CVE-2022-40674

libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c.

8.1 HighFix available

libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

2.25%Up 1.4 points since Sep 14, 2022

What each source reports

NVD Score used 8.1

libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c.

Record: CVE-2022-40674
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-416
Updated: 2026-11-02

CVE List 8.1

libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c.

Record: CVE-2022-40674
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-416
Updated: 2026-11-02

EUVDEUVD-2022-43945 8.1

libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c.

Record: EUVD-2022-43945
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-2vq2-xc55-3j5m 9.8

libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c.

libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c.

Record: GHSA-2vq2-xc55-3j5m
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-416
Updated: 2026-11-02

OSVALPINE-CVE-2022-40674 8.1

libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c.

Record: ALPINE-CVE-2022-40674
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-03

OSVAZL-10921 8.1

CVE-2022-40674 affecting package expat for versions less than 2.4.8-2

libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c.

Record: AZL-10921
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 46 moreShow less

OSVBELL-CVE-2022-40674 8.1

CVE-2022-40674 does not affect BellSoft software

Record: BELL-CVE-2022-40674
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSV 8.1

libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c.

Record: CVE-2022-40674
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2022-40674 8.1

libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c.

Record: DEBIAN-CVE-2022-40674
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-03

OSVJLSEC-2025-57 8.1

libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c.

libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c.

Record: JLSEC-2025-57
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVOESA-2022-1932 9.8

expat security update

Security Fix(es):

libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c.(CVE-2022-40674)

Record: OESA-2022-1932
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVOESA-2022-2019 9.8

firefox security update

Mozilla Firefox is a standalone web browser, designed for standards compliance and performance. Its functionality can be enhanced via a plethora of extensions.

Security Fix(es):

libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c.(CVE-2022-40674)

Record: OESA-2022-2019
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2022:6831 8.1

Red Hat Security Advisory: expat security update

Record: RHSA-2022:6831
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2022:6832 8.1

Red Hat Security Advisory: expat security update

Record: RHSA-2022:6832
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2022:6833 8.1

Red Hat Security Advisory: expat security update

Record: RHSA-2022:6833
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2022:6834 8.1

Red Hat Security Advisory: expat security update

Record: RHSA-2022:6834
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2022:6838 8.1

Red Hat Security Advisory: expat security update

Record: RHSA-2022:6838
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2022:6878 8.1

Red Hat Security Advisory: expat security update

Record: RHSA-2022:6878
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2022:6921 8.1

Red Hat Security Advisory: expat security update

Record: RHSA-2022:6921
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2022:6967 8.1

Red Hat Security Advisory: compat-expat1 security update

Record: RHSA-2022:6967
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2022:6995 8.1

Red Hat Security Advisory: thunderbird security update

Record: RHSA-2022:6995
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2022:6996 8.1

Red Hat Security Advisory: thunderbird security update

Record: RHSA-2022:6996
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2022:6997 8.1

Red Hat Security Advisory: firefox security update

Record: RHSA-2022:6997
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2022:6998 8.1

Red Hat Security Advisory: thunderbird security update

Record: RHSA-2022:6998
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2022:7019 8.1

Red Hat Security Advisory: firefox security update

Record: RHSA-2022:7019
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2022:7020 8.1

Red Hat Security Advisory: firefox security update

Record: RHSA-2022:7020
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2022:7021 8.1

Red Hat Security Advisory: thunderbird security update

Record: RHSA-2022:7021
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2022:7022 8.1

Red Hat Security Advisory: firefox security update

Record: RHSA-2022:7022
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2022:7023 8.1

Red Hat Security Advisory: thunderbird security update

Record: RHSA-2022:7023
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2022:7024 8.1

Red Hat Security Advisory: firefox security update

Record: RHSA-2022:7024
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2022:7025 8.1

Red Hat Security Advisory: firefox security update

Record: RHSA-2022:7025
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2022:7026 8.1

Red Hat Security Advisory: thunderbird security update

Record: RHSA-2022:7026
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2022:8598 8.6

Red Hat Security Advisory: Red Hat Virtualization Host security update [ovirt-4.5.3-1]

Record: RHSA-2022:8598
CVSS 3.1: 8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Updated: 2026-11-02

OSVRHSA-2023:3068 8.1

Red Hat Security Advisory: mingw-expat security update

Record: RHSA-2023:3068
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRLSA-2022:6838 8.1

Important: expat security update

Expat is a C library for parsing XML documents.

Security Fix(es):

expat: a use-after-free in the doContent function in xmlparse.c (CVE-2022-40674)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: RLSA-2022:6838
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRLSA-2022:6878 8.1

Important: expat security update

Expat is a C library for parsing XML documents.

Security Fix(es):

expat: a use-after-free in the doContent function in xmlparse.c (CVE-2022-40674)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: RLSA-2022:6878
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRLSA-2022:7023 8.1

Important: thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client.

This update upgrades Thunderbird to version 102.3.0.

Security Fix(es):

expat: a use-after-free in the doContent function in xmlparse.c (CVE-2022-40674)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: RLSA-2022:7023
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRLSA-2022:7024 8.1

Important: firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

This update upgrades Firefox to version 102.3.0 ESR.

Security Fix(es):

expat: a use-after-free in the doContent function in xmlparse.c (CVE-2022-40674)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: RLSA-2022:7024
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRLSA-2023:3068 8.1

Important: mingw-expat security update

Expat is a C library for parsing XML documents. The mingw-expat packages provide a port of the Expat library for MinGW.

Security Fix(es):

expat: a use-after-free in the doContent function in xmlparse.c (CVE-2022-40674)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.8 Release Notes linked from the References section.

Record: RLSA-2023:3068
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2022-40674 8.1

libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c.

Record: UBUNTU-CVE-2022-40674
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVALSA-2022:6838 No score

Important: expat security update

Expat is a C library for parsing XML documents.

Security Fix(es):

expat: a use-after-free in the doContent function in xmlparse.c (CVE-2022-40674)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2022:6838
Updated: 2026-11-02

OSVALSA-2022:6878 No score

Important: expat security update

Expat is a C library for parsing XML documents.

Security Fix(es):

expat: a use-after-free in the doContent function in xmlparse.c (CVE-2022-40674)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2022:6878
Updated: 2026-11-02

OSVALSA-2022:7020 No score

Important: firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

This update upgrades Firefox to version 102.3.0 ESR.

Security Fix(es):

expat: a use-after-free in the doContent function in xmlparse.c (CVE-2022-40674)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2022:7020
Updated: 2026-11-02

OSVALSA-2022:7023 No score

Important: thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client.

This update upgrades Thunderbird to version 102.3.0.

Security Fix(es):

expat: a use-after-free in the doContent function in xmlparse.c (CVE-2022-40674)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2022:7023
Updated: 2026-11-02

OSVALSA-2022:7024 No score

Important: firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

This update upgrades Firefox to version 102.3.0 ESR.

Security Fix(es):

expat: a use-after-free in the doContent function in xmlparse.c (CVE-2022-40674)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2022:7024
Updated: 2026-11-02

OSVALSA-2022:7026 No score

Important: thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client.

This update upgrades Thunderbird to version 102.3.0.

Security Fix(es):

expat: a use-after-free in the doContent function in xmlparse.c (CVE-2022-40674)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2022:7026
Updated: 2026-11-02

OSVALSA-2023:3068 No score

Important: mingw-expat security update

Expat is a C library for parsing XML documents. The mingw-expat packages provide a port of the Expat library for MinGW.

Security Fix(es):

expat: a use-after-free in the doContent function in xmlparse.c (CVE-2022-40674)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Record: ALSA-2023:3068
Updated: 2026-11-02

OSVCLSA-2022-1664192553 No score

Fix CVE(s): CVE-2022-40674

SECURITY UPDATE: Unsafe exiting internalEntityParser
- debian/patches/CVE-2022-40674.patch: Ensure raw tagnames are safe exiting internalEntityParser
- CVE-2022-40674
tests were activated
some leaks fixed:
- debian/patches/fix-leak-xmlparse.patch: tidy up attribute prefix bindings on error (fixes #17)
- debian/patches/fix-tests-leak.patch: free the external entity parser in external_entity_loader_set_encoding()
- debian/patches/fix-tests-leak2.patch: free the content model in dummy_element_decl_handler()
- debian/patches/dispose-test-stuff.patch: removes some of the memory leaks discovered by AddressSanitizer in the test suite (Issue #23)

Record: CLSA-2022-1664192553
Updated: 2026-11-02

OSVCLSA-2022-1664192692 No score

Fixed CVE-2022-40674 in expat

CVE-2022-40674: Ensure raw tagnames are safe exiting internalEntityParser
fix tests leak
fix xmlparse leak

Record: CLSA-2022-1664192692
Updated: 2026-11-02

OSVCLSA-2022-1664192814 No score

Fixed CVE-2022-40674 in expat

CVE-2022-40674: Ensure raw tagnames are safe exiting internalEntityParser

Record: CLSA-2022-1664192814
Updated: 2026-11-02

OSVCLSA-2022-1664192896 No score

Fixed CVE-2022-40674 in expat

CVE-2022-40674: Ensure raw tagnames are safe exiting internalEntityParser

Record: CLSA-2022-1664192896
Updated: 2026-11-02

OSVCLSA-2022-1664193203 No score

Fixed CVE-2022-40674 in expat

CVE-2022-40674: Ensure raw tagnames are safe exiting internalEntityParser
fix tests leak
fix xmlparse leak

Record: CLSA-2022-1664193203
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`expat` Alpine:v3.13	before 2.2.10-r7	2.2.10-r7
`expat` Alpine:v3.14	before 2.4.9-r0	2.4.9-r0
`expat` Alpine:v3.15	before 2.4.9-r0	2.4.9-r0
`expat` Alpine:v3.16	before 2.4.9-r0	2.4.9-r0
`expat` Alpine:v3.17	before 2.4.9-r0	2.4.9-r0
`expat` Alpine:v3.18	before 2.4.9-r0	2.4.9-r0
`expat` Alpine:v3.19	before 2.4.9-r0	2.4.9-r0
`expat` Alpine:v3.20	before 2.4.9-r0	2.4.9-r0
`expat` Alpine:v3.21	before 2.4.9-r0	2.4.9-r0
`expat` Alpine:v3.22	before 2.4.9-r0	2.4.9-r0

Show 260 moreShow less

Affected packages
Package	Affected	Fixed
`expat` Alpine:v3.23	before 2.4.9-r0	2.4.9-r0
`expat` Alpine:v3.24	before 2.4.9-r0	2.4.9-r0
`expat` AlmaLinux:9	before 2.2.10-12.el9_0.3	2.2.10-12.el9_0.3
`expat-devel` AlmaLinux:9	before 2.2.10-12.el9_0.3	2.2.10-12.el9_0.3
`expat` AlmaLinux:8	before 2.2.5-8.el8_6.3	2.2.5-8.el8_6.3
`expat-devel` AlmaLinux:8	before 2.2.5-8.el8_6.3	2.2.5-8.el8_6.3
`firefox` AlmaLinux:9	before 102.3.0-7.el9_0.alma	102.3.0-7.el9_0.alma
`thunderbird` AlmaLinux:8	before 102.3.0-4.el8_6.alma	102.3.0-4.el8_6.alma
`firefox` AlmaLinux:8	before 102.3.0-7.el8_6.alma	102.3.0-7.el8_6.alma
`thunderbird` AlmaLinux:9	before 102.3.0-4.el9_0.alma.plus	102.3.0-4.el9_0.alma.plus
`mingw32-expat` AlmaLinux:8	before 2.4.8-2.el8	2.4.8-2.el8
`mingw64-expat` AlmaLinux:8	before 2.4.8-2.el8	2.4.8-2.el8
`expat` Azure Linux:2	before 2.4.8-2	2.4.8-2
`expat` TuxCare:Ubuntu:16.04	before 2.1.0-7ubuntu0.16.04.5+tuxcare.els2	2.1.0-7ubuntu0.16.04.5+tuxcare.els2
`libexpat1` TuxCare:Ubuntu:16.04	before 2.1.0-7ubuntu0.16.04.5+tuxcare.els2	2.1.0-7ubuntu0.16.04.5+tuxcare.els2
`libexpat1-dev` TuxCare:Ubuntu:16.04	before 2.1.0-7ubuntu0.16.04.5+tuxcare.els2	2.1.0-7ubuntu0.16.04.5+tuxcare.els2
`expat` TuxCare:OracleLinux:6	before 2.0.1-13.el6_8.tuxcare.els2	2.0.1-13.el6_8.tuxcare.els2
`expat-devel` TuxCare:OracleLinux:6	before 2.0.1-13.el6_8.tuxcare.els2	2.0.1-13.el6_8.tuxcare.els2
`expat` TuxCare:CentOS:8.4	before 2.2.5-4.el8.tuxcare.els2	2.2.5-4.el8.tuxcare.els2
`expat-devel` TuxCare:CentOS:8.4	before 2.2.5-4.el8.tuxcare.els2	2.2.5-4.el8.tuxcare.els2
`expat-static` TuxCare:CentOS:8.4	before 2.2.5-4.el8.tuxcare.els2	2.2.5-4.el8.tuxcare.els2
`expat` TuxCare:CentOS:8.5	before 2.2.5-4.el8.tuxcare.els2	2.2.5-4.el8.tuxcare.els2
`expat-devel` TuxCare:CentOS:8.5	before 2.2.5-4.el8.tuxcare.els2	2.2.5-4.el8.tuxcare.els2
`expat-static` TuxCare:CentOS:8.5	before 2.2.5-4.el8.tuxcare.els2	2.2.5-4.el8.tuxcare.els2
`expat` TuxCare:CentOS:6	before 2.0.1-13.el6_8.tuxcare.els2	2.0.1-13.el6_8.tuxcare.els2
`expat-devel` TuxCare:CentOS:6	before 2.0.1-13.el6_8.tuxcare.els2	2.0.1-13.el6_8.tuxcare.els2
`expat` Debian:12	before 2.4.8-2	2.4.8-2
`expat` Debian:13	before 2.4.8-2	2.4.8-2
`expat` Debian:14	before 2.4.8-2	2.4.8-2
`libxmltok` Debian:12	All versions, plus listed versions 1.2-41.2-4.11.2-4.1~exp11.2-4.2	None known
`expat` Debian:10	before 2.2.6-2+deb10u5, plus listed versions 2.2.6-22.2.6-2+deb10u12.2.6-2+deb10u22.2.6-2+deb10u32.2.6-2+deb10u4	2.2.6-2+deb10u5
`expat` Debian:11	before 2.2.10-2+deb11u4, plus listed versions 2.2.10-22.2.10-2+deb11u12.2.10-2+deb11u22.2.10-2+deb11u3	2.2.10-2+deb11u4
`Expat_jll` Julia	before 2.5.0+0	2.5.0+0
`expat` Mageia:8	before 2.2.10-1.5.mga8	2.2.10-1.5.mga8
`thunderbird` Mageia:8	before 102.4.0-1.mga8	102.4.0-1.mga8
`thunderbird-l10n` Mageia:8	before 102.4.0-1.mga8	102.4.0-1.mga8
`firefox` Mageia:8	before 102.4.0-1.1.mga8	102.4.0-1.1.mga8
`xmlrpc-c` Mageia:9	before 1.51.08-1.1.mga9	1.51.08-1.1.mga9
`expat` openEuler:20.03-LTS-SP1	before 2.2.9-8.oe1	2.2.9-8.oe1
`expat` openEuler:20.03-LTS-SP3	before 2.2.9-8.oe1	2.2.9-8.oe1
`expat` openEuler:22.03-LTS	before 2.4.1-6.oe2203	2.4.1-6.oe2203
`firefox` openEuler:20.03-LTS-SP1	before 79.0-9.oe1	79.0-9.oe1
`firefox` openEuler:20.03-LTS-SP3	before 79.0-9.oe1	79.0-9.oe1
`firefox` openEuler:22.03-LTS	before 79.0-13.oe2203	79.0-13.oe2203
`expat` Red Hat:rhel_eus:8.4::baseos	before 0:2.2.5-4.el8_4.4	0:2.2.5-4.el8_4.4
`expat-debuginfo` Red Hat:rhel_eus:8.4::baseos	before 0:2.2.5-4.el8_4.4	0:2.2.5-4.el8_4.4
`expat-debugsource` Red Hat:rhel_eus:8.4::baseos	before 0:2.2.5-4.el8_4.4	0:2.2.5-4.el8_4.4
`expat-devel` Red Hat:rhel_eus:8.4::baseos	before 0:2.2.5-4.el8_4.4	0:2.2.5-4.el8_4.4
`expat` Red Hat:rhel_eus:8.2::baseos	before 0:2.2.5-3.el8_2.3	0:2.2.5-3.el8_2.3
`expat-debuginfo` Red Hat:rhel_eus:8.2::baseos	before 0:2.2.5-3.el8_2.3	0:2.2.5-3.el8_2.3
`expat-debugsource` Red Hat:rhel_eus:8.2::baseos	before 0:2.2.5-3.el8_2.3	0:2.2.5-3.el8_2.3
`expat-devel` Red Hat:rhel_eus:8.2::baseos	before 0:2.2.5-3.el8_2.3	0:2.2.5-3.el8_2.3
`expat` Red Hat:rhel_e4s:8.1::baseos	before 0:2.2.5-3.el8_1.2	0:2.2.5-3.el8_1.2
`expat-debuginfo` Red Hat:rhel_e4s:8.1::baseos	before 0:2.2.5-3.el8_1.2	0:2.2.5-3.el8_1.2
`expat-debugsource` Red Hat:rhel_e4s:8.1::baseos	before 0:2.2.5-3.el8_1.2	0:2.2.5-3.el8_1.2
`expat-devel` Red Hat:rhel_e4s:8.1::baseos	before 0:2.2.5-3.el8_1.2	0:2.2.5-3.el8_1.2
`expat` Red Hat:enterprise_linux:7::client	before 0:2.1.0-15.el7_9	0:2.1.0-15.el7_9
`expat-debuginfo` Red Hat:enterprise_linux:7::client	before 0:2.1.0-15.el7_9	0:2.1.0-15.el7_9
`expat-devel` Red Hat:enterprise_linux:7::client	before 0:2.1.0-15.el7_9	0:2.1.0-15.el7_9
`expat-static` Red Hat:enterprise_linux:7::client	before 0:2.1.0-15.el7_9	0:2.1.0-15.el7_9
`expat-debuginfo` Red Hat:enterprise_linux:7::computenode	before 0:2.1.0-15.el7_9	0:2.1.0-15.el7_9
`expat-devel` Red Hat:enterprise_linux:7::computenode	before 0:2.1.0-15.el7_9	0:2.1.0-15.el7_9
`expat-static` Red Hat:enterprise_linux:7::computenode	before 0:2.1.0-15.el7_9	0:2.1.0-15.el7_9
`expat` Red Hat:enterprise_linux:7::server	before 0:2.1.0-15.el7_9	0:2.1.0-15.el7_9
`expat-debuginfo` Red Hat:enterprise_linux:7::server	before 0:2.1.0-15.el7_9	0:2.1.0-15.el7_9
`expat-devel` Red Hat:enterprise_linux:7::server	before 0:2.1.0-15.el7_9	0:2.1.0-15.el7_9
`expat-static` Red Hat:enterprise_linux:7::server	before 0:2.1.0-15.el7_9	0:2.1.0-15.el7_9
`expat` Red Hat:enterprise_linux:7::workstation	before 0:2.1.0-15.el7_9	0:2.1.0-15.el7_9
`expat-debuginfo` Red Hat:enterprise_linux:7::workstation	before 0:2.1.0-15.el7_9	0:2.1.0-15.el7_9
`expat-devel` Red Hat:enterprise_linux:7::workstation	before 0:2.1.0-15.el7_9	0:2.1.0-15.el7_9
`expat-static` Red Hat:enterprise_linux:7::workstation	before 0:2.1.0-15.el7_9	0:2.1.0-15.el7_9
`expat-debuginfo` Red Hat:enterprise_linux:9::appstream	before 0:2.2.10-12.el9_0.3	0:2.2.10-12.el9_0.3
`expat-debugsource` Red Hat:enterprise_linux:9::appstream	before 0:2.2.10-12.el9_0.3	0:2.2.10-12.el9_0.3
`expat-devel` Red Hat:enterprise_linux:9::appstream	before 0:2.2.10-12.el9_0.3	0:2.2.10-12.el9_0.3
`expat` Red Hat:enterprise_linux:9::baseos	before 0:2.2.10-12.el9_0.3	0:2.2.10-12.el9_0.3
`expat-debuginfo` Red Hat:enterprise_linux:9::baseos	before 0:2.2.10-12.el9_0.3	0:2.2.10-12.el9_0.3
`expat-debugsource` Red Hat:enterprise_linux:9::baseos	before 0:2.2.10-12.el9_0.3	0:2.2.10-12.el9_0.3
`expat` Red Hat:enterprise_linux:8::baseos	before 0:2.2.5-8.el8_6.3	0:2.2.5-8.el8_6.3
`expat-debuginfo` Red Hat:enterprise_linux:8::baseos	before 0:2.2.5-8.el8_6.3	0:2.2.5-8.el8_6.3
`expat-debugsource` Red Hat:enterprise_linux:8::baseos	before 0:2.2.5-8.el8_6.3	0:2.2.5-8.el8_6.3
`expat-devel` Red Hat:enterprise_linux:8::baseos	before 0:2.2.5-8.el8_6.3	0:2.2.5-8.el8_6.3
`expat` Red Hat:rhel_els:6	before 0:2.0.1-15.el6_10	0:2.0.1-15.el6_10
`expat-debuginfo` Red Hat:rhel_els:6	before 0:2.0.1-15.el6_10	0:2.0.1-15.el6_10
`expat-devel` Red Hat:rhel_els:6	before 0:2.0.1-15.el6_10	0:2.0.1-15.el6_10
`compat-expat1` Red Hat:rhel_els:6	before 0:1.95.8-9.el6_10	0:1.95.8-9.el6_10
`compat-expat1-debuginfo` Red Hat:rhel_els:6	before 0:1.95.8-9.el6_10	0:1.95.8-9.el6_10
`thunderbird` Red Hat:rhel_eus:8.4::appstream	before 0:102.3.0-4.el8_4	0:102.3.0-4.el8_4
`thunderbird-debuginfo` Red Hat:rhel_eus:8.4::appstream	before 0:102.3.0-4.el8_4	0:102.3.0-4.el8_4
`thunderbird-debugsource` Red Hat:rhel_eus:8.4::appstream	before 0:102.3.0-4.el8_4	0:102.3.0-4.el8_4
`thunderbird` Red Hat:rhel_eus:8.2::appstream	before 0:102.3.0-4.el8_2	0:102.3.0-4.el8_2
`thunderbird-debuginfo` Red Hat:rhel_eus:8.2::appstream	before 0:102.3.0-4.el8_2	0:102.3.0-4.el8_2
`thunderbird-debugsource` Red Hat:rhel_eus:8.2::appstream	before 0:102.3.0-4.el8_2	0:102.3.0-4.el8_2
`firefox` Red Hat:enterprise_linux:7::client	before 0:102.3.0-7.el7_9	0:102.3.0-7.el7_9
`firefox-debuginfo` Red Hat:enterprise_linux:7::client	before 0:102.3.0-7.el7_9	0:102.3.0-7.el7_9
`firefox` Red Hat:enterprise_linux:7::server	before 0:102.3.0-7.el7_9	0:102.3.0-7.el7_9
`firefox-debuginfo` Red Hat:enterprise_linux:7::server	before 0:102.3.0-7.el7_9	0:102.3.0-7.el7_9
`firefox` Red Hat:enterprise_linux:7::workstation	before 0:102.3.0-7.el7_9	0:102.3.0-7.el7_9
`firefox-debuginfo` Red Hat:enterprise_linux:7::workstation	before 0:102.3.0-7.el7_9	0:102.3.0-7.el7_9
`thunderbird` Red Hat:enterprise_linux:7::client	before 0:102.3.0-4.el7_9	0:102.3.0-4.el7_9
`thunderbird-debuginfo` Red Hat:enterprise_linux:7::client	before 0:102.3.0-4.el7_9	0:102.3.0-4.el7_9
`thunderbird` Red Hat:enterprise_linux:7::server	before 0:102.3.0-4.el7_9	0:102.3.0-4.el7_9
`thunderbird-debuginfo` Red Hat:enterprise_linux:7::server	before 0:102.3.0-4.el7_9	0:102.3.0-4.el7_9
`thunderbird` Red Hat:enterprise_linux:7::workstation	before 0:102.3.0-4.el7_9	0:102.3.0-4.el7_9
`thunderbird-debuginfo` Red Hat:enterprise_linux:7::workstation	before 0:102.3.0-4.el7_9	0:102.3.0-4.el7_9
`firefox` Red Hat:rhel_e4s:8.1::appstream	before 0:102.3.0-7.el8_1	0:102.3.0-7.el8_1
`firefox-debuginfo` Red Hat:rhel_e4s:8.1::appstream	before 0:102.3.0-7.el8_1	0:102.3.0-7.el8_1
`firefox-debugsource` Red Hat:rhel_e4s:8.1::appstream	before 0:102.3.0-7.el8_1	0:102.3.0-7.el8_1
`firefox` Red Hat:enterprise_linux:9::appstream	before 0:102.3.0-7.el9_0	0:102.3.0-7.el9_0
`firefox-debuginfo` Red Hat:enterprise_linux:9::appstream	before 0:102.3.0-7.el9_0	0:102.3.0-7.el9_0
`firefox-debugsource` Red Hat:enterprise_linux:9::appstream	before 0:102.3.0-7.el9_0	0:102.3.0-7.el9_0
`thunderbird` Red Hat:rhel_e4s:8.1::appstream	before 0:102.3.0-4.el8_1	0:102.3.0-4.el8_1
`thunderbird-debuginfo` Red Hat:rhel_e4s:8.1::appstream	before 0:102.3.0-4.el8_1	0:102.3.0-4.el8_1
`thunderbird-debugsource` Red Hat:rhel_e4s:8.1::appstream	before 0:102.3.0-4.el8_1	0:102.3.0-4.el8_1
`firefox` Red Hat:rhel_eus:8.2::appstream	before 0:102.3.0-7.el8_2	0:102.3.0-7.el8_2
`firefox-debuginfo` Red Hat:rhel_eus:8.2::appstream	before 0:102.3.0-7.el8_2	0:102.3.0-7.el8_2
`firefox-debugsource` Red Hat:rhel_eus:8.2::appstream	before 0:102.3.0-7.el8_2	0:102.3.0-7.el8_2
`thunderbird` Red Hat:enterprise_linux:8::appstream	before 0:102.3.0-4.el8_6	0:102.3.0-4.el8_6
`thunderbird-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:102.3.0-4.el8_6	0:102.3.0-4.el8_6
`thunderbird-debugsource` Red Hat:enterprise_linux:8::appstream	before 0:102.3.0-4.el8_6	0:102.3.0-4.el8_6
`firefox` Red Hat:enterprise_linux:8::appstream	before 0:102.3.0-7.el8_6	0:102.3.0-7.el8_6
`firefox-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:102.3.0-7.el8_6	0:102.3.0-7.el8_6
`firefox-debugsource` Red Hat:enterprise_linux:8::appstream	before 0:102.3.0-7.el8_6	0:102.3.0-7.el8_6
`firefox` Red Hat:rhel_eus:8.4::appstream	before 0:102.3.0-7.el8_4	0:102.3.0-7.el8_4
`firefox-debuginfo` Red Hat:rhel_eus:8.4::appstream	before 0:102.3.0-7.el8_4	0:102.3.0-7.el8_4
`firefox-debugsource` Red Hat:rhel_eus:8.4::appstream	before 0:102.3.0-7.el8_4	0:102.3.0-7.el8_4
`thunderbird` Red Hat:enterprise_linux:9::appstream	before 0:102.3.0-4.el9_0	0:102.3.0-4.el9_0
`thunderbird-debuginfo` Red Hat:enterprise_linux:9::appstream	before 0:102.3.0-4.el9_0	0:102.3.0-4.el9_0
`thunderbird-debugsource` Red Hat:enterprise_linux:9::appstream	before 0:102.3.0-4.el9_0	0:102.3.0-4.el9_0
`redhat-virtualization-host` Red Hat:rhev_hypervisor:4.4::el8	before 0:4.5.3-202211170828_8.6	0:4.5.3-202211170828_8.6
`redhat-virtualization-host-image-update` Red Hat:rhev_hypervisor:4.4::el8	before 0:4.5.3-202211170828_8.6	0:4.5.3-202211170828_8.6
`mingw-expat` Red Hat:enterprise_linux:8::crb	before 0:2.4.8-2.el8	0:2.4.8-2.el8
`mingw32-expat` Red Hat:enterprise_linux:8::crb	before 0:2.4.8-2.el8	0:2.4.8-2.el8
`mingw32-expat-debuginfo` Red Hat:enterprise_linux:8::crb	before 0:2.4.8-2.el8	0:2.4.8-2.el8
`mingw64-expat` Red Hat:enterprise_linux:8::crb	before 0:2.4.8-2.el8	0:2.4.8-2.el8
`mingw64-expat-debuginfo` Red Hat:enterprise_linux:8::crb	before 0:2.4.8-2.el8	0:2.4.8-2.el8
`expat` Rocky Linux:9	before 0:2.2.10-12.el9_0.3	0:2.2.10-12.el9_0.3
`expat` Rocky Linux:8	before 0:2.2.5-8.el8_6.3	0:2.2.5-8.el8_6.3
`thunderbird` Rocky Linux:8	before 0:102.3.0-4.el8_6	0:102.3.0-4.el8_6
`firefox` Rocky Linux:8	before 0:102.3.0-7.el8_6	0:102.3.0-7.el8_6
`mingw-expat` Rocky Linux:8	before 0:2.4.8-2.el8	0:2.4.8-2.el8
`expat` SUSE:OpenStack Cloud 9	before 2.1.0-21.25.1	2.1.0-21.25.1
`expat` SUSE:OpenStack Cloud Crowbar 9	before 2.1.0-21.25.1	2.1.0-21.25.1
`expat` SUSE:Linux Enterprise Server for SAP Applications 12 SP4	before 2.1.0-21.25.1	2.1.0-21.25.1
`expat` SUSE:Linux Enterprise Software Development Kit 12 SP5	before 2.1.0-21.25.1	2.1.0-21.25.1
`expat` SUSE:Linux Enterprise Server 12 SP2-BCL	before 2.1.0-21.25.1	2.1.0-21.25.1
`expat` SUSE:Linux Enterprise Server 12 SP3-BCL	before 2.1.0-21.25.1	2.1.0-21.25.1
`expat` SUSE:Linux Enterprise Server 12 SP4-LTSS	before 2.1.0-21.25.1	2.1.0-21.25.1
`expat` SUSE:Linux Enterprise Server 12 SP5	before 2.1.0-21.25.1	2.1.0-21.25.1
`expat` SUSE:Linux Enterprise Server for SAP Applications 12 SP5	before 2.1.0-21.25.1	2.1.0-21.25.1
`expat` SUSE:Linux Enterprise Micro 5.3	before 2.4.4-150400.3.9.1	2.4.4-150400.3.9.1
`expat` SUSE:Linux Enterprise Module for Basesystem 15 SP4	before 2.4.4-150400.3.9.1	2.4.4-150400.3.9.1
`expat` openSUSE:Leap 15.4	before 2.4.4-150400.3.9.1	2.4.4-150400.3.9.1
`expat` SUSE:Linux Enterprise Module for Basesystem 15 SP3	before 2.2.5-150000.3.22.1	2.2.5-150000.3.22.1
`expat` SUSE:Linux Enterprise High Performance Computing 15-ESPOS	before 2.2.5-150000.3.22.1	2.2.5-150000.3.22.1
`expat` SUSE:Linux Enterprise High Performance Computing 15-LTSS	before 2.2.5-150000.3.22.1	2.2.5-150000.3.22.1
`expat` SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS	before 2.2.5-150000.3.22.1	2.2.5-150000.3.22.1
`expat` SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS	before 2.2.5-150000.3.22.1	2.2.5-150000.3.22.1
`expat` SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS	before 2.2.5-150000.3.22.1	2.2.5-150000.3.22.1
`expat` SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS	before 2.2.5-150000.3.22.1	2.2.5-150000.3.22.1
`expat` SUSE:Linux Enterprise Server 15-LTSS	before 2.2.5-150000.3.22.1	2.2.5-150000.3.22.1
`expat` SUSE:Linux Enterprise Server 15 SP1-BCL	before 2.2.5-150000.3.22.1	2.2.5-150000.3.22.1
`expat` SUSE:Linux Enterprise Server 15 SP1-LTSS	before 2.2.5-150000.3.22.1	2.2.5-150000.3.22.1
`expat` SUSE:Linux Enterprise Server 15 SP2-BCL	before 2.2.5-150000.3.22.1	2.2.5-150000.3.22.1
`expat` SUSE:Linux Enterprise Server 15 SP2-LTSS	before 2.2.5-150000.3.22.1	2.2.5-150000.3.22.1
`expat` SUSE:Linux Enterprise Server for SAP Applications 15	before 2.2.5-150000.3.22.1	2.2.5-150000.3.22.1
`expat` SUSE:Linux Enterprise Server for SAP Applications 15 SP1	before 2.2.5-150000.3.22.1	2.2.5-150000.3.22.1
`expat` SUSE:Linux Enterprise Server for SAP Applications 15 SP2	before 2.2.5-150000.3.22.1	2.2.5-150000.3.22.1
`expat` SUSE:Manager Proxy 4.1	before 2.2.5-150000.3.22.1	2.2.5-150000.3.22.1
`expat` SUSE:Manager Retail Branch Server 4.1	before 2.2.5-150000.3.22.1	2.2.5-150000.3.22.1
`expat` SUSE:Manager Server 4.1	before 2.2.5-150000.3.22.1	2.2.5-150000.3.22.1
`expat` SUSE:Linux Enterprise Micro 5.1	before 2.2.5-150000.3.22.1	2.2.5-150000.3.22.1
`expat` SUSE:Linux Enterprise Micro 5.2	before 2.2.5-150000.3.22.1	2.2.5-150000.3.22.1
`expat` SUSE:Enterprise Storage 6	before 2.2.5-150000.3.22.1	2.2.5-150000.3.22.1
`expat` SUSE:Enterprise Storage 7	before 2.2.5-150000.3.22.1	2.2.5-150000.3.22.1
`expat` openSUSE:Leap Micro 5.2	before 2.2.5-150000.3.22.1	2.2.5-150000.3.22.1
`expat` openSUSE:Leap 15.3	before 2.2.5-150000.3.22.1	2.2.5-150000.3.22.1
`expat` Ubuntu:Pro:14.04:LTS	before 2.1.0-4ubuntu1.4+esm7, plus listed versions 2.1.0-42.1.0-4ubuntu12.1.0-4ubuntu1.12.1.0-4ubuntu1.22.1.0-4ubuntu1.3 Show 5 moreShow less 2.1.0-4ubuntu1.42.1.0-4ubuntu1.4+esm12.1.0-4ubuntu1.4+esm22.1.0-4ubuntu1.4+esm42.1.0-4ubuntu1.4+esm6	2.1.0-4ubuntu1.4+esm7
`coin3` Ubuntu:Pro:14.04:LTS	All versions, plus listed versions 3.1.4~abc9f50-33.1.4~abc9f50-43.1.4~abc9f50-4ubuntu23.1.4~abc9f50-4ubuntu2+esm13.1.4~abc9f50-4ubuntu2+esm2	None known
`vnc4` Ubuntu:Pro:14.04:LTS	All versions, plus listed versions 4.1.1+xorg4.3.0-37ubuntu54.1.1+xorg4.3.0-37ubuntu5.0.14.1.1+xorg4.3.0-37ubuntu5.0.24.1.1+xorg4.3.0-37ubuntu5.0.2+esm1	None known
`vtk` Ubuntu:Pro:14.04:LTS	All versions, plus listed versions 5.8.0-14ubuntu15.8.0-14ubuntu35.8.0-14.1ubuntu25.8.0-14.1ubuntu35.8.0-14.1ubuntu3+esm1	None known
`xmlrpc-c` Ubuntu:Pro:14.04:LTS	All versions, plus listed versions 1.16.33-3.2ubuntu31.33.06-0ubuntu11.33.06-0ubuntu1+esm1	None known
`expat` Ubuntu:Pro:16.04:LTS	before 2.1.0-7ubuntu0.16.04.5+esm6, plus listed versions 2.1.0-72.1.0-7ubuntu0.16.04.12.1.0-7ubuntu0.16.04.22.1.0-7ubuntu0.16.04.32.1.0-7ubuntu0.16.04.42.1.0-7ubuntu0.16.04.52.1.0-7ubuntu0.16.04.5+esm22.1.0-7ubuntu0.16.04.5+esm5	2.1.0-7ubuntu0.16.04.5+esm6
`ayttm` Ubuntu:Pro:16.04:LTS	All versions, plus listed versions 0.6.3-3build10.6.3-3ubuntu0.1~esm1	None known
`cableswig` Ubuntu:Pro:16.04:LTS	All versions, plus listed versions 0.1.0+git20150808-10.1.0+git20150808-20.1.0+git20150808-2ubuntu0.1~esm1	None known
`cadaver` Ubuntu:16.04:LTS	All versions, plus listed versions 0.23.3-2ubuntu2	None known
`coin3` Ubuntu:Pro:16.04:LTS	All versions, plus listed versions 3.1.4~abc9f50+dfsg1-13.1.4~abc9f50+dfsg1-1ubuntu0.1~esm13.1.4~abc9f50+dfsg1-1ubuntu0.1~esm2	None known
`insighttoolkit` Ubuntu:Pro:16.04:LTS	All versions, plus listed versions 3.20.1+git20120521-63.20.1+git20120521-6build13.20.1+git20120521-6ubuntu0.1~esm1	None known
`insighttoolkit4` Ubuntu:16.04:LTS	All versions, plus listed versions 4.8.1-1ubuntu34.8.1-1ubuntu44.8.2-3.1ubuntu14.9.0-3ubuntu24.9.0-4ubuntu14.9.0-4ubuntu1.1	None known
`matanza` Ubuntu:16.04:LTS	All versions, plus listed versions 0.13+ds1-5	None known
`smart` Ubuntu:16.04:LTS	All versions, plus listed versions 1.4-2	None known
`swish-e` Ubuntu:Pro:16.04:LTS	All versions, plus listed versions 2.4.7-42.4.7-4build12.4.7-4ubuntu0.1~esm1	None known
`tdom` Ubuntu:16.04:LTS	All versions, plus listed versions 0.8.3-1	None known
`vnc4` Ubuntu:Pro:16.04:LTS	All versions, plus listed versions 4.1.1+xorg4.3.0-37.3ubuntu24.1.1+xorg4.3.0-37.3ubuntu2.1+esm1	None known
`vtk` Ubuntu:Pro:16.04:LTS	All versions, plus listed versions 5.10.1+dfsg-25.10.1+dfsg-2build35.10.1+dfsg-2.1build15.10.1+dfsg-2.1ubuntu0.1~esm1	None known
`wbxml2` Ubuntu:16.04:LTS	All versions, plus listed versions 0.10.7-1	None known
`xmlrpc-c` Ubuntu:Pro:16.04:LTS	All versions, plus listed versions 1.33.14-0.2ubuntu31.33.14-1ubuntu11.33.14-1ubuntu1+esm1	None known
`expat` Ubuntu:18.04:LTS	before 2.2.5-3ubuntu0.8, plus listed versions 2.2.3-12.2.3-22.2.5-0ubuntu22.2.5-32.2.5-3ubuntu0.12.2.5-3ubuntu0.22.2.5-3ubuntu0.42.2.5-3ubuntu0.7	2.2.5-3ubuntu0.8
`firefox` Ubuntu:18.04:LTS	before 107.0+build2-0ubuntu0.18.04.1, plus listed versions 56.0+build6-0ubuntu157.0.1+build2-0ubuntu159.0.1+build1-0ubuntu159.0.2+build1-0ubuntu160.0+build2-0ubuntu1 Show 45 moreShow less 60.0.1+build2-0ubuntu0.18.04.160.0.2+build1-0ubuntu0.18.04.161.0+build3-0ubuntu0.18.04.161.0.1+build1-0ubuntu0.18.04.162.0+build2-0ubuntu0.18.04.362.0+build2-0ubuntu0.18.04.462.0+build2-0ubuntu0.18.04.562.0.3+build1-0ubuntu0.18.04.163.0+build2-0ubuntu0.18.04.263.0.3+build1-0ubuntu0.18.04.164.0+build3-0ubuntu0.18.04.165.0+build2-0ubuntu0.18.04.165.0.1+build2-0ubuntu0.18.04.166.0+build3-0ubuntu0.18.04.166.0.1+build1-0ubuntu0.18.04.166.0.2+build1-0ubuntu0.18.04.166.0.3+build1-0ubuntu0.18.04.166.0.4+build3-0ubuntu0.18.04.166.0.5+build1-0ubuntu0.18.04.167.0+build2-0ubuntu0.18.04.167.0.1+build1-0ubuntu0.18.04.167.0.2+build2-0ubuntu0.18.04.167.0.3+build1-0ubuntu0.18.04.167.0.4+build1-0ubuntu0.18.04.168.0+build3-0ubuntu0.18.04.168.0.1+build1-0ubuntu0.18.04.168.0.2+build1-0ubuntu0.18.04.169.0+build2-0ubuntu0.18.04.169.0.1+build1-0ubuntu0.18.04.169.0.2+build1-0ubuntu0.18.04.170.0+build2-0ubuntu0.18.04.170.0.1+build1-0ubuntu0.18.04.171.0+build5-0ubuntu0.18.04.172.0.1+build1-0ubuntu0.18.04.172.0.2+build1-0ubuntu0.18.04.173.0+build3-0ubuntu0.18.04.173.0.1+build1-0ubuntu0.18.04.174.0+build3-0ubuntu0.18.04.174.0.1+build1-0ubuntu0.18.04.175.0+build3-0ubuntu0.18.04.176.0+build2-0ubuntu0.18.04.176.0.1+build1-0ubuntu0.18.04.177.0.1+build1-0ubuntu0.18.04.178.0.1+build1-0ubuntu0.18.04.178.0.2+build2-0ubuntu0.18.04.1	107.0+build2-0ubuntu0.18.04.1
`cadaver` Ubuntu:18.04:LTS	All versions, plus listed versions 0.23.3-2ubuntu3	None known
`coin3` Ubuntu:Pro:18.04:LTS	All versions, plus listed versions 3.1.4~abc9f50+dfsg1-23.1.4~abc9f50+dfsg2-13.1.4~abc9f50+dfsg3-13.1.4~abc9f50+dfsg3-23.1.4~abc9f50+dfsg3-2ubuntu0.1~esm1	None known
`matanza` Ubuntu:18.04:LTS	All versions, plus listed versions 0.13+ds1-5build10.13+ds1-6	None known
`smart` Ubuntu:18.04:LTS	All versions, plus listed versions 1.4-2	None known
`swish-e` Ubuntu:Pro:18.04:LTS	All versions, plus listed versions 2.4.7-5ubuntu12.4.7-5ubuntu1+esm1	None known
`tdom` Ubuntu:18.04:LTS	All versions, plus listed versions 0.8.3-10.9.0-1	None known
`vnc4` Ubuntu:18.04:LTS	All versions, plus listed versions 4.1.1+xorg4.3.0-37.3ubuntu2	None known
`wbxml2` Ubuntu:18.04:LTS	All versions, plus listed versions 0.10.7-10.10.7-1build1	None known
`xmlrpc-c` Ubuntu:Pro:18.04:LTS	All versions, plus listed versions 1.33.14-71.33.14-81.33.14-8build11.33.14-8ubuntu0.18.04.1~esm1	None known
`expat` Ubuntu:20.04:LTS	before 2.2.9-1ubuntu0.5, plus listed versions 2.2.7-22.2.9-12.2.9-1build12.2.9-1ubuntu0.22.2.9-1ubuntu0.4	2.2.9-1ubuntu0.5
`firefox` Ubuntu:20.04:LTS	before 107.0+build2-0ubuntu0.20.04.1, plus listed versions 69.0.3+build1-0ubuntu170.0+build2-0ubuntu170.0+build2-0ubuntu270.0.1+build1-0ubuntu271.0+build2-0ubuntu2 Show 45 moreShow less 71.0+build5-0ubuntu172.0.1+build1-0ubuntu172.0.2+build1-0ubuntu173.0+build1-0ubuntu173.0+build2-0ubuntu173.0+build3-0ubuntu173.0.1+build1-0ubuntu174.0+build1-0ubuntu174.0+build2-0ubuntu174.0+build2-0ubuntu274.0+build3-0ubuntu175.0+build3-0ubuntu176.0+build2-0ubuntu0.20.04.176.0.1+build1-0ubuntu0.20.04.177.0.1+build1-0ubuntu0.20.04.178.0.1+build1-0ubuntu0.20.04.178.0.2+build2-0ubuntu0.20.04.179.0+build1-0ubuntu0.20.04.180.0+build2-0ubuntu0.20.04.180.0.1+build1-0ubuntu0.20.04.181.0+build2-0ubuntu0.20.04.181.0.2+build1-0ubuntu0.20.04.182.0+build2-0ubuntu0.20.04.182.0.2+build1-0ubuntu0.20.04.182.0.3+build1-0ubuntu0.20.04.183.0+build2-0ubuntu0.20.04.184.0+build3-0ubuntu0.20.04.184.0.1+build1-0ubuntu0.20.04.184.0.2+build1-0ubuntu0.20.04.185.0+build1-0ubuntu0.20.04.185.0.1+build1-0ubuntu0.20.04.186.0+build3-0ubuntu0.20.04.186.0.1+build1-0ubuntu0.20.04.187.0+build3-0ubuntu0.20.04.288.0+build2-0ubuntu0.20.04.188.0.1+build1-0ubuntu0.20.04.289.0+build2-0ubuntu0.20.04.289.0.1+build1-0ubuntu0.20.04.189.0.2+build1-0ubuntu0.20.04.190.0+build1-0ubuntu0.20.04.190.0.2+build1-0ubuntu0.20.04.191.0+build2-0ubuntu0.20.04.191.0.1+build1-0ubuntu0.20.04.191.0.2+build1-0ubuntu0.20.04.192.0+build3-0ubuntu0.20.04.1	107.0+build2-0ubuntu0.20.04.1
`cadaver` Ubuntu:20.04:LTS	All versions, plus listed versions 0.23.3-2.1build1	None known
`coin3` Ubuntu:20.04:LTS	All versions, plus listed versions 4.0.0~CMake~6f54f1602475+ds1-34.0.0+ds-1build1	None known
`matanza` Ubuntu:20.04:LTS	All versions, plus listed versions 0.13+ds1-60.13+ds2-1	None known
`swish-e` Ubuntu:Pro:20.04:LTS	All versions, plus listed versions 2.4.7-6build12.4.7-6build22.4.7-6ubuntu0.1~esm1	None known
`tdom` Ubuntu:20.04:LTS	All versions, plus listed versions 0.9.1-1	None known
`wbxml2` Ubuntu:20.04:LTS	All versions, plus listed versions 0.10.7-1build1	None known
`xmlrpc-c` Ubuntu:Pro:20.04:LTS	All versions, plus listed versions 1.33.14-8build11.33.14-8build21.33.14-8ubuntu0.20.04.1~esm1	None known
`cadaver` Ubuntu:22.04:LTS	All versions, plus listed versions 0.23.3-2.1build1	None known
`coin3` Ubuntu:22.04:LTS	All versions, plus listed versions 4.0.0+ds-1build14.0.0+ds-2	None known
`expat` Ubuntu:22.04:LTS	before 2.4.7-1ubuntu0.1, plus listed versions 2.4.1-22.4.1-32.4.2-12.4.3-12.4.3-22.4.4-12.4.6-12.4.7-1	2.4.7-1ubuntu0.1
`matanza` Ubuntu:22.04:LTS	All versions, plus listed versions 0.13+ds2-1	None known
`tdom` Ubuntu:22.04:LTS	All versions, plus listed versions 0.9.2-1	None known
`thunderbird` Ubuntu:22.04:LTS	All versions, plus listed versions 1:91.1.2+build1-0ubuntu11:91.3.0+build2-0ubuntu11:91.3.1+build1-0ubuntu11:91.3.2+build1-0ubuntu11:91.4.0+build1.1-0ubuntu1 Show 34 moreShow less 1:91.4.0+build2-0ubuntu11:91.5.0+build1-0ubuntu11:91.5.1+build1-0ubuntu11:91.6.1+build1-0ubuntu11:91.7.0+build1-0ubuntu11:91.7.0+build2-0ubuntu11:91.8.0+build2-0ubuntu11:91.9.1+build1-0ubuntu0.22.04.11:91.11.0+build2-0ubuntu0.22.04.11:102.2.2+build1-0ubuntu0.22.04.11:102.4.2+build2-0ubuntu0.22.04.11:102.7.1+build2-0ubuntu0.22.04.11:102.8.0+build2-0ubuntu0.22.04.11:102.9.0+build1-0ubuntu0.22.04.11:102.10.0+build2-0ubuntu0.22.04.11:102.11.0+build1-0ubuntu0.22.04.11:102.13.0+build1-0ubuntu0.22.04.11:102.15.0+build1-0ubuntu0.22.04.11:102.15.1+build1-0ubuntu0.22.04.11:115.3.1+build1-0ubuntu0.22.04.21:115.4.1+build1-0ubuntu0.22.04.11:115.5.0+build1-0ubuntu0.22.04.11:115.6.0+build2-0ubuntu0.22.04.11:115.8.1+build1-0ubuntu0.22.04.11:115.9.0+build1-0ubuntu0.22.04.11:115.10.1+build1-0ubuntu0.22.04.11:115.11.0+build2-0ubuntu0.22.04.11:115.12.0+build3-0ubuntu0.22.04.11:115.13.0+build5-0ubuntu0.22.04.11:115.15.0+build1-0ubuntu0.22.04.11:115.16.0+build2-0ubuntu0.22.04.11:115.18.0+build1-0ubuntu0.22.04.11:128.12.0+build1-0ubuntu0.22.04.11:140.7.1+build1-0ubuntu0.22.04.1	None known
`wbxml2` Ubuntu:22.04:LTS	All versions, plus listed versions 0.10.7-1build10.11.7+dfsg-1	None known
`swish-e` Ubuntu:Pro:22.04:LTS	All versions, plus listed versions 2.4.7-6build32.4.7-6.12.4.7-6.1build12.4.7-6.1ubuntu0.1~esm1	None known
`xmlrpc-c` Ubuntu:Pro:22.04:LTS	All versions, plus listed versions 1.33.14-91.33.14-101.33.14-10ubuntu0.1~esm1	None known
`cadaver` Ubuntu:24.04:LTS	All versions, plus listed versions 0.24+dfsg-20.24+dfsg-30.24+dfsg-3build10.24+dfsg-3build2	None known
`coin3` Ubuntu:24.04:LTS	All versions, plus listed versions 4.0.0+ds-54.0.2+ds-14.0.2+ds-1.1ubuntu14.0.2+ds-1.1ubuntu2	None known
`matanza` Ubuntu:24.04:LTS	All versions, plus listed versions 0.13+ds2-10.13+ds2-1build10.13+ds2-1build2	None known
`tdom` Ubuntu:24.04:LTS	All versions, plus listed versions 0.9.3-10.9.3-1build1	None known
`thunderbird` Ubuntu:24.04:LTS	All versions, plus listed versions 1:115.3.1+build1-0ubuntu11:115.4.1+build1-0ubuntu11:115.4.3+build1-0ubuntu11:115.5.0+build1-0ubuntu11:115.5.1+build1-0ubuntu1 Show 9 moreShow less 1:115.5.2+build2-0ubuntu11:115.6.0+build1-0ubuntu11:115.6.0+build2-0ubuntu11:115.6.1+build1-0ubuntu11:115.8.0+build1-0ubuntu11:115.8.1+build1+snap21:115.8.1+build1+snap32:1snap1-0ubuntu12:1snap1-0ubuntu3	None known
`wbxml2` Ubuntu:24.04:LTS	All versions, plus listed versions 0.11.8+dfsg-30.11.8+dfsg-3build1	None known
`swish-e` Ubuntu:Pro:24.04:LTS	All versions, plus listed versions 2.4.7-6.22.4.7-6.2build12.4.7-6.2build22.4.7-6.2build32.4.7-6.2ubuntu0.1~esm1	None known
`xmlrpc-c` Ubuntu:Pro:24.04:LTS	All versions, plus listed versions 1.33.14-111.33.14-11.11.33.14-121.33.14-12build11.33.14-12build21.33.14-12ubuntu0.1~esm1	None known
`cadaver` Ubuntu:25.10	All versions, plus listed versions 0.26+dfsg-2	None known
`coin3` Ubuntu:25.10	All versions, plus listed versions 4.0.3+ds-2	None known
`matanza` Ubuntu:25.10	All versions, plus listed versions 0.13+ds2-2	None known
`swish-e` Ubuntu:25.10	All versions, plus listed versions 2.4.7-6.32.4.7-6.3build12.4.7-7	None known
`tdom` Ubuntu:25.10	All versions, plus listed versions 0.9.5.1-20.9.5.1-3	None known
`thunderbird` Ubuntu:25.10	All versions, plus listed versions 2:1snap1-0ubuntu3	None known
`wbxml2` Ubuntu:25.10	All versions, plus listed versions 0.11.10+dfsg-2	None known
`xmlrpc-c` Ubuntu:25.10	All versions, plus listed versions 1.59.03-71.59.03-91.59.03-101.59.03-10.1	None known
`cadaver` Ubuntu:26.10	All versions, plus listed versions 0.28+dfsg-2	None known
`coin3` Ubuntu:26.10	All versions, plus listed versions 4.0.6+ds-14.0.7+ds-1	None known
`matanza` Ubuntu:26.10	All versions, plus listed versions 0.13+ds2-2build1	None known
`swish-e` Ubuntu:26.10	All versions, plus listed versions 2.4.7-7.12.4.7-7.22.4.7-7.2build1	None known
`tdom` Ubuntu:26.10	All versions, plus listed versions 0.9.6-20.9.6-3	None known
`thunderbird` Ubuntu:26.10	All versions, plus listed versions 2:1snap1-0ubuntu5	None known
`wbxml2` Ubuntu:26.10	All versions, plus listed versions 0.11.10+dfsg-30.11.10+dfsg-4	None known
`xmlrpc-c` Ubuntu:26.10	All versions, plus listed versions 1.60.05-11.60.05-1build1	None known
`cadaver` Ubuntu:26.04:LTS	All versions, plus listed versions 0.26+dfsg-20.28+dfsg-10.28+dfsg-2	None known
`coin3` Ubuntu:26.04:LTS	All versions, plus listed versions 4.0.3+ds-24.0.6+ds-1	None known
`matanza` Ubuntu:26.04:LTS	All versions, plus listed versions 0.13+ds2-20.13+ds2-2build1	None known
`tdom` Ubuntu:26.04:LTS	All versions, plus listed versions 0.9.5.1-30.9.6-2	None known
`thunderbird` Ubuntu:26.04:LTS	All versions, plus listed versions 2:1snap1-0ubuntu32:1snap1-0ubuntu42:1snap1-0ubuntu5	None known
`wbxml2` Ubuntu:26.04:LTS	All versions, plus listed versions 0.11.10+dfsg-20.11.10+dfsg-2build10.11.10+dfsg-3	None known
`xmlrpc-c` Ubuntu:26.04:LTS	All versions, plus listed versions 1.59.03-10.11.60.05-1	None known
`swish-e` Ubuntu:Pro:26.04:LTS	All versions, plus listed versions 2.4.7-72.4.7-7.12.4.7-7.1ubuntu0.1~esm1	None known
`expat` openSUSE:Tumbleweed	before 2.4.9-1.1	2.4.9-1.1
`MozillaFirefox` openSUSE:Tumbleweed	before 107.0-1.1	107.0-1.1
`firefox-esr` openSUSE:Tumbleweed	before 128.5.1-1.1	128.5.1-1.1

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-40674 is a high vulnerability (CVSS 8.1) in Libexpat Project Libexpat, published September 14, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.25%, the 82nd percentile. Fixed in expat 2.2.10-r7.

References

Show 194 moreShow less

This page doesn't list everything

Left out here: 68 versions and 1,816 references. The JSON record has them. Left out on purpose, here and in the API, to keep responses small: 14 source records.