-109733)

  • firefox: Sandbox escape due to incorrect boundary conditions in the Networking component (CVE-2026-109708)

  • firefox: Use-after-free in the DOM: Bindings (WebIDL) component (CVE-2026-109717)

  • firefox: Use-after-free in the DOM: Workers component (CVE-2026-109752)

  • firefox: Sandbox escape due to use-after-free in the Networking component (CVE-2026-109707)

  • firefox: JIT miscompilation in the JavaScript: WebAssembly component (CVE-2026-109720)

  • firefox: Use-after-free in the SVG component (CVE-2026-109726)

  • firefox: Integer overflow in the Graphics component (CVE-2026-109730)

  • firefox: Use-after-free in the Audio/Video component (CVE-2026-109727)

  • firefox: Mitigation bypass in the Enterprise Policies component (CVE-2026-109737)

  • firefox: Use-after-free in the DOM: Streams component (CVE-2026-109732)

  • firefox: Information disclosure in the Networking component (CVE-2026-109751)

  • firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-109725)

  • firefox: Sandbox escape due to uninitialized memory in the Graphics component (CVE-2026-109712)

  • firefox: Use-after-free in the Graphics: Canvas2D component (CVE-2026-109711)

  • firefox: Frame poisoning in the Layout component (CVE-2026-109736)

  • firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-109722)

  • firefox: Use-after-free in the DOM: Animation component (CVE-2026-109728)

  • firefox: Incorrect boundary conditions in the JavaScript Engine: JIT component (CVE-2026-109721)

  • firefox: Privilege escalation in the Panning and Zooming component (CVE-2026-109743)

Bug Fix(es) and Enhancement(s):

  • Firefox ESR 153 rebase [rhel-8.10.z] (JIRA:Rocky Linux-175143)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References…

Record
RLSA-2026:89756
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2026:89757 7.5

Important: firefox security, bug fix, and enhancement update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

  • libexpat: denial of service via crafted XML input (CVE-2026-45186)

  • firefox: thunderbird: Privilege escalation in the Application Update component (CVE-2026-109704)

  • firefox: Use-after-free in the XML component (CVE-2026-109718)

  • firefox: Information disclosure in the PDF Viewer component (CVE-2026-109742)

  • firefox: Incorrect boundary conditions in the JavaScript Engine component (CVE-2026-109715)

  • firefox: firefox: Sandbox escape via incorrect boundary conditions in Win32 widget (CVE-2026-109740)

  • firefox: Use-after-free in the Storage: IndexedDB component (CVE-2026-109706)

  • firefox: Use-after-free in the Crash Reporting component (CVE-2026-109713)

  • firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-109724)

  • firefox: Sandbox escape due to uninitialized memory in the DOM: Web Serial component (CVE-2026-109745)

  • firefox: Mitigation bypass in the File Handling component (CVE-2026-109782)

  • firefox: Information disclosure, privilege escalation in the Security: Process Sandboxing component (CVE-2026-109709)

  • firefox: Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component (CVE-2026-109705)

  • firefox: Use-after-free in the Audio/Video: Playback component (CVE-2026-109738)

  • firefox: Sandbox escape due to race condition in the Networking component (CVE-2026-109757)

  • firefox: Use-after-free in the Storage: Bucket File System component (CVE-2026-109741)

  • firefox: Use-after-free in the JavaScript Engine: JIT component (CVE-2026-109729)

  • firefox: Other issue in the DOM: File component (CVE-2026-109744)

  • firefox: Incorrect boundary conditions in the JavaScript Engine component (CVE-2026-109716)

  • firefox: Race condition, use-after-free in the Graphics: CanvasWebGL component (CVE-2026-109719)

  • firefox: Incorrect boundary conditions in the Layout component (CVE-2026-109753)

  • firefox: Integer overflow in the Layout: Text and Fonts component (CVE-2026-109723)

  • firefox: Privilege escalation in the DOM: Navigation component (CVE-2026-109756)

  • firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-109733)

  • firefox: Mitigation bypass in the File Handling component (CVE-2026-109763)

  • firefox: Sandbox escape due to incorrect boundary conditions in the Networking component (CVE-2026-109708)

  • firefox: Use-after-free in the DOM: Bindings (WebIDL) component (CVE-2026-109717)

  • firefox: Use-after-free in the DOM: Workers component (CVE-2026-109752)

  • firefox: Sandbox escape due to use-after-free in the Networking component (CVE-2026-109707)

  • firefox: Mitigation bypass in the Networking: HTTP component (CVE-2026-109760)

  • firefox: JIT miscompilation in the JavaScript: WebAssembly component (CVE-2026-109720)

  • firefox: Use-after-free in the SVG component (CVE-2026-109726)

  • firefox: Integer overflow in the Graphics component (CVE-2026-109730)

  • firefox: Use-after-free in the Audio/Video component (CVE-2026-109727)

  • firefox: Mitigation bypass in the Enterprise Policies component (CVE-2026-109737)

  • firefox: Use-after-free in the DOM: Streams component (CVE-2026-109732)

  • firefox: Site isolation issue in the Networking component (CVE-2026-109759)

  • firefox: Incorrect boundary conditions in the SVG component (CVE-2026-109762)

  • firefox: Incorrect boundary conditions in the DOM: Editor component (CVE-2026-109754)

  • firefox: Information disclosure in the Networking component (CVE-2026-109751)

  • firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-109725)

  • firefox: Sandbox escape due to uninitialized memory in the Graphics component (CVE-2026-109712)

  • firefox: Use-after-free in the Graphics: Canvas2D component (CVE-2026-109711)

  • firefox: Frame poisoning in the Layout component (CVE-2026-109736)

  • firefox: JIT miscompilation in the JavaScript…

Record
RLSA-2026:89757
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2026:89758 8.2

Important: firefox security, bug fix, and enhancement update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

  • libexpat: denial of service via crafted XML input (CVE-2026-45186)

  • expat: expat: Information disclosure via heap buffer over-read in XML_ParseBuffer (CVE-2026-77214)

  • firefox: thunderbird: Privilege escalation in the Application Update component (CVE-2026-109704)

  • firefox: Use-after-free in the XML component (CVE-2026-109718)

  • firefox: Incorrect boundary conditions in the JavaScript Engine component (CVE-2026-109715)

  • firefox: firefox: Sandbox escape via incorrect boundary conditions in Win32 widget (CVE-2026-109740)

  • firefox: Use-after-free in the Storage: IndexedDB component (CVE-2026-109706)

  • firefox: Use-after-free in the Crash Reporting component (CVE-2026-109713)

  • firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-109724)

  • firefox: Information disclosure, privilege escalation in the Security: Process Sandboxing component (CVE-2026-109709)

  • firefox: Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component (CVE-2026-109705)

  • firefox: Use-after-free in the JavaScript Engine: JIT component (CVE-2026-109729)

  • firefox: Incorrect boundary conditions in the JavaScript Engine component (CVE-2026-109716)

  • firefox: Race condition, use-after-free in the Graphics: CanvasWebGL component (CVE-2026-109719)

  • firefox: Integer overflow in the Layout: Text and Fonts component (CVE-2026-109723)

  • firefox: Sandbox escape due to incorrect boundary conditions in the Networking component (CVE-2026-109708)

  • firefox: Use-after-free in the DOM: Bindings (WebIDL) component (CVE-2026-109717)

  • firefox: Sandbox escape due to use-after-free in the Networking component (CVE-2026-109707)

  • firefox: JIT miscompilation in the JavaScript: WebAssembly component (CVE-2026-109720)

  • firefox: Use-after-free in the SVG component (CVE-2026-109726)

  • firefox: Integer overflow in the Graphics component (CVE-2026-109730)

  • firefox: Use-after-free in the Audio/Video component (CVE-2026-109727)

  • firefox: Use-after-free in the DOM: Streams component (CVE-2026-109732)

  • firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-109725)

  • firefox: Sandbox escape due to uninitialized memory in the Graphics component (CVE-2026-109712)

  • firefox: Use-after-free in the Graphics: Canvas2D component (CVE-2026-109711)

  • firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-109722)

  • firefox: Use-after-free in the DOM: Animation component (CVE-2026-109728)

  • firefox: Incorrect boundary conditions in the JavaScript Engine: JIT component (CVE-2026-109721)

Bug Fix(es) and Enhancement(s):

  • Firefox ESR 153 rebase [rhel-10.2.z] (JIRA:Rocky Linux-175166)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:89758
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
Updated
2026-11-02
OSVRLSA-2026:90895 7.5

Important: thunderbird security, bug fix, and enhancement update

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

  • libexpat: denial of service via crafted XML input (CVE-2026-45186)

Bug Fix(es) and Enhancement(s):

  • Thunderbird ESR 153 rebase [rhel-10.2.z] (JIRA:Rocky Linux-175207)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:90895
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:93443 7.5

Important: thunderbird security, bug fix, and enhancement update

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

  • libexpat: denial of service via crafted XML input (CVE-2026-45186)

  • firefox: Mitigation bypass in the Enterprise Policies component (CVE-2026-109764)

  • firefox: Spoofing issue in the DOM: Web Serial component (CVE-2026-109770)

  • firefox: Mitigation bypass in the File Handling component (CVE-2026-109783)

  • firefox: thunderbird: Privilege escalation in the Application Update component (CVE-2026-109704)

  • firefox: Use-after-free in the XML component (CVE-2026-109718)

  • firefox: Information disclosure in the PDF Viewer component (CVE-2026-109742)

  • firefox: Incorrect boundary conditions in the JavaScript Engine component (CVE-2026-109715)

  • firefox: firefox: Sandbox escape via incorrect boundary conditions in Win32 widget (CVE-2026-109740)

  • firefox: Use-after-free in the Storage: IndexedDB component (CVE-2026-109706)

  • firefox: Use-after-free in the Crash Reporting component (CVE-2026-109713)

  • firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-109724)

  • firefox: Sandbox escape due to uninitialized memory in the DOM: Web Serial component (CVE-2026-109745)

  • firefox: Mitigation bypass in the File Handling component (CVE-2026-109782)

  • firefox: Information disclosure, privilege escalation in the Security: Process Sandboxing component (CVE-2026-109709)

  • firefox: Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component (CVE-2026-109705)

  • firefox: Use-after-free in the Audio/Video: Playback component (CVE-2026-109738)

  • firefox: Sandbox escape due to race condition in the Networking component (CVE-2026-109757)

  • firefox: Use-after-free in the Storage: Bucket File System component (CVE-2026-109741)

  • firefox: Use-after-free in the JavaScript Engine: JIT component (CVE-2026-109729)

  • firefox: Other issue in the DOM: File component (CVE-2026-109744)

  • firefox: Incorrect boundary conditions in the JavaScript Engine component (CVE-2026-109716)

  • firefox: Race condition, use-after-free in the Graphics: CanvasWebGL component (CVE-2026-109719)

  • firefox: Incorrect boundary conditions in the Layout component (CVE-2026-109753)

  • firefox: Integer overflow in the Layout: Text and Fonts component (CVE-2026-109723)

  • firefox: Privilege escalation in the DOM: Navigation component (CVE-2026-109756)

  • firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-109733)

  • firefox: thunderbird: Mitigation bypass in the DOM: Security component (CVE-2026-109734)

  • firefox: Mitigation bypass in the File Handling component (CVE-2026-109763)

  • firefox: Sandbox escape due to incorrect boundary conditions in the Networking component (CVE-2026-109708)

  • firefox: Use-after-free in the DOM: Bindings (WebIDL) component (CVE-2026-109717)

  • firefox: Use-after-free in the DOM: Workers component (CVE-2026-109752)

  • firefox: Race condition in the XPCOM component (CVE-2026-109776)

  • firefox: Sandbox escape due to use-after-free in the Networking component (CVE-2026-109707)

  • firefox: Mitigation bypass in the Networking: HTTP component (CVE-2026-109760)

  • firefox: JIT miscompilation in the JavaScript: WebAssembly component (CVE-2026-109720)

  • firefox: Information disclosure in the Storage: IndexedDB component (CVE-2026-109777)

  • firefox: Use-after-free in the SVG component (CVE-2026-109726)

  • firefox: Integer overflow in the Graphics component (CVE-2026-109730)

  • firefox: Use-after-free in the Audio/Video component (CVE-2026-109727)

  • firefox: Mitigation bypass in the Enterprise Policies component (CVE-2026-109737)

  • firefox: Mitigation bypass in the Enterprise Policies component (CVE-2026-109766)

  • firefox: Use-after-free in the DOM: Streams component (CVE-2026-109732)

  • firefox: Site isolation issue in the Networking component (CVE-2026-109759)

  • firefox: Privilege escalation in the WebExtensions component (CVE-2026-109778)

  • firefox: Incorrect…

Record
RLSA-2026:93443
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-03
OSVROOT-OS-DEBIAN-11-CVE-2026-45186 7.5

CVE-2026-45186 in expat - Patched by Root

Root has patched CVE-2026-45186 in the expat package for Root:Debian:11. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-11-CVE-2026-45186
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVROOT-OS-DEBIAN-12-CVE-2026-45186 7.5

CVE-2026-45186 in expat - Patched by Root

Root has patched CVE-2026-45186 in the expat package for Root:Debian:12. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-12-CVE-2026-45186
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVROOT-OS-DEBIAN-13-CVE-2026-45186 7.5

CVE-2026-45186 in expat - Patched by Root

Root has patched CVE-2026-45186 in the expat package for Root:Debian:13. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-13-CVE-2026-45186
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-45186 2.9

In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input.

Record
UBUNTU-CVE-2026-45186
CVSS 3.1
2.9 LowCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVALSA-2026:22715 No score

Important: expat security update

Expat is a C library for parsing XML documents.

Security Fix(es):

  • libexpat: denial of service via crafted XML input (CVE-2026-45186)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:22715
Updated
2026-11-02
OSVALSA-2026:22721 No score

Important: expat security update

Expat is a C library for parsing XML documents.

Security Fix(es):

  • libexpat: denial of service via crafted XML input (CVE-2026-45186)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:22721
Updated
2026-11-02
OSVALSA-2026:23230 No score

Important: expat security update

Expat is a C library for parsing XML documents.

Security Fix(es):

  • libexpat: denial of service via crafted XML input (CVE-2026-45186)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:23230
Updated
2026-11-02
OSVALSA-2026:89756 No score

Important: firefox security, bug fix, and enhancement update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

  • libexpat: denial of service via crafted XML input (CVE-2026-45186)
  • firefox: thunderbird: Privilege escalation in the Application Update component (CVE-2026-109704)
  • firefox: Use-after-free in the XML component (CVE-2026-109718)
  • firefox: Information disclosure in the PDF Viewer component (CVE-2026-109742)
  • firefox: Incorrect boundary conditions in the JavaScript Engine component (CVE-2026-109715)
  • firefox: firefox: Sandbox escape via incorrect boundary conditions in Win32 widget (CVE-2026-109740)
  • firefox: Use-after-free in the Storage: IndexedDB component (CVE-2026-109706)
  • firefox: Use-after-free in the Crash Reporting component (CVE-2026-109713)
  • firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-109724)
  • firefox: Sandbox escape due to uninitialized memory in the DOM: Web Serial component (CVE-2026-109745)
  • firefox: Mitigation bypass in the File Handling component (CVE-2026-109782)
  • firefox: Information disclosure, privilege escalation in the Security: Process Sandboxing component (CVE-2026-109709)
  • firefox: Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component (CVE-2026-109705)
  • firefox: Use-after-free in the Audio/Video: Playback component (CVE-2026-109738)
  • firefox: Use-after-free in the Storage: Bucket File System component (CVE-2026-109741)
  • firefox: Use-after-free in the JavaScript Engine: JIT component (CVE-2026-109729)
  • firefox: Other issue in the DOM: File component (CVE-2026-109744)
  • firefox: Incorrect boundary conditions in the JavaScript Engine component (CVE-2026-109716)
  • firefox: Race condition, use-after-free in the Graphics: CanvasWebGL component (CVE-2026-109719)
  • firefox: Incorrect boundary conditions in the Layout component (CVE-2026-109753)
  • firefox: Integer overflow in the Layout: Text and Fonts component (CVE-2026-109723)
  • firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-109733)
  • firefox: Sandbox escape due to incorrect boundary conditions in the Networking component (CVE-2026-109708)
  • firefox: Use-after-free in the DOM: Bindings (WebIDL) component (CVE-2026-109717)
  • firefox: Use-after-free in the DOM: Workers component (CVE-2026-109752)
  • firefox: Sandbox escape due to use-after-free in the Networking component (CVE-2026-109707)
  • firefox: JIT miscompilation in the JavaScript: WebAssembly component (CVE-2026-109720)
  • firefox: Use-after-free in the SVG component (CVE-2026-109726)
  • firefox: Integer overflow in the Graphics component (CVE-2026-109730)
  • firefox: Use-after-free in the Audio/Video component (CVE-2026-109727)
  • firefox: Mitigation bypass in the Enterprise Policies component (CVE-2026-109737)
  • firefox: Use-after-free in the DOM: Streams component (CVE-2026-109732)
  • firefox: Information disclosure in the Networking component (CVE-2026-109751)
  • firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-109725)
  • firefox: Sandbox escape due to uninitialized memory in the Graphics component (CVE-2026-109712)
  • firefox: Use-after-free in the Graphics: Canvas2D component (CVE-2026-109711)
  • firefox: Frame poisoning in the Layout component (CVE-2026-109736)
  • firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-109722)
  • firefox: Use-after-free in the DOM: Animation component (CVE-2026-109728)
  • firefox: Incorrect boundary conditions in the JavaScript Engine: JIT component (CVE-2026-109721)
  • firefox: Privilege escalation in the Panning and Zooming component (CVE-2026-109743)

Bug Fix(es) and Enhancement(s):

  • Firefox ESR 153 rebase [rhel-8.10.z] (JIRA:RHEL-175143)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to…

Record
ALSA-2026:89756
Updated
2026-11-03
OSVALSA-2026:89757 No score

Important: firefox security, bug fix, and enhancement update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

  • libexpat: denial of service via crafted XML input (CVE-2026-45186)
  • firefox: thunderbird: Privilege escalation in the Application Update component (CVE-2026-109704)
  • firefox: Use-after-free in the XML component (CVE-2026-109718)
  • firefox: Information disclosure in the PDF Viewer component (CVE-2026-109742)
  • firefox: Incorrect boundary conditions in the JavaScript Engine component (CVE-2026-109715)
  • firefox: firefox: Sandbox escape via incorrect boundary conditions in Win32 widget (CVE-2026-109740)
  • firefox: Use-after-free in the Storage: IndexedDB component (CVE-2026-109706)
  • firefox: Use-after-free in the Crash Reporting component (CVE-2026-109713)
  • firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-109724)
  • firefox: Sandbox escape due to uninitialized memory in the DOM: Web Serial component (CVE-2026-109745)
  • firefox: Mitigation bypass in the File Handling component (CVE-2026-109782)
  • firefox: Information disclosure, privilege escalation in the Security: Process Sandboxing component (CVE-2026-109709)
  • firefox: Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component (CVE-2026-109705)
  • firefox: Use-after-free in the Audio/Video: Playback component (CVE-2026-109738)
  • firefox: Sandbox escape due to race condition in the Networking component (CVE-2026-109757)
  • firefox: Use-after-free in the Storage: Bucket File System component (CVE-2026-109741)
  • firefox: Use-after-free in the JavaScript Engine: JIT component (CVE-2026-109729)
  • firefox: Other issue in the DOM: File component (CVE-2026-109744)
  • firefox: Incorrect boundary conditions in the JavaScript Engine component (CVE-2026-109716)
  • firefox: Race condition, use-after-free in the Graphics: CanvasWebGL component (CVE-2026-109719)
  • firefox: Incorrect boundary conditions in the Layout component (CVE-2026-109753)
  • firefox: Integer overflow in the Layout: Text and Fonts component (CVE-2026-109723)
  • firefox: Privilege escalation in the DOM: Navigation component (CVE-2026-109756)
  • firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-109733)
  • firefox: Mitigation bypass in the File Handling component (CVE-2026-109763)
  • firefox: Sandbox escape due to incorrect boundary conditions in the Networking component (CVE-2026-109708)
  • firefox: Use-after-free in the DOM: Bindings (WebIDL) component (CVE-2026-109717)
  • firefox: Use-after-free in the DOM: Workers component (CVE-2026-109752)
  • firefox: Sandbox escape due to use-after-free in the Networking component (CVE-2026-109707)
  • firefox: Mitigation bypass in the Networking: HTTP component (CVE-2026-109760)
  • firefox: JIT miscompilation in the JavaScript: WebAssembly component (CVE-2026-109720)
  • firefox: Use-after-free in the SVG component (CVE-2026-109726)
  • firefox: Integer overflow in the Graphics component (CVE-2026-109730)
  • firefox: Use-after-free in the Audio/Video component (CVE-2026-109727)
  • firefox: Mitigation bypass in the Enterprise Policies component (CVE-2026-109737)
  • firefox: Use-after-free in the DOM: Streams component (CVE-2026-109732)
  • firefox: Site isolation issue in the Networking component (CVE-2026-109759)
  • firefox: Incorrect boundary conditions in the SVG component (CVE-2026-109762)
  • firefox: Incorrect boundary conditions in the DOM: Editor component (CVE-2026-109754)
  • firefox: Information disclosure in the Networking component (CVE-2026-109751)
  • firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-109725)
  • firefox: Sandbox escape due to uninitialized memory in the Graphics component (CVE-2026-109712)
  • firefox: Use-after-free in the Graphics: Canvas2D component (CVE-2026-109711)
  • firefox: Frame poisoning in the Layout component (CVE-2026-109736) …
Record
ALSA-2026:89757
Updated
2026-11-02
OSVALSA-2026:89758 No score

Important: firefox security, bug fix, and enhancement update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

  • libexpat: denial of service via crafted XML input (CVE-2026-45186)
  • expat: expat: Information disclosure via heap buffer over-read in XML_ParseBuffer (CVE-2026-77214)
  • firefox: thunderbird: Privilege escalation in the Application Update component (CVE-2026-109704)
  • firefox: Use-after-free in the XML component (CVE-2026-109718)
  • firefox: Incorrect boundary conditions in the JavaScript Engine component (CVE-2026-109715)
  • firefox: firefox: Sandbox escape via incorrect boundary conditions in Win32 widget (CVE-2026-109740)
  • firefox: Use-after-free in the Storage: IndexedDB component (CVE-2026-109706)
  • firefox: Use-after-free in the Crash Reporting component (CVE-2026-109713)
  • firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-109724)
  • firefox: Information disclosure, privilege escalation in the Security: Process Sandboxing component (CVE-2026-109709)
  • firefox: Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component (CVE-2026-109705)
  • firefox: Use-after-free in the JavaScript Engine: JIT component (CVE-2026-109729)
  • firefox: Incorrect boundary conditions in the JavaScript Engine component (CVE-2026-109716)
  • firefox: Race condition, use-after-free in the Graphics: CanvasWebGL component (CVE-2026-109719)
  • firefox: Integer overflow in the Layout: Text and Fonts component (CVE-2026-109723)
  • firefox: Sandbox escape due to incorrect boundary conditions in the Networking component (CVE-2026-109708)
  • firefox: Use-after-free in the DOM: Bindings (WebIDL) component (CVE-2026-109717)
  • firefox: Sandbox escape due to use-after-free in the Networking component (CVE-2026-109707)
  • firefox: JIT miscompilation in the JavaScript: WebAssembly component (CVE-2026-109720)
  • firefox: Use-after-free in the SVG component (CVE-2026-109726)
  • firefox: Integer overflow in the Graphics component (CVE-2026-109730)
  • firefox: Use-after-free in the Audio/Video component (CVE-2026-109727)
  • firefox: Use-after-free in the DOM: Streams component (CVE-2026-109732)
  • firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-109725)
  • firefox: Sandbox escape due to uninitialized memory in the Graphics component (CVE-2026-109712)
  • firefox: Use-after-free in the Graphics: Canvas2D component (CVE-2026-109711)
  • firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-109722)
  • firefox: Use-after-free in the DOM: Animation component (CVE-2026-109728)
  • firefox: Incorrect boundary conditions in the JavaScript Engine: JIT component (CVE-2026-109721)

Bug Fix(es) and Enhancement(s):

  • Firefox ESR 153 rebase [rhel-10.2.z] (JIRA:RHEL-175166)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:89758
Updated
2026-11-04
OSVALSA-2026:90895 No score

Important: thunderbird security, bug fix, and enhancement update

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

  • libexpat: denial of service via crafted XML input (CVE-2026-45186)

Bug Fix(es) and Enhancement(s):

  • Thunderbird ESR 153 rebase [rhel-10.2.z] (JIRA:RHEL-175207)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:90895
Updated
2026-11-02
OSVALSA-2026:93443 No score

Important: thunderbird security, bug fix, and enhancement update

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

  • libexpat: denial of service via crafted XML input (CVE-2026-45186)
  • firefox: Mitigation bypass in the Enterprise Policies component (CVE-2026-109764)
  • firefox: Spoofing issue in the DOM: Web Serial component (CVE-2026-109770)
  • firefox: Mitigation bypass in the File Handling component (CVE-2026-109783)
  • firefox: thunderbird: Privilege escalation in the Application Update component (CVE-2026-109704)
  • firefox: Use-after-free in the XML component (CVE-2026-109718)
  • firefox: Information disclosure in the PDF Viewer component (CVE-2026-109742)
  • firefox: Incorrect boundary conditions in the JavaScript Engine component (CVE-2026-109715)
  • firefox: firefox: Sandbox escape via incorrect boundary conditions in Win32 widget (CVE-2026-109740)
  • firefox: Use-after-free in the Storage: IndexedDB component (CVE-2026-109706)
  • firefox: Use-after-free in the Crash Reporting component (CVE-2026-109713)
  • firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-109724)
  • firefox: Sandbox escape due to uninitialized memory in the DOM: Web Serial component (CVE-2026-109745)
  • firefox: Mitigation bypass in the File Handling component (CVE-2026-109782)
  • firefox: Information disclosure, privilege escalation in the Security: Process Sandboxing component (CVE-2026-109709)
  • firefox: Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component (CVE-2026-109705)
  • firefox: Use-after-free in the Audio/Video: Playback component (CVE-2026-109738)
  • firefox: Sandbox escape due to race condition in the Networking component (CVE-2026-109757)
  • firefox: Use-after-free in the Storage: Bucket File System component (CVE-2026-109741)
  • firefox: Use-after-free in the JavaScript Engine: JIT component (CVE-2026-109729)
  • firefox: Other issue in the DOM: File component (CVE-2026-109744)
  • firefox: Incorrect boundary conditions in the JavaScript Engine component (CVE-2026-109716)
  • firefox: Race condition, use-after-free in the Graphics: CanvasWebGL component (CVE-2026-109719)
  • firefox: Incorrect boundary conditions in the Layout component (CVE-2026-109753)
  • firefox: Integer overflow in the Layout: Text and Fonts component (CVE-2026-109723)
  • firefox: Privilege escalation in the DOM: Navigation component (CVE-2026-109756)
  • firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-109733)
  • firefox: thunderbird: Mitigation bypass in the DOM: Security component (CVE-2026-109734)
  • firefox: Mitigation bypass in the File Handling component (CVE-2026-109763)
  • firefox: Sandbox escape due to incorrect boundary conditions in the Networking component (CVE-2026-109708)
  • firefox: Use-after-free in the DOM: Bindings (WebIDL) component (CVE-2026-109717)
  • firefox: Use-after-free in the DOM: Workers component (CVE-2026-109752)
  • firefox: Race condition in the XPCOM component (CVE-2026-109776)
  • firefox: Sandbox escape due to use-after-free in the Networking component (CVE-2026-109707)
  • firefox: Mitigation bypass in the Networking: HTTP component (CVE-2026-109760)
  • firefox: JIT miscompilation in the JavaScript: WebAssembly component (CVE-2026-109720)
  • firefox: Information disclosure in the Storage: IndexedDB component (CVE-2026-109777)
  • firefox: Use-after-free in the SVG component (CVE-2026-109726)
  • firefox: Integer overflow in the Graphics component (CVE-2026-109730)
  • firefox: Use-after-free in the Audio/Video component (CVE-2026-109727)
  • firefox: Mitigation bypass in the Enterprise Policies component (CVE-2026-109737)
  • firefox: Mitigation bypass in the Enterprise Policies component (CVE-2026-109766)
  • firefox: Use-after-free in the DOM: Streams component (CVE-2026-109732)
  • firefox: Site isolation issue in the Networking component (CVE-2026-109759)
  • firefox: Privilege escalation in the WebExtensions…
Record
ALSA-2026:93443
Updated
2026-11-02
OSVAZL-86340 No score

CVE-2026-45186 affecting package expat for versions less than 2.8.2-1

In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input.

Record
AZL-86340
Updated
2026-11-02
OSVCLSA-2026-1779122132 No score

expat: Fix of CVE-2026-45186

  • CVE-2026-45186: fix quadratic runtime behavior in attribute collision detection
Record
CLSA-2026-1779122132
Updated
2026-11-02
OSVCLSA-2026-1779129222 No score

Fix CVE(s): CVE-2026-45186

  • SECURITY UPDATE: fix quadratic complexity in attribute name collision check
    • debian/patches/CVE-2026-45186.patch: fix quadratic complexity in attribute name collision check
    • CVE-2026-45186
Record
CLSA-2026-1779129222
Updated
2026-11-02
OSVCLSA-2026-1779129362 No score

Fix CVE(s): CVE-2026-45186

  • SECURITY UPDATE: fix quadratic complexity in attribute name collision check
    • debian/patches/CVE-2026-45186.patch: fix quadratic complexity in attribute name collision check
    • CVE-2026-45186
Record
CLSA-2026-1779129362
Updated
2026-11-02
OSVCLSA-2026-1779130424 No score

expat: Fix of CVE-2026-45186

  • CVE-2026-45186: fix quadratic complexity in attribute name collision check
Record
CLSA-2026-1779130424
Updated
2026-11-02
OSVCLSA-2026-1779183482 No score

Fix CVE(s): CVE-2026-45186

  • SECURITY UPDATE: denial of service via O(n^2) attribute name collision check with moderately sized crafted XML input
    • debian/patches/CVE-2026-45186.patch: replace linear scan in defineAttribute() with O(1) hash table lookup using new ELEMENT_TYPE.defaultAttsNames field in expat/lib/xmlparse.c
    • CVE-2026-45186
Record
CLSA-2026-1779183482
Updated
2026-11-02
OSVCLSA-2026-1779183767 No score

expat: Fix of CVE-2026-45186

  • CVE-2026-45186: fix quadratic complexity in attribute name collision check
Record
CLSA-2026-1779183767
Updated
2026-11-02
OSVCLSA-2026-1779183996 No score

expat: Fix of CVE-2026-45186

  • CVE-2026-45186: fix quadratic complexity in attribute name collision check
Record
CLSA-2026-1779183996
Updated
2026-11-02
OSVCLSA-2026-1779184141 No score

expat: Fix of CVE-2026-45186

  • CVE-2026-45186: fix quadratic complexity in attribute name collision check
Record
CLSA-2026-1779184141
Updated
2026-11-02
OSVCLSA-2026-1779358911 No score

expat: Fix of CVE-2026-45186

  • CVE-2026-45186: fix quadratic runtime in attribute collision detection by using a hash table for default attribute names instead of an O(n^2) loop
Record
CLSA-2026-1779358911
Updated
2026-11-02
OSVCLSA-2026-1779358954 No score

expat: Fix of CVE-2026-45186

  • CVE-2026-45186: fix quadratic runtime in attribute collision detection by using a hash table for default attribute names instead of an O(n^2) loop
Record
CLSA-2026-1779358954
Updated
2026-11-02
OSVCLSA-2026-1779359157 No score

Fix CVE(s): CVE-2026-45186

  • SECURITY UPDATE: Denial of service via quadratic attribute-name collision check in libexpat before 2.8.1
    • debian/patches/CVE-2026-45186.patch: introduce per-element defaultAttsNames hash table and use it for O(1) attribute collision detection in defineAttribute
    • CVE-2026-45186
Record
CLSA-2026-1779359157
Updated
2026-11-02
OSVCLSA-2026-1779359397 No score

expat: Fix of CVE-2026-45186

  • CVE-2026-45186: fix quadratic runtime in attribute collision detection by using a hash table for default attribute names instead of an O(n^2) loop
Record
CLSA-2026-1779359397
Updated
2026-11-02
OSVCLSA-2026-1779359429 No score

expat: Fix of CVE-2026-45186

  • CVE-2026-45186: fix quadratic runtime in attribute collision detection by using a hash table for default attribute names instead of an O(n^2) loop
Record
CLSA-2026-1779359429
Updated
2026-11-02
OSVCLSA-2026-1779361284 No score

expat: Fix of CVE-2026-45186

  • CVE-2026-45186: fix quadratic runtime in attribute collision detection by using a hash table for default attribute names instead of an O(n^2) loop
Record
CLSA-2026-1779361284
Updated
2026-11-02
OSVMGASA-2026-0204 No score

Updated expat packages fix security vulnerabilities

CVE-2026-45186 the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input.

Record
MGASA-2026-0204
Updated
2026-11-02

Affected products

Show 1 moreShow less

Affected packages

Affected packages
PackageAffectedFixed
expat
Alpine:v3.20
 before 2.8.1-r0
2.8.1-r0
expat
Alpine:v3.21
 before 2.8.1-r0
2.8.1-r0
expat
Alpine:v3.22
 before 2.8.1-r0
2.8.1-r0
expat
Alpine:v3.23
 before 2.8.1-r0
2.8.1-r0
expat
Alpine:v3.24
 before 2.8.1-r0
2.8.1-r0
expat
AlmaLinux:10
 before 2.7.3-1.el10_2.1
2.7.3-1.el10_2.1
expat-devel
AlmaLinux:10
 before 2.7.3-1.el10_2.1
2.7.3-1.el10_2.1
expat
AlmaLinux:8
 before 2.5.0-2.el8_10
2.5.0-2.el8_10
expat-devel
AlmaLinux:8
 before 2.5.0-2.el8_10
2.5.0-2.el8_10
expat
AlmaLinux:9
 before 2.5.0-6.el9_8.1
2.5.0-6.el9_8.1
Show 229 moreShow less
Affected packages
PackageAffectedFixed
expat-devel
AlmaLinux:9
 before 2.5.0-6.el9_8.1
2.5.0-6.el9_8.1
firefox
AlmaLinux:8
From an advisory covering 41 CVEs
 before 153.5.0-1.el8_10
153.5.0-1.el8_10
firefox
AlmaLinux:9
From an advisory covering 48 CVEs
 before 153.5.0-1.el9_8
153.5.0-1.el9_8
firefox-x11
AlmaLinux:9
From an advisory covering 48 CVEs
 before 153.5.0-1.el9_8
153.5.0-1.el9_8
firefox
AlmaLinux:10
From an advisory covering 29 CVEs
 before 153.5.0-1.el10_2
153.5.0-1.el10_2
thunderbird
AlmaLinux:10
 before 153.5.0-1.el10_2.alma.1
153.5.0-1.el10_2.alma.1
thunderbird
AlmaLinux:9
From an advisory covering 62 CVEs
 before 153.5.0-1.el9_8.alma.1
153.5.0-1.el9_8.alma.1
expat
Azure Linux:3
 before 2.8.2-1
2.8.2-1
expat
Alpaquita:23
 2.5.0-r0 up to 2.7.5-r1
2.7.5-r1
expat
Alpaquita:25
 2.7.1-r0 up to 2.7.5-r1
2.7.5-r1
expat
Alpaquita:stream
 2.4.9-r0 up to 2.8.1-r0
2.8.1-r0
expat
BellSoft Hardened Containers:23
 2.5.0-r0 up to 2.7.5-r1
2.7.5-r1
expat
BellSoft Hardened Containers:25
 2.7.1-r0 up to 2.7.5-r1
2.7.5-r1
expat
BellSoft Hardened Containers:stream
 2.4.9-r0 up to 2.8.1-r0
2.8.1-r0
expat
TuxCare:AlmaLinux:9.2
 before 2.5.0-1.el9.tuxcare.els11
2.5.0-1.el9.tuxcare.els11
expat-devel
TuxCare:AlmaLinux:9.2
 before 2.5.0-1.el9.tuxcare.els11
2.5.0-1.el9.tuxcare.els11
expat-static
TuxCare:AlmaLinux:9.2
 before 2.5.0-1.el9.tuxcare.els11
2.5.0-1.el9.tuxcare.els11
expat
TuxCare:Ubuntu:16.04
 before 2.1.0-7ubuntu0.16.04.5+tuxcare.els9
2.1.0-7ubuntu0.16.04.5+tuxcare.els9
libexpat1
TuxCare:Ubuntu:16.04
 before 2.1.0-7ubuntu0.16.04.5+tuxcare.els9
2.1.0-7ubuntu0.16.04.5+tuxcare.els9
libexpat1-dev
TuxCare:Ubuntu:16.04
 before 2.1.0-7ubuntu0.16.04.5+tuxcare.els9
2.1.0-7ubuntu0.16.04.5+tuxcare.els9
expat
TuxCare:Ubuntu:18.04
 before 2.2.5-3ubuntu0.9+tuxcare.els6
2.2.5-3ubuntu0.9+tuxcare.els6
libexpat1
TuxCare:Ubuntu:18.04
 before 2.2.5-3ubuntu0.9+tuxcare.els6
2.2.5-3ubuntu0.9+tuxcare.els6
libexpat1-dev
TuxCare:Ubuntu:18.04
 before 2.2.5-3ubuntu0.9+tuxcare.els6
2.2.5-3ubuntu0.9+tuxcare.els6
expat
TuxCare:AlmaLinux:9.6
 before 2.5.0-5.el9_6.tuxcare.els7
2.5.0-5.el9_6.tuxcare.els7
expat-devel
TuxCare:AlmaLinux:9.6
 before 2.5.0-5.el9_6.tuxcare.els7
2.5.0-5.el9_6.tuxcare.els7
expat-static
TuxCare:AlmaLinux:9.6
 before 2.5.0-5.el9_6.tuxcare.els7
2.5.0-5.el9_6.tuxcare.els7
expat
TuxCare:Ubuntu:20.04
 before 2.2.9-1ubuntu0.8+tuxcare.els4
2.2.9-1ubuntu0.8+tuxcare.els4
libexpat1
TuxCare:Ubuntu:20.04
 before 2.2.9-1ubuntu0.8+tuxcare.els4
2.2.9-1ubuntu0.8+tuxcare.els4
libexpat1-dev
TuxCare:Ubuntu:20.04
 before 2.2.9-1ubuntu0.8+tuxcare.els4
2.2.9-1ubuntu0.8+tuxcare.els4
expat
TuxCare:CentOS:8.4
 before 2.5.0-1.el8.tuxcare.els4
2.5.0-1.el8.tuxcare.els4
expat-devel
TuxCare:CentOS:8.4
 before 2.5.0-1.el8.tuxcare.els4
2.5.0-1.el8.tuxcare.els4
expat-static
TuxCare:CentOS:8.4
 before 2.5.0-1.el8.tuxcare.els4
2.5.0-1.el8.tuxcare.els4
expat
TuxCare:CentOS-Stream:8
 before 2.5.0-1.el8.tuxcare.els4
2.5.0-1.el8.tuxcare.els4
expat-devel
TuxCare:CentOS-Stream:8
 before 2.5.0-1.el8.tuxcare.els4
2.5.0-1.el8.tuxcare.els4
expat-static
TuxCare:CentOS-Stream:8
 before 2.5.0-1.el8.tuxcare.els4
2.5.0-1.el8.tuxcare.els4
expat
TuxCare:CentOS:8.5
 before 2.5.0-1.el8.tuxcare.els4
2.5.0-1.el8.tuxcare.els4
expat-devel
TuxCare:CentOS:8.5
 before 2.5.0-1.el8.tuxcare.els4
2.5.0-1.el8.tuxcare.els4
expat-static
TuxCare:CentOS:8.5
 before 2.5.0-1.el8.tuxcare.els4
2.5.0-1.el8.tuxcare.els4
expat
TuxCare:OracleLinux:7
 before 2.1.0-15.0.7.el7_9.tuxcare.els2
2.1.0-15.0.7.el7_9.tuxcare.els2
expat-devel
TuxCare:OracleLinux:7
 before 2.1.0-15.0.7.el7_9.tuxcare.els2
2.1.0-15.0.7.el7_9.tuxcare.els2
expat-static
TuxCare:OracleLinux:7
 before 2.1.0-15.0.7.el7_9.tuxcare.els2
2.1.0-15.0.7.el7_9.tuxcare.els2
expat
TuxCare:RHEL:7
 before 2.1.0-15.0.7.el7_9.tuxcare.els2
2.1.0-15.0.7.el7_9.tuxcare.els2
expat-devel
TuxCare:RHEL:7
 before 2.1.0-15.0.7.el7_9.tuxcare.els2
2.1.0-15.0.7.el7_9.tuxcare.els2
expat-static
TuxCare:RHEL:7
 before 2.1.0-15.0.7.el7_9.tuxcare.els2
2.1.0-15.0.7.el7_9.tuxcare.els2
expat
TuxCare:Debian:10
 before 2.2.6-2+deb10u7+tuxcare.els5
2.2.6-2+deb10u7+tuxcare.els5
libexpat1
TuxCare:Debian:10
 before 2.2.6-2+deb10u7+tuxcare.els5
2.2.6-2+deb10u7+tuxcare.els5
libexpat1-dev
TuxCare:Debian:10
 before 2.2.6-2+deb10u7+tuxcare.els5
2.2.6-2+deb10u7+tuxcare.els5
expat
TuxCare:CentOS:7
 before 2.1.0-15.0.7.el7_9.tuxcare.els2
2.1.0-15.0.7.el7_9.tuxcare.els2
expat-devel
TuxCare:CentOS:7
 before 2.1.0-15.0.7.el7_9.tuxcare.els2
2.1.0-15.0.7.el7_9.tuxcare.els2
expat-static
TuxCare:CentOS:7
 before 2.1.0-15.0.7.el7_9.tuxcare.els2
2.1.0-15.0.7.el7_9.tuxcare.els2
expat
TuxCare:OracleLinux:6
 before 2.0.1-13.el6_8.tuxcare.els9
2.0.1-13.el6_8.tuxcare.els9
expat-devel
TuxCare:OracleLinux:6
 before 2.0.1-13.el6_8.tuxcare.els9
2.0.1-13.el6_8.tuxcare.els9
expat
TuxCare:CentOS:6
 before 2.0.1-13.el6_8.tuxcare.els9
2.0.1-13.el6_8.tuxcare.els9
expat-devel
TuxCare:CentOS:6
 before 2.0.1-13.el6_8.tuxcare.els9
2.0.1-13.el6_8.tuxcare.els9
expat
Debian:12
 before 2.5.0-1+deb12u4, plus listed versions
2.5.0-12.5.0-1+deb12u12.5.0-1+deb12u22.5.0-1+deb12u3
2.5.0-1+deb12u4
expat
Debian:13
 before 2.8.2-1~deb13u1, plus listed versions
2.7.1-22.7.2-12.7.3-12.7.3-22.7.4-1
Show 4 moreShow less
2.7.5-12.8.0-12.8.0-22.8.1-1
2.8.2-1~deb13u1
expat
Debian:14
 before 2.8.0-2, plus listed versions
2.7.1-22.7.2-12.7.3-12.7.3-22.7.4-12.7.5-12.8.0-1
2.8.0-2
Expat_jll
Julia
 before 2.8.1+0
2.8.1+0
expat
Mageia:9
 before 2.7.5-1.1.mga9
2.7.5-1.1.mga9
expat
openEuler:24.03-LTS
 before 2.5.0-19.oe2403
2.5.0-19.oe2403
expat
openEuler:24.03-LTS-SP3
 before 2.5.0-19.oe2403sp3
2.5.0-19.oe2403sp3
expat
openEuler:20.03-LTS-SP4
 before 2.2.9-24.oe2003sp4
2.2.9-24.oe2003sp4
expat
openEuler:22.03-LTS-SP4
 before 2.4.1-23.oe2203sp4
2.4.1-23.oe2203sp4
expat
openEuler:24.03-LTS-SP1
 before 2.5.0-19.oe2403sp1
2.5.0-19.oe2403sp1
expat-debuginfo
Red Hat:enterprise_linux:10.2
 before 0:2.7.3-1.el10_2.1
0:2.7.3-1.el10_2.1
expat-debugsource
Red Hat:enterprise_linux:10.2
 before 0:2.7.3-1.el10_2.1
0:2.7.3-1.el10_2.1
expat-devel
Red Hat:enterprise_linux:10.2
 before 0:2.7.3-1.el10_2.1
0:2.7.3-1.el10_2.1
expat
Red Hat:enterprise_linux:10.2
 before 0:2.7.3-1.el10_2.1
0:2.7.3-1.el10_2.1
expat
Red Hat:enterprise_linux:8::baseos
 before 0:2.5.0-2.el8_10
0:2.5.0-2.el8_10
expat-debuginfo
Red Hat:enterprise_linux:8::baseos
 before 0:2.5.0-2.el8_10
0:2.5.0-2.el8_10
expat-debugsource
Red Hat:enterprise_linux:8::baseos
 before 0:2.5.0-2.el8_10
0:2.5.0-2.el8_10
expat-devel
Red Hat:enterprise_linux:8::baseos
 before 0:2.5.0-2.el8_10
0:2.5.0-2.el8_10
expat-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:2.5.0-6.el9_8.1
0:2.5.0-6.el9_8.1
expat-debugsource
Red Hat:enterprise_linux:9::appstream
 before 0:2.5.0-6.el9_8.1
0:2.5.0-6.el9_8.1
expat-devel
Red Hat:enterprise_linux:9::appstream
 before 0:2.5.0-6.el9_8.1
0:2.5.0-6.el9_8.1
expat
Red Hat:enterprise_linux:9::baseos
 before 0:2.5.0-6.el9_8.1
0:2.5.0-6.el9_8.1
expat-debuginfo
Red Hat:enterprise_linux:9::baseos
 before 0:2.5.0-6.el9_8.1
0:2.5.0-6.el9_8.1
expat-debugsource
Red Hat:enterprise_linux:9::baseos
 before 0:2.5.0-6.el9_8.1
0:2.5.0-6.el9_8.1
expat
Red Hat:hummingbird:1
 before 0:2.8.5-1.1.hum1
0:2.8.5-1.1.hum1
expat-devel
Red Hat:hummingbird:1
 before 0:2.8.5-1.1.hum1
0:2.8.5-1.1.hum1
expat-static
Red Hat:hummingbird:1
 before 0:2.8.5-1.1.hum1
0:2.8.5-1.1.hum1
expat
Rocky Linux:10
 before 0:2.7.3-1.el10_2.1
0:2.7.3-1.el10_2.1
expat
Rocky Linux:8
 before 0:2.5.0-2.el8_10
0:2.5.0-2.el8_10
expat
Rocky Linux:9
 before 0:2.5.0-6.el9_8.1
0:2.5.0-6.el9_8.1
firefox
Rocky Linux:8
From an advisory covering 41 CVEs
 before 0:153.5.0-1.el8_10
0:153.5.0-1.el8_10
firefox
Rocky Linux:9
From an advisory covering 48 CVEs
 before 0:153.5.0-1.el9_8
0:153.5.0-1.el9_8
firefox
Rocky Linux:10
From an advisory covering 29 CVEs
 before 0:153.5.0-1.el10_2
0:153.5.0-1.el10_2
thunderbird
Rocky Linux:10
 before 0:153.5.0-1.el10_2
0:153.5.0-1.el10_2
thunderbird
Rocky Linux:9
From an advisory covering 62 CVEs
 before 0:153.5.0-1.el9_8
0:153.5.0-1.el9_8
expat
Root:Debian:11
 before 2.2.10-2+deb11u7.root.io.14
2.2.10-2+deb11u7.root.io.142.2.10-2+deb11u7.aikido.172.2.10-2+deb11u7.root.io.152.2.10-2+deb11u7.aikido.192.2.10-2+deb11u7.aikido.182.2.10-2+deb11u7.aikido.202.2.10-2+deb11u7.root.io.162.2.10-2+deb11u7.root.io.13
rootio-expat
Root:Debian:11
 before 2.2.10-2+deb11u7.root.io.14
2.2.10-2+deb11u7.root.io.142.2.10-2+deb11u7.aikido.172.2.10-2+deb11u7.root.io.152.2.10-2+deb11u7.aikido.192.2.10-2+deb11u7.aikido.182.2.10-2+deb11u7.aikido.202.2.10-2+deb11u7.root.io.162.2.10-2+deb11u7.root.io.13
python311
SUSE:Linux Micro 6.1
From an advisory covering 24 CVEs
 before 3.11.16-slfo.1.1_1.1
3.11.16-slfo.1.1_1.1
python311-core
SUSE:Linux Micro 6.1
From an advisory covering 24 CVEs
 before 3.11.16-slfo.1.1_1.1
3.11.16-slfo.1.1_1.1
expat
SUSE:Linux Micro 6.2
From an advisory covering 20 CVEs
 before 2.8.4-160000.1.1
2.8.4-160000.1.1
expat
SUSE:Linux Enterprise Server 16.0
From an advisory covering 20 CVEs
 before 2.8.4-160000.1.1
2.8.4-160000.1.1
expat
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 20 CVEs
 before 2.8.4-160000.1.1
2.8.4-160000.1.1
MozillaFirefox
SUSE:Linux Enterprise Server 16.0
From an advisory covering 85 CVEs
 before 153.5.0-160000.1.1
153.5.0-160000.1.1
MozillaFirefox
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 85 CVEs
 before 153.5.0-160000.1.1
153.5.0-160000.1.1
expat
SUSE:Linux Micro 6.0
From an advisory covering 34 CVEs
 before 2.8.5-159998.1.1
2.8.5-159998.1.1
expat
SUSE:Linux Micro 6.1
From an advisory covering 29 CVEs
 before 2.8.5-slfo.1.1_1.1
2.8.5-slfo.1.1_1.1
python313
SUSE:Linux Enterprise Module for Python 3 15 SP7
From an advisory covering 13 CVEs
 before 3.13.14-150700.4.53.1
3.13.14-150700.4.53.1
python313-core
SUSE:Linux Enterprise Module for Python 3 15 SP7
From an advisory covering 13 CVEs
 before 3.13.14-150700.4.53.1
3.13.14-150700.4.53.1
python312
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 26 CVEs
 before 3.12.14-150600.3.68.1
3.12.14-150600.3.68.1
python312-core
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 26 CVEs
 before 3.12.14-150600.3.68.1
3.12.14-150600.3.68.1
python312
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 26 CVEs
 before 3.12.14-150600.3.68.1
3.12.14-150600.3.68.1
python312-core
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 26 CVEs
 before 3.12.14-150600.3.68.1
3.12.14-150600.3.68.1
expat
SUSE:Linux Enterprise Server 12 SP5-LTSS
From an advisory covering 34 CVEs
 before 2.8.5-21.55.1
2.8.5-21.55.1
expat
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
From an advisory covering 34 CVEs
 before 2.8.5-21.55.1
2.8.5-21.55.1
expat
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 29 CVEs
 before 2.8.5-150700.3.15.1
2.8.5-150700.3.15.1
expat
SUSE:Linux Enterprise Micro 5.3
From an advisory covering 34 CVEs
 before 2.8.5-150400.3.40.1
2.8.5-150400.3.40.1
expat
SUSE:Linux Enterprise Micro 5.4
From an advisory covering 34 CVEs
 before 2.8.5-150400.3.40.1
2.8.5-150400.3.40.1
expat
SUSE:Linux Enterprise Micro 5.5
From an advisory covering 34 CVEs
 before 2.8.5-150400.3.40.1
2.8.5-150400.3.40.1
expat
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 34 CVEs
 before 2.8.5-150400.3.40.1
2.8.5-150400.3.40.1
expat
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 34 CVEs
 before 2.8.5-150400.3.40.1
2.8.5-150400.3.40.1
expat
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 34 CVEs
 before 2.8.5-150400.3.40.1
2.8.5-150400.3.40.1
expat
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 34 CVEs
 before 2.8.5-150400.3.40.1
2.8.5-150400.3.40.1
expat
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 34 CVEs
 before 2.8.5-150400.3.40.1
2.8.5-150400.3.40.1
expat
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 34 CVEs
 before 2.8.5-150400.3.40.1
2.8.5-150400.3.40.1
expat
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 34 CVEs
 before 2.8.5-150400.3.40.1
2.8.5-150400.3.40.1
expat
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 34 CVEs
 before 2.8.5-150400.3.40.1
2.8.5-150400.3.40.1
expat
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 34 CVEs
 before 2.8.5-150400.3.40.1
2.8.5-150400.3.40.1
expat
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 34 CVEs
 before 2.8.5-150400.3.40.1
2.8.5-150400.3.40.1
MozillaThunderbird
SUSE:Linux Enterprise Module for Package Hub 15 SP7
From an advisory covering 86 CVEs
 before 153.5.0-150400.13.9.1
153.5.0-150400.13.9.1
MozillaThunderbird
SUSE:Linux Enterprise Workstation Extension 15 SP7
From an advisory covering 86 CVEs
 before 153.5.0-150400.13.9.1
153.5.0-150400.13.9.1
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP5-LTSS
From an advisory covering 85 CVEs
 before 153.5.0-118.16.2
153.5.0-118.16.2
MozillaFirefox
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
From an advisory covering 85 CVEs
 before 153.5.0-118.16.2
153.5.0-118.16.2
MozillaFirefox
SUSE:Linux Enterprise Module for Desktop Applications 15 SP7
From an advisory covering 85 CVEs
 before 153.5.0-150400.157.16.1
153.5.0-150400.157.16.1
MozillaFirefox
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 85 CVEs
 before 153.5.0-150400.157.16.1
153.5.0-150400.157.16.1
MozillaFirefox
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 85 CVEs
 before 153.5.0-150400.157.16.1
153.5.0-150400.157.16.1
MozillaFirefox
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 85 CVEs
 before 153.5.0-150400.157.16.1
153.5.0-150400.157.16.1
MozillaFirefox
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 85 CVEs
 before 153.5.0-150400.157.16.1
153.5.0-150400.157.16.1
MozillaFirefox
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 85 CVEs
 before 153.5.0-150400.157.16.1
153.5.0-150400.157.16.1
MozillaFirefox
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 85 CVEs
 before 153.5.0-150400.157.16.1
153.5.0-150400.157.16.1
MozillaFirefox
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 85 CVEs
 before 153.5.0-150400.157.16.1
153.5.0-150400.157.16.1
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 85 CVEs
 before 153.5.0-150400.157.16.1
153.5.0-150400.157.16.1
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 85 CVEs
 before 153.5.0-150400.157.16.1
153.5.0-150400.157.16.1
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 85 CVEs
 before 153.5.0-150400.157.16.1
153.5.0-150400.157.16.1
coin3
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
3.1.4~abc9f50-33.1.4~abc9f50-43.1.4~abc9f50-4ubuntu23.1.4~abc9f50-4ubuntu2+esm13.1.4~abc9f50-4ubuntu2+esm2
 None known
expat
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
2.1.0-42.1.0-4ubuntu12.1.0-4ubuntu1.12.1.0-4ubuntu1.22.1.0-4ubuntu1.3
Show 12 moreShow less
2.1.0-4ubuntu1.42.1.0-4ubuntu1.4+esm12.1.0-4ubuntu1.4+esm22.1.0-4ubuntu1.4+esm42.1.0-4ubuntu1.4+esm62.1.0-4ubuntu1.4+esm72.1.0-4ubuntu1.4+esm82.1.0-4ubuntu1.4+esm92.1.0-4ubuntu1.4+esm102.1.0-4ubuntu1.4+esm112.1.0-4ubuntu1.4+esm122.1.0-4ubuntu1.4+esm13
 None known
vnc4
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
4.1.1+xorg4.3.0-37ubuntu54.1.1+xorg4.3.0-37ubuntu5.0.14.1.1+xorg4.3.0-37ubuntu5.0.24.1.1+xorg4.3.0-37ubuntu5.0.2+esm1
 None known
vtk
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
5.8.0-14ubuntu15.8.0-14ubuntu35.8.0-14.1ubuntu25.8.0-14.1ubuntu35.8.0-14.1ubuntu3+esm1
 None known
xmlrpc-c
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
1.16.33-3.2ubuntu31.33.06-0ubuntu11.33.06-0ubuntu1+esm1
 None known
expat
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
2.1.0-72.1.0-7ubuntu0.16.04.12.1.0-7ubuntu0.16.04.22.1.0-7ubuntu0.16.04.32.1.0-7ubuntu0.16.04.4
Show 12 moreShow less
2.1.0-7ubuntu0.16.04.52.1.0-7ubuntu0.16.04.5+esm22.1.0-7ubuntu0.16.04.5+esm52.1.0-7ubuntu0.16.04.5+esm62.1.0-7ubuntu0.16.04.5+esm72.1.0-7ubuntu0.16.04.5+esm82.1.0-7ubuntu0.16.04.5+esm92.1.0-7ubuntu0.16.04.5+esm102.1.0-7ubuntu0.16.04.5+esm112.1.0-7ubuntu0.16.04.5+esm122.1.0-7ubuntu0.16.04.5+esm132.1.0-7ubuntu0.16.04.5+esm14
 None known
ayttm
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
0.6.3-3build10.6.3-3ubuntu0.1~esm1
 None known
cableswig
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
0.1.0+git20150808-10.1.0+git20150808-20.1.0+git20150808-2ubuntu0.1~esm1
 None known
cadaver
Ubuntu:16.04:LTS
 All versions, plus listed versions
0.23.3-2ubuntu2
 None known
coin3
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
3.1.4~abc9f50+dfsg1-13.1.4~abc9f50+dfsg1-1ubuntu0.1~esm13.1.4~abc9f50+dfsg1-1ubuntu0.1~esm2
 None known
gdcm
Ubuntu:16.04:LTS
 All versions, plus listed versions
2.4.4-42.4.4-4build12.4.4-4ubuntu12.6.1-32.6.2-1
Show 7 moreShow less
2.6.2-22.6.2-32.6.3-12.6.3-1ubuntu12.6.3-2ubuntu12.6.3-3ubuntu12.6.3-3ubuntu3
 None known
insighttoolkit4
Ubuntu:16.04:LTS
 All versions, plus listed versions
4.8.1-1ubuntu34.8.1-1ubuntu44.8.2-3.1ubuntu14.9.0-3ubuntu24.9.0-4ubuntu14.9.0-4ubuntu1.1
 None known
libxmltok
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1.2-3build31.2-3ubuntu0.1~esm11.2-3ubuntu0.16.04.1~esm11.2-3ubuntu0.16.04.1~esm21.2-3ubuntu0.16.04.1~esm31.2-3ubuntu0.16.04.1~esm41.2-3ubuntu0.16.04.1~esm5
 None known
matanza
Ubuntu:16.04:LTS
 All versions, plus listed versions
0.13+ds1-5
 None known
smart
Ubuntu:16.04:LTS
 All versions, plus listed versions
1.4-2
 None known
swish-e
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
2.4.7-42.4.7-4build12.4.7-4ubuntu0.1~esm1
 None known
tdom
Ubuntu:16.04:LTS
 All versions, plus listed versions
0.8.3-1
 None known
vnc4
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
4.1.1+xorg4.3.0-37.3ubuntu24.1.1+xorg4.3.0-37.3ubuntu2.1+esm1
 None known
vtk
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
5.10.1+dfsg-25.10.1+dfsg-2build35.10.1+dfsg-2.1build15.10.1+dfsg-2.1ubuntu0.1~esm1
 None known
wbxml2
Ubuntu:16.04:LTS
 All versions, plus listed versions
0.10.7-1
 None known
xmlrpc-c
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1.33.14-0.2ubuntu31.33.14-1ubuntu11.33.14-1ubuntu1+esm1
 None known
expat
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
2.2.3-12.2.3-22.2.5-0ubuntu22.2.5-32.2.5-3ubuntu0.1
Show 10 moreShow less
2.2.5-3ubuntu0.22.2.5-3ubuntu0.42.2.5-3ubuntu0.72.2.5-3ubuntu0.82.2.5-3ubuntu0.92.2.5-3ubuntu0.9+esm12.2.5-3ubuntu0.9+esm22.2.5-3ubuntu0.9+esm32.2.5-3ubuntu0.9+esm42.2.5-3ubuntu0.9+esm5
 None known
cadaver
Ubuntu:18.04:LTS
 All versions, plus listed versions
0.23.3-2ubuntu3
 None known
coin3
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
3.1.4~abc9f50+dfsg1-23.1.4~abc9f50+dfsg2-13.1.4~abc9f50+dfsg3-13.1.4~abc9f50+dfsg3-23.1.4~abc9f50+dfsg3-2ubuntu0.1~esm1
 None known
gdcm
Ubuntu:18.04:LTS
 All versions, plus listed versions
2.8.2-3build12.8.3-12.8.4-12.8.4-1build2
 None known
insighttoolkit4
Ubuntu:18.04:LTS
 All versions, plus listed versions
4.12.2-dfsg1-1ubuntu1
 None known
libxmltok
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
1.2-41.2-4ubuntu0.18.04.1~esm11.2-4ubuntu0.18.04.1~esm21.2-4ubuntu0.18.04.1~esm31.2-4ubuntu0.18.04.1~esm41.2-4ubuntu0.18.04.1~esm51.2-4ubuntu0.18.04.1~esm61.2-4ubuntu0.18.04.1~esm7
 None known
matanza
Ubuntu:18.04:LTS
 All versions, plus listed versions
0.13+ds1-5build10.13+ds1-6
 None known
smart
Ubuntu:18.04:LTS
 All versions, plus listed versions
1.4-2
 None known
swish-e
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
2.4.7-5ubuntu12.4.7-5ubuntu1+esm1
 None known
tdom
Ubuntu:18.04:LTS
 All versions, plus listed versions
0.8.3-10.9.0-1
 None known
vnc4
Ubuntu:18.04:LTS
 All versions, plus listed versions
4.1.1+xorg4.3.0-37.3ubuntu2
 None known
wbxml2
Ubuntu:18.04:LTS
 All versions, plus listed versions
0.10.7-10.10.7-1build1
 None known
xmlrpc-c
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
1.33.14-71.33.14-81.33.14-8build11.33.14-8ubuntu0.18.04.1~esm1
 None known
expat
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
2.2.7-22.2.9-12.2.9-1build12.2.9-1ubuntu0.22.2.9-1ubuntu0.4
Show 7 moreShow less
2.2.9-1ubuntu0.52.2.9-1ubuntu0.62.2.9-1ubuntu0.72.2.9-1ubuntu0.82.2.9-1ubuntu0.8+esm12.2.9-1ubuntu0.8+esm22.2.9-1ubuntu0.8+esm3
 None known
cadaver
Ubuntu:20.04:LTS
 All versions, plus listed versions
0.23.3-2.1build1
 None known
insighttoolkit4
Ubuntu:20.04:LTS
 All versions, plus listed versions
4.12.2-dfsg1-4.1ubuntu14.13.2-dfsg1-1ubuntu14.13.2-dfsg1-4ubuntu14.13.2-dfsg1-64.13.2-dfsg1-6ubuntu14.13.2-dfsg1-8
 None known
libxmltok
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
1.2-41.2-4ubuntu0.20.04.1~esm11.2-4ubuntu0.20.04.1~esm21.2-4ubuntu0.20.04.1~esm31.2-4ubuntu0.20.04.1~esm41.2-4ubuntu0.20.04.1~esm51.2-4ubuntu0.20.04.1~esm61.2-4ubuntu0.20.04.1~esm7
 None known
matanza
Ubuntu:20.04:LTS
 All versions, plus listed versions
0.13+ds1-60.13+ds2-1
 None known
swish-e
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
2.4.7-6build12.4.7-6build22.4.7-6ubuntu0.1~esm1
 None known
tdom
Ubuntu:20.04:LTS
 All versions, plus listed versions
0.9.1-1
 None known
wbxml2
Ubuntu:20.04:LTS
 All versions, plus listed versions
0.10.7-1build1
 None known
xmlrpc-c
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
1.33.14-8build11.33.14-8build21.33.14-8ubuntu0.20.04.1~esm1
 None known
cadaver
Ubuntu:22.04:LTS
 All versions, plus listed versions
0.23.3-2.1build1
 None known
expat
Ubuntu:22.04:LTS
 All versions, plus listed versions
2.4.1-22.4.1-32.4.2-12.4.3-12.4.3-2
Show 12 moreShow less
2.4.4-12.4.6-12.4.7-12.4.7-1ubuntu0.12.4.7-1ubuntu0.22.4.7-1ubuntu0.32.4.7-1ubuntu0.42.4.7-1ubuntu0.52.4.7-1ubuntu0.62.4.7-1ubuntu0.72.4.7-1ubuntu0.82.4.7-1ubuntu0.9
 None known
insighttoolkit4
Ubuntu:22.04:LTS
 All versions, plus listed versions
4.13.3withdata-dfsg1-4.14.13.3withdata-dfsg2-1ubuntu1
 None known
libxmltok
Ubuntu:22.04:LTS
 All versions, plus listed versions
1.2-4
 None known
matanza
Ubuntu:22.04:LTS
 All versions, plus listed versions
0.13+ds2-1
 None known
tdom
Ubuntu:22.04:LTS
 All versions, plus listed versions
0.9.2-1
 None known
wbxml2
Ubuntu:22.04:LTS
 All versions, plus listed versions
0.10.7-1build10.11.7+dfsg-1
 None known
swish-e
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
2.4.7-6build32.4.7-6.12.4.7-6.1build12.4.7-6.1ubuntu0.1~esm1
 None known
xmlrpc-c
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
1.33.14-91.33.14-101.33.14-10ubuntu0.1~esm1
 None known
cadaver
Ubuntu:24.04:LTS
 All versions, plus listed versions
0.24+dfsg-20.24+dfsg-30.24+dfsg-3build10.24+dfsg-3build2
 None known
expat
Ubuntu:24.04:LTS
 before 2.6.1-2ubuntu0.5, plus listed versions
2.5.0-22.6.0-12.6.1-22.6.1-2build12.6.1-2ubuntu0.12.6.1-2ubuntu0.22.6.1-2ubuntu0.32.6.1-2ubuntu0.4
2.6.1-2ubuntu0.5
libxmltok
Ubuntu:24.04:LTS
 All versions, plus listed versions
1.2-4ubuntu11.2-4.1ubuntu11.2-4.1ubuntu2
 None known
matanza
Ubuntu:24.04:LTS
 All versions, plus listed versions
0.13+ds2-10.13+ds2-1build10.13+ds2-1build2
 None known
tdom
Ubuntu:24.04:LTS
 All versions, plus listed versions
0.9.3-10.9.3-1build1
 None known
wbxml2
Ubuntu:24.04:LTS
 All versions, plus listed versions
0.11.8+dfsg-30.11.8+dfsg-3build1
 None known
swish-e
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
2.4.7-6.22.4.7-6.2build12.4.7-6.2build22.4.7-6.2build32.4.7-6.2ubuntu0.1~esm1
 None known
xmlrpc-c
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
1.33.14-111.33.14-11.11.33.14-121.33.14-12build11.33.14-12build21.33.14-12ubuntu0.1~esm1
 None known
cadaver
Ubuntu:25.10
 All versions, plus listed versions
0.26+dfsg-2
 None known
expat
Ubuntu:25.10
 All versions, plus listed versions
2.7.1-12.7.1-22.7.1-2ubuntu0.2
 None known
matanza
Ubuntu:25.10
 All versions, plus listed versions
0.13+ds2-2
 None known
swish-e
Ubuntu:25.10
 All versions, plus listed versions
2.4.7-6.32.4.7-6.3build12.4.7-7
 None known
tdom
Ubuntu:25.10
 All versions, plus listed versions
0.9.5.1-20.9.5.1-3
 None known
wbxml2
Ubuntu:25.10
 All versions, plus listed versions
0.11.10+dfsg-2
 None known
xmlrpc-c
Ubuntu:25.10
 All versions, plus listed versions
1.59.03-71.59.03-91.59.03-101.59.03-10.1
 None known
cadaver
Ubuntu:26.10
 All versions, plus listed versions
0.28+dfsg-2
 None known
matanza
Ubuntu:26.10
 All versions, plus listed versions
0.13+ds2-2build1
 None known
swish-e
Ubuntu:26.10
 All versions, plus listed versions
2.4.7-7.12.4.7-7.22.4.7-7.2build1
 None known
tdom
Ubuntu:26.10
 All versions, plus listed versions
0.9.6-20.9.6-3
 None known
wbxml2
Ubuntu:26.10
 All versions, plus listed versions
0.11.10+dfsg-30.11.10+dfsg-4
 None known
xmlrpc-c
Ubuntu:26.10
 All versions, plus listed versions
1.60.05-11.60.05-1build1
 None known
cadaver
Ubuntu:26.04:LTS
 All versions, plus listed versions
0.26+dfsg-20.28+dfsg-10.28+dfsg-2
 None known
expat
Ubuntu:26.04:LTS
 before 2.7.4-1ubuntu0.1, plus listed versions
2.7.1-22.7.3-12.7.4-1
2.7.4-1ubuntu0.1
matanza
Ubuntu:26.04:LTS
 All versions, plus listed versions
0.13+ds2-20.13+ds2-2build1
 None known
tdom
Ubuntu:26.04:LTS
 All versions, plus listed versions
0.9.5.1-30.9.6-2
 None known
wbxml2
Ubuntu:26.04:LTS
 All versions, plus listed versions
0.11.10+dfsg-20.11.10+dfsg-2build10.11.10+dfsg-3
 None known
xmlrpc-c
Ubuntu:26.04:LTS
 All versions, plus listed versions
1.59.03-10.11.60.05-1
 None known
swish-e
Ubuntu:Pro:26.04:LTS
 All versions, plus listed versions
2.4.7-72.4.7-7.12.4.7-7.1ubuntu0.1~esm1
 None known
expat
Ubuntu:Pro:14.04:LTS
From an advisory covering 12 CVEs
 before 2.1.0-4ubuntu1.4+esm12, plus listed versions
2.1.0-42.1.0-4ubuntu12.1.0-4ubuntu1.12.1.0-4ubuntu1.22.1.0-4ubuntu1.3
Show 10 moreShow less
2.1.0-4ubuntu1.42.1.0-4ubuntu1.4+esm12.1.0-4ubuntu1.4+esm22.1.0-4ubuntu1.4+esm42.1.0-4ubuntu1.4+esm62.1.0-4ubuntu1.4+esm72.1.0-4ubuntu1.4+esm82.1.0-4ubuntu1.4+esm92.1.0-4ubuntu1.4+esm102.1.0-4ubuntu1.4+esm11
2.1.0-4ubuntu1.4+esm12
expat
Ubuntu:Pro:16.04:LTS
From an advisory covering 12 CVEs
 before 2.1.0-7ubuntu0.16.04.5+esm13, plus listed versions
2.1.0-72.1.0-7ubuntu0.16.04.12.1.0-7ubuntu0.16.04.22.1.0-7ubuntu0.16.04.32.1.0-7ubuntu0.16.04.4
Show 10 moreShow less
2.1.0-7ubuntu0.16.04.52.1.0-7ubuntu0.16.04.5+esm22.1.0-7ubuntu0.16.04.5+esm52.1.0-7ubuntu0.16.04.5+esm62.1.0-7ubuntu0.16.04.5+esm72.1.0-7ubuntu0.16.04.5+esm82.1.0-7ubuntu0.16.04.5+esm92.1.0-7ubuntu0.16.04.5+esm102.1.0-7ubuntu0.16.04.5+esm112.1.0-7ubuntu0.16.04.5+esm12
2.1.0-7ubuntu0.16.04.5+esm13
expat
Ubuntu:Pro:18.04:LTS
From an advisory covering 12 CVEs
 before 2.2.5-3ubuntu0.9+esm4, plus listed versions
2.2.3-12.2.3-22.2.5-0ubuntu22.2.5-32.2.5-3ubuntu0.1
Show 8 moreShow less
2.2.5-3ubuntu0.22.2.5-3ubuntu0.42.2.5-3ubuntu0.72.2.5-3ubuntu0.82.2.5-3ubuntu0.92.2.5-3ubuntu0.9+esm12.2.5-3ubuntu0.9+esm22.2.5-3ubuntu0.9+esm3
2.2.5-3ubuntu0.9+esm4
expat
Ubuntu:Pro:20.04:LTS
From an advisory covering 12 CVEs
 before 2.2.9-1ubuntu0.8+esm2, plus listed versions
2.2.7-22.2.9-12.2.9-1build12.2.9-1ubuntu0.22.2.9-1ubuntu0.4
Show 5 moreShow less
2.2.9-1ubuntu0.52.2.9-1ubuntu0.62.2.9-1ubuntu0.72.2.9-1ubuntu0.82.2.9-1ubuntu0.8+esm1
2.2.9-1ubuntu0.8+esm2
expat
Ubuntu:22.04:LTS
From an advisory covering 12 CVEs
 before 2.4.7-1ubuntu0.8, plus listed versions
2.4.1-22.4.1-32.4.2-12.4.3-12.4.3-2
Show 10 moreShow less
2.4.4-12.4.6-12.4.7-12.4.7-1ubuntu0.12.4.7-1ubuntu0.22.4.7-1ubuntu0.32.4.7-1ubuntu0.42.4.7-1ubuntu0.52.4.7-1ubuntu0.62.4.7-1ubuntu0.7
2.4.7-1ubuntu0.8
expat
Ubuntu:24.04:LTS
From an advisory covering 12 CVEs
 before 2.6.1-2ubuntu0.5, plus listed versions
2.5.0-22.6.0-12.6.1-22.6.1-2build12.6.1-2ubuntu0.12.6.1-2ubuntu0.22.6.1-2ubuntu0.32.6.1-2ubuntu0.4
2.6.1-2ubuntu0.5
expat
Ubuntu:26.04:LTS
From an advisory covering 12 CVEs
 before 2.7.4-1ubuntu0.1, plus listed versions
2.7.1-22.7.3-12.7.4-1
2.7.4-1ubuntu0.1
expat
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 2.8.1-1.1
2.8.1-1.1
python310
openSUSE:Tumbleweed
From an advisory covering 3 CVEs
 before 3.10.21-1.1
3.10.21-1.1
python311
openSUSE:Tumbleweed
From an advisory covering 4 CVEs
 before 3.11.16-1.1
3.11.16-1.1
expat
openSUSE:Leap 16.0
From an advisory covering 20 CVEs
 before 2.8.4-160000.1.1
2.8.4-160000.1.1
MozillaFirefox
openSUSE:Leap 16.0
From an advisory covering 85 CVEs
 before 153.5.0-160000.1.1
153.5.0-160000.1.1

History

History
RecordedChangedSources
affected, aliases, referencesOSV
affected
affected, aliases, facts, referencesOSV
affected, aliases, referencesOSV
affected, aliases, referencesOSV
affected
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-45186 is a low vulnerability (CVSS 2.9) in Libexpat Project Libexpat, published May 10, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.48%, the 41st percentile. Fixed in expat 2.8.1-r0.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 263 references and the rest of 6 source descriptions. The JSON record has them. Left out on purpose, here and in the API, to keep responses small: 20 source records.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open