{"id":"CVE-2026-25210","aliases":["ALPINE-CVE-2026-25210","AZL-75815","AZL-76340","BELL-CVE-2026-25210","CLSA-2026-1773924425","CLSA-2026-1773924658","CLSA-2026-1773925534","CLSA-2026-1773926416","CLSA-2026-1773927217","CLSA-2026-1773928179","CLSA-2026-1773928447","CLSA-2026-1773930526","CLSA-2026-1773930717","CLSA-2026-1774006814","CLSA-2026-1774009875","CLSA-2026-1774021165","CLSA-2026-1774021417","CLSA-2026-1774283473","DEBIAN-CVE-2026-25210","EUVD-2026-5042","GHSA-857q-6v86-xp84","JLSEC-2026-380","MGASA-2026-0031","OESA-2026-1295","OESA-2026-1296","OESA-2026-1297","OESA-2026-1298","OESA-2026-1378","OESA-2026-1379","ROOT-OS-DEBIAN-11-CVE-2026-25210","ROOT-OS-DEBIAN-12-CVE-2026-25210","ROOT-OS-DEBIAN-13-CVE-2026-25210","SUSE-SU-2026:0386-1","SUSE-SU-2026:0646-1","SUSE-SU-2026:0647-1","SUSE-SU-2026:0826-1","SUSE-SU-2026:20350-1","SUSE-SU-2026:20481-1","SUSE-SU-2026:20627-1","SUSE-SU-2026:20642-1","SUSE-SU-2026:24323-1","SUSE-SU-2026:24554-1","SUSE-SU-2026:4615-1","SUSE-SU-2026:4619-1","SUSE-SU-2026:4623-1","UBUNTU-CVE-2026-25210","USN-8022-2","openSUSE-SU-2026:10144-1","openSUSE-SU-2026:20306-1"],"status":"published","title":"In libexpat before 2.7.4, the doContent function does not properly determine the buffer size...","description":"In libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize because there is no integer overflow check for tag buffer reallocation.","severity":{"version":"3.1","score":6.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00211,"percentile":0.11411,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-190"],"published":"2026-01-30T06:40:27Z","modified":"2026-11-11T02:48:55Z","fixes":[{"ecosystem":"Alpine:v3.20","package":"expat","fixed_in":["2.7.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"expat","fixed_in":["2.7.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"expat","fixed_in":["2.7.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"expat","fixed_in":["2.7.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"expat","fixed_in":["2.7.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"qt6-qtwebengine","fixed_in":["6.11.1-r2"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"expat","fixed_in":["2.6.4-4"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"expat","fixed_in":["2.6.4-4"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"expat","fixed_in":["2.7.4-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"expat","fixed_in":["2.7.4-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"expat","fixed_in":["2.7.4-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:23","package":"expat","fixed_in":["2.7.4-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:25","package":"expat","fixed_in":["2.7.4-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"expat","fixed_in":["2.7.4-r0"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"expat","fixed_in":["2.1.0-15.0.1.el7_9.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"expat-devel","fixed_in":["2.1.0-15.0.1.el7_9.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"expat-static","fixed_in":["2.1.0-15.0.1.el7_9.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:RHEL:7","package":"expat","fixed_in":["2.1.0-15.0.1.el7_9.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:RHEL:7","package":"expat-devel","fixed_in":["2.1.0-15.0.1.el7_9.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:RHEL:7","package":"expat-static","fixed_in":["2.1.0-15.0.1.el7_9.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"expat","fixed_in":["2.1.0-15.0.1.el7_9.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"expat-devel","fixed_in":["2.1.0-15.0.1.el7_9.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"expat-static","fixed_in":["2.1.0-15.0.1.el7_9.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"expat","fixed_in":["2.5.0-1.el8.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"expat-devel","fixed_in":["2.5.0-1.el8.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"expat-static","fixed_in":["2.5.0-1.el8.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"expat","fixed_in":["2.5.0-1.el8.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"expat-devel","fixed_in":["2.5.0-1.el8.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"expat-static","fixed_in":["2.5.0-1.el8.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"expat","fixed_in":["2.5.0-5.el9_6.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"expat-devel","fixed_in":["2.5.0-5.el9_6.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"expat-static","fixed_in":["2.5.0-5.el9_6.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"expat","fixed_in":["2.5.0-1.el8.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"expat-devel","fixed_in":["2.5.0-1.el8.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"expat-static","fixed_in":["2.5.0-1.el8.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"expat","fixed_in":["2.1.0-7ubuntu0.16.04.5+tuxcare.els8"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"libexpat1","fixed_in":["2.1.0-7ubuntu0.16.04.5+tuxcare.els8"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"libexpat1-dev","fixed_in":["2.1.0-7ubuntu0.16.04.5+tuxcare.els8"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"expat","fixed_in":["2.2.5-3ubuntu0.9+tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libexpat1","fixed_in":["2.2.5-3ubuntu0.9+tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libexpat1-dev","fixed_in":["2.2.5-3ubuntu0.9+tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"expat","fixed_in":["2.5.0-1.el9.tuxcare.els8"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"expat-devel","fixed_in":["2.5.0-1.el9.tuxcare.els8"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"expat-static","fixed_in":["2.5.0-1.el9.tuxcare.els8"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:20.04","package":"expat","fixed_in":["2.2.9-1ubuntu0.8+tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:20.04","package":"libexpat1","fixed_in":["2.2.9-1ubuntu0.8+tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:20.04","package":"libexpat1-dev","fixed_in":["2.2.9-1ubuntu0.8+tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"expat","fixed_in":["2.0.1-13.el6_8.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"expat-devel","fixed_in":["2.0.1-13.el6_8.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"expat","fixed_in":["2.0.1-13.el6_8.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"expat-devel","fixed_in":["2.0.1-13.el6_8.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"expat","fixed_in":["2.2.6-2+deb10u7+tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"libexpat1","fixed_in":["2.2.6-2+deb10u7+tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"libexpat1-dev","fixed_in":["2.2.6-2+deb10u7+tuxcare.els3"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"expat","fixed_in":["2.5.0-1+deb12u4"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"expat","fixed_in":["2.8.2-1~deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"expat","fixed_in":["2.7.4-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"Expat_jll","fixed_in":["2.7.5+0"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"expat","fixed_in":["2.5.0-15.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"expat","fixed_in":["2.2.9-21.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"expat","fixed_in":["2.5.0-15.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP2","package":"expat","fixed_in":["2.5.0-15.oe2403sp2"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"expat","fixed_in":["2.2.10-2+deb11u7.root.io.14","2.2.10-2+deb11u7.aikido.17","2.2.10-2+deb11u7.root.io.8","2.2.10-2+deb11u7.root.io.15","2.2.10-2+deb11u7.aikido.19","2.2.10-2+deb11u7.root.io.11","2.2.10-2+deb11u7.root.io.10","2.2.10-2+deb11u7.aikido.18","2.2.10-2+deb11u7.root.io.7","2.2.10-2+deb11u7.root.io.12","2.2.10-2+deb11u7.aikido.20","2.2.10-2+deb11u7.root.io.9","2.2.10-2+deb11u7.root.io.16","2.2.10-2+deb11u7.root.io.13"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"rootio-expat","fixed_in":["2.2.10-2+deb11u7.root.io.14","2.2.10-2+deb11u7.aikido.17","2.2.10-2+deb11u7.root.io.8","2.2.10-2+deb11u7.root.io.15","2.2.10-2+deb11u7.aikido.19","2.2.10-2+deb11u7.root.io.11","2.2.10-2+deb11u7.root.io.10","2.2.10-2+deb11u7.aikido.18","2.2.10-2+deb11u7.root.io.7","2.2.10-2+deb11u7.root.io.12","2.2.10-2+deb11u7.aikido.20","2.2.10-2+deb11u7.root.io.9","2.2.10-2+deb11u7.root.io.16","2.2.10-2+deb11u7.root.io.13"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"expat","fixed_in":["2.1.0-4ubuntu1.4+esm11"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"expat","fixed_in":["2.1.0-7ubuntu0.16.04.5+esm11"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libxmltok","fixed_in":["1.2-3ubuntu0.16.04.1~esm5"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"expat","fixed_in":["2.2.5-3ubuntu0.9+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libxmltok","fixed_in":["1.2-4ubuntu0.18.04.1~esm6"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"expat","fixed_in":["2.2.9-1ubuntu0.8+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libxmltok","fixed_in":["1.2-4ubuntu0.20.04.1~esm6"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"expat","fixed_in":["2.4.7-1ubuntu0.7"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"libxmltok","fixed_in":["1.2-4ubuntu0.22.04.1~esm6"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"expat","fixed_in":["2.6.1-2ubuntu0.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"libxmltok","fixed_in":["1.2-4.1ubuntu2.24.0.4.1+esm4"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"expat","fixed_in":["2.7.1-2ubuntu0.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.20","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"qt6-qtwebengine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.11.1-r2"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.4-4"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.4-4"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.0-r0"},{"fixed":"2.7.4-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.1-r0"},{"fixed":"2.7.4-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.9-r0"},{"fixed":"2.7.4-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:23","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.0-r0"},{"fixed":"2.7.4-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:25","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.1-r0"},{"fixed":"2.7.4-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.9-r0"},{"fixed":"2.7.4-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-15.0.1.el7_9.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-15.0.1.el7_9.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"expat-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-15.0.1.el7_9.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-15.0.1.el7_9.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-15.0.1.el7_9.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"expat-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-15.0.1.el7_9.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-15.0.1.el7_9.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-15.0.1.el7_9.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"expat-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-15.0.1.el7_9.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-1.el8.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-1.el8.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"expat-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-1.el8.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-1.el8.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-1.el8.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"expat-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-1.el8.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-5.el9_6.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-5.el9_6.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"expat-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-5.el9_6.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-1.el8.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-1.el8.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"expat-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-1.el8.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-7ubuntu0.16.04.5+tuxcare.els8"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libexpat1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-7ubuntu0.16.04.5+tuxcare.els8"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libexpat1-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-7ubuntu0.16.04.5+tuxcare.els8"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3ubuntu0.9+tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libexpat1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3ubuntu0.9+tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libexpat1-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3ubuntu0.9+tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-1.el9.tuxcare.els8"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-1.el9.tuxcare.els8"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"expat-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-1.el9.tuxcare.els8"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.9-1ubuntu0.8+tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"libexpat1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.9-1ubuntu0.8+tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"libexpat1-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.9-1ubuntu0.8+tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.1-13.el6_8.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.1-13.el6_8.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.1-13.el6_8.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.1-13.el6_8.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.6-2+deb10u7+tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libexpat1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.6-2+deb10u7+tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libexpat1-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.6-2+deb10u7+tuxcare.els3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-1+deb12u4"}]}],"versions":["2.5.0-1","2.5.0-1+deb12u1","2.5.0-1+deb12u2","2.5.0-1+deb12u3"]},{"source":"osv","ecosystem":"Debian:13","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.2-1~deb13u1"}]}],"versions":["2.7.1-2","2.7.2-1","2.7.3-1","2.7.3-2","2.7.4-1","2.7.5-1","2.8.0-1","2.8.0-2","2.8.1-1"]},{"source":"osv","ecosystem":"Debian:14","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.4-1"}]}],"versions":["2.7.1-2","2.7.2-1","2.7.3-1","2.7.3-2"]},{"source":"osv","ecosystem":"Julia","package":"Expat_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.7.5+0"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.4-1.mga9"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-15.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.9-21.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-15.oe2403"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-15.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-15.oe2403sp2"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.1-21.oe2203sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"Root:Debian:11","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.10-2+deb11u7.root.io.14"},{"fixed":"2.2.10-2+deb11u7.aikido.17"},{"fixed":"2.2.10-2+deb11u7.root.io.8"},{"fixed":"2.2.10-2+deb11u7.root.io.15"},{"fixed":"2.2.10-2+deb11u7.aikido.19"},{"fixed":"2.2.10-2+deb11u7.root.io.11"},{"fixed":"2.2.10-2+deb11u7.root.io.10"},{"fixed":"2.2.10-2+deb11u7.aikido.18"},{"fixed":"2.2.10-2+deb11u7.root.io.7"},{"fixed":"2.2.10-2+deb11u7.root.io.12"},{"fixed":"2.2.10-2+deb11u7.aikido.20"},{"fixed":"2.2.10-2+deb11u7.root.io.9"},{"fixed":"2.2.10-2+deb11u7.root.io.16"},{"fixed":"2.2.10-2+deb11u7.root.io.13"}]}]},{"source":"osv","ecosystem":"Root:Debian:11","package":"rootio-expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.10-2+deb11u7.root.io.14"},{"fixed":"2.2.10-2+deb11u7.aikido.17"},{"fixed":"2.2.10-2+deb11u7.root.io.8"},{"fixed":"2.2.10-2+deb11u7.root.io.15"},{"fixed":"2.2.10-2+deb11u7.aikido.19"},{"fixed":"2.2.10-2+deb11u7.root.io.11"},{"fixed":"2.2.10-2+deb11u7.root.io.10"},{"fixed":"2.2.10-2+deb11u7.aikido.18"},{"fixed":"2.2.10-2+deb11u7.root.io.7"},{"fixed":"2.2.10-2+deb11u7.root.io.12"},{"fixed":"2.2.10-2+deb11u7.aikido.20"},{"fixed":"2.2.10-2+deb11u7.root.io.9"},{"fixed":"2.2.10-2+deb11u7.root.io.16"},{"fixed":"2.2.10-2+deb11u7.root.io.13"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.1-150000.3.42.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.1-150700.3.9.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.1-21.49.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.1-150400.3.34.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.1-150400.3.34.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.1-150400.3.34.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.1-150400.3.34.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.1-4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.1-slfo.1.1_4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.1-160000.4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.1-160000.4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.1-160000.4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-159998.1.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-slfo.1.1_1.1"}]}],"bundled":29},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-21.55.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-21.55.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-150700.3.15.1"}]}],"bundled":29},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-150400.3.40.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-150400.3.40.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-150400.3.40.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-150400.3.40.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-150400.3.40.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-150400.3.40.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-150400.3.40.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-150400.3.40.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-150400.3.40.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-150400.3.40.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-150400.3.40.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-150400.3.40.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-150400.3.40.1"}]}],"bundled":34},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"coin3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.4~abc9f50-3","3.1.4~abc9f50-4","3.1.4~abc9f50-4ubuntu2","3.1.4~abc9f50-4ubuntu2+esm1","3.1.4~abc9f50-4ubuntu2+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-4ubuntu1.4+esm11"}]}],"versions":["2.1.0-4","2.1.0-4ubuntu1","2.1.0-4ubuntu1.1","2.1.0-4ubuntu1.2","2.1.0-4ubuntu1.3","2.1.0-4ubuntu1.4","2.1.0-4ubuntu1.4+esm1","2.1.0-4ubuntu1.4+esm2","2.1.0-4ubuntu1.4+esm4","2.1.0-4ubuntu1.4+esm6","2.1.0-4ubuntu1.4+esm7","2.1.0-4ubuntu1.4+esm8","2.1.0-4ubuntu1.4+esm9","2.1.0-4ubuntu1.4+esm10"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"vnc4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.1.1+xorg4.3.0-37ubuntu5","4.1.1+xorg4.3.0-37ubuntu5.0.1","4.1.1+xorg4.3.0-37ubuntu5.0.2","4.1.1+xorg4.3.0-37ubuntu5.0.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"vtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-14ubuntu1","5.8.0-14ubuntu3","5.8.0-14.1ubuntu2","5.8.0-14.1ubuntu3","5.8.0-14.1ubuntu3+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.16.33-3.2ubuntu3","1.33.06-0ubuntu1","1.33.06-0ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-7ubuntu0.16.04.5+esm11"}]}],"versions":["2.1.0-7","2.1.0-7ubuntu0.16.04.1","2.1.0-7ubuntu0.16.04.2","2.1.0-7ubuntu0.16.04.3","2.1.0-7ubuntu0.16.04.4","2.1.0-7ubuntu0.16.04.5","2.1.0-7ubuntu0.16.04.5+esm2","2.1.0-7ubuntu0.16.04.5+esm5","2.1.0-7ubuntu0.16.04.5+esm6","2.1.0-7ubuntu0.16.04.5+esm7","2.1.0-7ubuntu0.16.04.5+esm8","2.1.0-7ubuntu0.16.04.5+esm9","2.1.0-7ubuntu0.16.04.5+esm10"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libxmltok","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2-3ubuntu0.16.04.1~esm5"}]}],"versions":["1.2-3build3","1.2-3ubuntu0.16.04.1~esm1","1.2-3ubuntu0.16.04.1~esm2","1.2-3ubuntu0.16.04.1~esm3","1.2-3ubuntu0.16.04.1~esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"ayttm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.6.3-3build1","0.6.3-3ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"cableswig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.1.0+git20150808-1","0.1.0+git20150808-2","0.1.0+git20150808-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.23.3-2ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"coin3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.4~abc9f50+dfsg1-1","3.1.4~abc9f50+dfsg1-1ubuntu0.1~esm1","3.1.4~abc9f50+dfsg1-1ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"gdcm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.4-4","2.4.4-4build1","2.4.4-4ubuntu1","2.6.1-3","2.6.2-1","2.6.2-2","2.6.2-3","2.6.3-1","2.6.3-1ubuntu1","2.6.3-2ubuntu1","2.6.3-3ubuntu1","2.6.3-3ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"insighttoolkit4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.8.1-1ubuntu3","4.8.1-1ubuntu4","4.8.2-3.1ubuntu1","4.9.0-3ubuntu2","4.9.0-4ubuntu1","4.9.0-4ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds1-5"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"smart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-4","2.4.7-4build1","2.4.7-4ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"tdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.8.3-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"vnc4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.1.1+xorg4.3.0-37.3ubuntu2","4.1.1+xorg4.3.0-37.3ubuntu2.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"vtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.10.1+dfsg-2","5.10.1+dfsg-2build3","5.10.1+dfsg-2.1build1","5.10.1+dfsg-2.1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"wbxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.7-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.33.14-0.2ubuntu3","1.33.14-1ubuntu1","1.33.14-1ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3ubuntu0.9+esm3"}]}],"versions":["2.2.3-1","2.2.3-2","2.2.5-0ubuntu2","2.2.5-3","2.2.5-3ubuntu0.1","2.2.5-3ubuntu0.2","2.2.5-3ubuntu0.4","2.2.5-3ubuntu0.7","2.2.5-3ubuntu0.8","2.2.5-3ubuntu0.9","2.2.5-3ubuntu0.9+esm1","2.2.5-3ubuntu0.9+esm2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.23.3-2ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"coin3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.4~abc9f50+dfsg1-2","3.1.4~abc9f50+dfsg2-1","3.1.4~abc9f50+dfsg3-1","3.1.4~abc9f50+dfsg3-2","3.1.4~abc9f50+dfsg3-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"gdcm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.8.2-3build1","2.8.3-1","2.8.4-1","2.8.4-1build2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"insighttoolkit4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.12.2-dfsg1-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libxmltok","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2-4ubuntu0.18.04.1~esm6"}]}],"versions":["1.2-4","1.2-4ubuntu0.18.04.1~esm1","1.2-4ubuntu0.18.04.1~esm2","1.2-4ubuntu0.18.04.1~esm3","1.2-4ubuntu0.18.04.1~esm4","1.2-4ubuntu0.18.04.1~esm5"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds1-5build1","0.13+ds1-6"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"smart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-5ubuntu1","2.4.7-5ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"tdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.8.3-1","0.9.0-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"vnc4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.1.1+xorg4.3.0-37.3ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"wbxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.7-1","0.10.7-1build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.33.14-7","1.33.14-8","1.33.14-8build1","1.33.14-8ubuntu0.18.04.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.9-1ubuntu0.8+esm1"}]}],"versions":["2.2.7-2","2.2.9-1","2.2.9-1build1","2.2.9-1ubuntu0.2","2.2.9-1ubuntu0.4","2.2.9-1ubuntu0.5","2.2.9-1ubuntu0.6","2.2.9-1ubuntu0.7","2.2.9-1ubuntu0.8"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.23.3-2.1build1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"insighttoolkit4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.12.2-dfsg1-4.1ubuntu1","4.13.2-dfsg1-1ubuntu1","4.13.2-dfsg1-4ubuntu1","4.13.2-dfsg1-6","4.13.2-dfsg1-6ubuntu1","4.13.2-dfsg1-8"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libxmltok","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2-4ubuntu0.20.04.1~esm6"}]}],"versions":["1.2-4","1.2-4ubuntu0.20.04.1~esm1","1.2-4ubuntu0.20.04.1~esm2","1.2-4ubuntu0.20.04.1~esm3","1.2-4ubuntu0.20.04.1~esm4","1.2-4ubuntu0.20.04.1~esm5"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds1-6","0.13+ds2-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-6build1","2.4.7-6build2","2.4.7-6ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"tdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.1-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"wbxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.7-1build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.33.14-8build1","1.33.14-8build2","1.33.14-8ubuntu0.20.04.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.23.3-2.1build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.7-1ubuntu0.7"}]}],"versions":["2.4.1-2","2.4.1-3","2.4.2-1","2.4.3-1","2.4.3-2","2.4.4-1","2.4.6-1","2.4.7-1","2.4.7-1ubuntu0.1","2.4.7-1ubuntu0.2","2.4.7-1ubuntu0.3","2.4.7-1ubuntu0.4","2.4.7-1ubuntu0.5","2.4.7-1ubuntu0.6"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"insighttoolkit4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.13.3withdata-dfsg1-4.1","4.13.3withdata-dfsg2-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds2-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"tdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.2-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"wbxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.7-1build1","0.11.7+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"libxmltok","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2-4ubuntu0.22.04.1~esm6"}]}],"versions":["1.2-4","1.2-4ubuntu0.22.04.1~esm1","1.2-4ubuntu0.22.04.1~esm2","1.2-4ubuntu0.22.04.1~esm3","1.2-4ubuntu0.22.04.1~esm4","1.2-4ubuntu0.22.04.1~esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-6build3","2.4.7-6.1","2.4.7-6.1build1","2.4.7-6.1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.33.14-9","1.33.14-10","1.33.14-10ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.24+dfsg-2","0.24+dfsg-3","0.24+dfsg-3build1","0.24+dfsg-3build2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1-2ubuntu0.4"}]}],"versions":["2.5.0-2","2.6.0-1","2.6.1-2","2.6.1-2build1","2.6.1-2ubuntu0.1","2.6.1-2ubuntu0.2","2.6.1-2ubuntu0.3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds2-1","0.13+ds2-1build1","0.13+ds2-1build2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"tdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.3-1","0.9.3-1build1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"wbxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.8+dfsg-3","0.11.8+dfsg-3build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"libxmltok","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2-4.1ubuntu2.24.0.4.1+esm4"}]}],"versions":["1.2-4ubuntu1","1.2-4.1ubuntu1","1.2-4.1ubuntu2","1.2-4.1ubuntu2.24.0.4.1+esm1","1.2-4.1ubuntu2.24.0.4.1+esm2","1.2-4.1ubuntu2.24.0.4.1+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-6.2","2.4.7-6.2build1","2.4.7-6.2build2","2.4.7-6.2build3","2.4.7-6.2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.33.14-11","1.33.14-11.1","1.33.14-12","1.33.14-12build1","1.33.14-12build2","1.33.14-12ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.26+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.1-2ubuntu0.2"}]}],"versions":["2.7.1-1","2.7.1-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds2-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-6.3","2.4.7-6.3build1","2.4.7-7"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"tdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.5.1-2","0.9.5.1-3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"wbxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.10+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.59.03-7","1.59.03-9","1.59.03-10","1.59.03-10.1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.28+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds2-2build1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-7.1","2.4.7-7.2","2.4.7-7.2build1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"tdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.6-2","0.9.6-3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"wbxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.10+dfsg-3","0.11.10+dfsg-4"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.60.05-1","1.60.05-1build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.26+dfsg-2","0.28+dfsg-1","0.28+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds2-2","0.13+ds2-2build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"tdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.5.1-3","0.9.6-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"wbxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.10+dfsg-2","0.11.10+dfsg-2build1","0.11.10+dfsg-3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.59.03-10.1","1.60.05-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-7","2.4.7-7.1","2.4.7-7.1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1-2ubuntu0.4"}]}],"versions":["2.5.0-2","2.6.0-1","2.6.1-2","2.6.1-2build1","2.6.1-2ubuntu0.1","2.6.1-2ubuntu0.2","2.6.1-2ubuntu0.3"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.4-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.1-160000.4.1"}]}],"bundled":2}],"products":[{"vendor":"libexpat project","product":"libexpat"},{"vendor":"libexpat_project","product":"libexpat"},{"vendor":"siemens","product":"ruggedcom rst2428p (6gk6242-6pa00)"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0)"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ac0)"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518f-4 pn/dp mfp (6es7518-4fx00-1ab0)"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518f-4 pn/dp mfp (6es7518-4fx00-1ac0)"},{"vendor":"siemens","product":"siplus s7-1500 cpu 1518-4 pn/dp mfp (6ag1518-4ax00-4ac0)"}],"references":[{"url":"https://github.com/libexpat/libexpat/pull/1075","tags":["Issue Tracking","Patch","fix","web"]},{"url":"https://github.com/libexpat/libexpat/pull/1075/commits/9c2d990389e6abe2e44527eeaa8b39f16fe859c7","tags":["Patch","web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-253495.html","tags":["web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25210","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-857q-6v86-xp84"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-25210","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-25210","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/oraclelinux7els/CLSA-2026-1773924425.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/rhel7els/CLSA-2026-1773924658.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos7els/CLSA-2026-1773925534.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos8.4els/CLSA-2026-1773926416.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos8.5els/CLSA-2026-1773927217.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1773928179.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos-stream8els/CLSA-2026-1773928447.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu16.04els/CLSA-2026-1773930526.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2026-1773930717.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1774006814.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu20.04els/CLSA-2026-1774009875.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos6els/CLSA-2026-1774021165.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/oraclelinux6els/CLSA-2026-1774021417.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/debian10els/CLSA-2026-1774283473.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25210.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-25210","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0031.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35089","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/01/31/1","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1295","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1296","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1297","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24515","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1298","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1378","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1379","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260386-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1257144","tags":["report"]},{"url":"https://bugzilla.suse.com/1257496","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24515","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25210","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260646-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260647-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260826-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620350-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620481-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620627-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620642-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624323-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1249584","tags":["report"]},{"url":"https://bugzilla.suse.com/1259711","tags":["report"]},{"url":"https://bugzilla.suse.com/1259726","tags":["report"]},{"url":"https://bugzilla.suse.com/1259729","tags":["report"]},{"url":"https://bugzilla.suse.com/1262263","tags":["report"]},{"url":"https://bugzilla.suse.com/1264713","tags":["report"]},{"url":"https://bugzilla.suse.com/1267631","tags":["report"]},{"url":"https://bugzilla.suse.com/1268572","tags":["report"]},{"url":"https://bugzilla.suse.com/1268573","tags":["report"]},{"url":"https://bugzilla.suse.com/1275115","tags":["report"]},{"url":"https://bugzilla.suse.com/1275594","tags":["report"]},{"url":"https://bugzilla.suse.com/1275732","tags":["report"]},{"url":"https://bugzilla.suse.com/1275859","tags":["report"]},{"url":"https://bugzilla.suse.com/1275860","tags":["report"]},{"url":"https://bugzilla.suse.com/1275915","tags":["report"]},{"url":"https://bugzilla.suse.com/1282347","tags":["report"]},{"url":"https://bugzilla.suse.com/1283493","tags":["report"]},{"url":"https://bugzilla.suse.com/1284334","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0718","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9063","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-43680","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52425","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-8176","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59375","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-102633","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32776","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32777","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32778","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41080","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45186","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50219","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56131","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56132","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56403","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56404","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56405","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56406","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56407","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56408","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56409","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56410","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56411","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56412","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-66046","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72522","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-76641","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-76956","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-76957","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-77214","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93990","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624554-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264615-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264619-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264623-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-25210","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-25210","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8022-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8023-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8022-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-24515","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-25210","description":"In libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize because there is no integer overflow check for tag buffer reallocation.","status":"published","published":"2026-01-30T06:40:27.917Z","modified":"2026-11-10T12:43:42.995Z","cvss":[{"version":"3.1","score":6.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-190"],"updated_at":"2026-11-10T13:38:44.039016Z"}],"euvd":[{"id":"EUVD-2026-5042","description":"In libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize because there is no integer overflow check for tag buffer reallocation.","status":"published","published":"2026-01-30T06:40:27Z","modified":"2026-11-10T12:43:42Z","cvss":[{"version":"3.1","score":6.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"medium"}],"updated_at":"2026-11-10T14:21:11.138259Z"}],"ghsa":[{"id":"GHSA-857q-6v86-xp84","title":"In libexpat before 2.7.4, the doContent function does not properly determine the buffer size...","description":"In libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize because there is no integer overflow check for tag buffer reallocation.","status":"published","published":"2026-01-30T09:30:55Z","modified":"2026-11-10T15:32:05Z","cvss":[{"version":"3.1","score":6.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"medium"}],"cwes":["CWE-190"],"updated_at":"2026-11-10T15:55:01.006697Z"}],"nvd":[{"id":"CVE-2026-25210","description":"In libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize because there is no integer overflow check for tag buffer reallocation.","status":"published","published":"2026-01-30T07:16:15.57Z","modified":"2026-11-10T13:18:49.48Z","cvss":[{"version":"3.1","score":6.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-190"],"updated_at":"2026-11-10T16:19:45.801381Z"}],"osv":[{"id":"ALPINE-CVE-2026-25210","description":"In libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize because there is no integer overflow check for tag buffer reallocation.","status":"published","published":"2026-01-30T07:16:15.57Z","modified":"2026-11-03T06:32:53.348338726Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T07:16:26.770911Z"},{"id":"BELL-CVE-2026-25210","status":"published","published":"2026-01-31T06:08:10.859584Z","modified":"2026-03-13T18:10:36.62029Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:23.315185Z"},{"id":"CVE-2026-25210","description":"In libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize because there is no integer overflow check for tag buffer reallocation.","status":"published","published":"2026-01-30T06:40:27.917Z","modified":"2026-11-11T02:48:55.252179163Z","cvss":[{"version":"3.1","score":6.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"medium"}],"cwes":["CWE-190"],"updated_at":"2026-11-11T03:21:32.226287Z"},{"id":"DEBIAN-CVE-2026-25210","description":"In libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize because there is no integer overflow check for tag buffer reallocation.","status":"published","published":"2026-01-30T07:16:15.57Z","modified":"2026-10-01T03:03:01.143375347Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:53.877573Z"},{"id":"JLSEC-2026-380","description":"In libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize because there is no integer overflow check for tag buffer reallocation.","status":"published","published":"2026-05-01T17:50:38.295Z","modified":"2026-07-18T00:00:30.974659479Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:47:18.573531Z"},{"id":"OESA-2026-1295","title":"expat security update","description":"expat is a stream-oriented XML parser library written in C. expat excels with files too large to fit RAM, and where performance and flexibility are crucial.\r\n\r\nSecurity Fix(es):\n\nIn libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize because there is no integer overflow check for tag buffer reallocation.(CVE-2026-25210)","status":"published","published":"2026-02-06T11:10:19Z","modified":"2026-08-18T01:19:31.322739092Z","cvss":[{"version":"3.1","score":6.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:45.339366Z"},{"id":"OESA-2026-1296","title":"expat security update","description":"expat is a stream-oriented XML parser library written in C. expat excels with files too large to fit RAM, and where performance and flexibility are crucial.\r\n\r\nSecurity Fix(es):\n\nIn libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize because there is no integer overflow check for tag buffer reallocation.(CVE-2026-25210)","status":"published","published":"2026-02-06T11:10:19Z","modified":"2026-08-18T01:19:31.732784424Z","cvss":[{"version":"3.1","score":6.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:45.339366Z"},{"id":"OESA-2026-1297","title":"expat security update","description":"expat is a stream-oriented XML parser library written in C. expat excels with files too large to fit RAM, and where performance and flexibility are crucial.\r\n\r\nSecurity Fix(es):\n\nIn libexpat before 2.7.4, XML_ExternalEntityParserCreate does not copy unknown encoding handler user data.(CVE-2026-24515)\n\nIn libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize because there is no integer overflow check for tag buffer reallocation.(CVE-2026-25210)","status":"published","published":"2026-02-06T11:10:19Z","modified":"2026-08-18T01:19:31.974517242Z","cvss":[{"version":"3.1","score":6.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:45.339366Z"},{"id":"OESA-2026-1298","title":"expat security update","description":"expat is a stream-oriented XML parser library written in C. expat excels with files too large to fit RAM, and where performance and flexibility are crucial.\r\n\r\nSecurity Fix(es):\n\nIn libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize because there is no integer overflow check for tag buffer reallocation.(CVE-2026-25210)","status":"published","published":"2026-02-06T11:10:19Z","modified":"2026-08-18T01:19:31.993622406Z","cvss":[{"version":"3.1","score":6.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:45.339366Z"},{"id":"OESA-2026-1378","title":"expat security update","description":"expat is a stream-oriented XML parser library written in C. expat excels with files too large to fit RAM, and where performance and flexibility are crucial.\r\n\r\nSecurity Fix(es):\n\nIn libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize because there is no integer overflow check for tag buffer reallocation.(CVE-2026-25210)","status":"published","published":"2026-02-13T11:10:24Z","modified":"2026-08-18T01:19:33.30705837Z","cvss":[{"version":"3.1","score":6.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"OESA-2026-1379","title":"expat security update","description":"expat is a stream-oriented XML parser library written in C. expat excels with files too large to fit RAM, and where performance and flexibility are crucial.\r\n\r\nSecurity Fix(es):\n\nIn libexpat before 2.7.4, XML_ExternalEntityParserCreate does not copy unknown encoding handler user data.(CVE-2026-24515)\n\nIn libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize because there is no integer overflow check for tag buffer reallocation.(CVE-2026-25210)","status":"published","published":"2026-02-13T11:10:24Z","modified":"2026-08-18T01:19:33.392910995Z","cvss":[{"version":"3.1","score":6.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"ROOT-OS-DEBIAN-11-CVE-2026-25210","title":"CVE-2026-25210 in expat - Patched by Root","description":"Root has patched CVE-2026-25210 in the expat package for Root:Debian:11. Multiple fixed versions available.","status":"published","published":"2026-10-19T10:19:12Z","modified":"2026-10-19T11:15:04.337619347Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:29.900552Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2026-25210","title":"CVE-2026-25210 in expat - Patched by Root","description":"Root has patched CVE-2026-25210 in the expat package for Root:Debian:12. Multiple fixed versions available.","status":"withdrawn","published":"2026-09-25T11:40:57Z","modified":"2026-10-06T19:00:05.830064856Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:31.773105Z"},{"id":"ROOT-OS-DEBIAN-13-CVE-2026-25210","title":"CVE-2026-25210 in rootio-expat - Patched by Root","description":"Root has patched CVE-2026-25210 in the rootio-expat package for Root:Debian:13. Multiple fixed versions available.","status":"withdrawn","published":"2026-03-23T09:29:39Z","modified":"2026-09-15T14:00:04.963094182Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:33.415244Z"},{"id":"UBUNTU-CVE-2026-25210","description":"In libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize because there is no integer overflow check for tag buffer reallocation.","status":"published","published":"2026-01-30T07:16:00Z","modified":"2026-10-17T12:59:57.709423207Z","cvss":[{"version":"3.1","score":6.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"medium"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:08.726452Z"},{"id":"AZL-75815","title":"CVE-2026-25210 affecting package expat for versions less than 2.6.4-4","description":"In libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize because there is no integer overflow check for tag buffer reallocation.","status":"published","published":"2026-01-30T07:16:15Z","modified":"2026-06-30T17:29:27Z","updated_at":"2026-11-02T15:28:09.474476Z"},{"id":"AZL-76340","title":"CVE-2026-25210 affecting package expat for versions less than 2.6.4-4","description":"In libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize because there is no integer overflow check for tag buffer reallocation.","status":"published","published":"2026-01-30T07:16:15Z","modified":"2026-04-21T04:39:02.232538Z","updated_at":"2026-11-02T15:28:09.474476Z"},{"id":"CLSA-2026-1773924425","title":"expat: Fix of CVE-2026-25210","description":"- Fix CVE-2026-25210: integer overflow in doContent tag buffer reallocation","status":"published","published":"2026-03-19T12:47:11Z","modified":"2026-06-01T00:33:27.00737292Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1773924658","title":"expat: Fix of CVE-2026-25210","description":"- Fix CVE-2026-25210: integer overflow in doContent tag buffer reallocation","status":"published","published":"2026-03-19T12:51:03Z","modified":"2026-06-01T00:33:28.118268928Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1773925534","title":"expat: Fix of CVE-2026-25210","description":"- Fix CVE-2026-25210: integer overflow in doContent tag buffer reallocation","status":"published","published":"2026-03-23T14:50:55Z","modified":"2026-06-01T00:33:09.541685512Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1773926416","title":"expat: Fix of CVE-2026-25210","description":"- CVE-2026-25210: fix integer overflow in tag buffer reallocation in\n  doContent function","status":"published","published":"2026-03-19T13:20:24Z","modified":"2026-06-01T00:33:21.436087017Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1773927217","title":"expat: Fix of CVE-2026-25210","description":"- CVE-2026-25210: fix integer overflow in tag buffer reallocation in\n  doContent function","status":"published","published":"2026-03-19T13:33:42Z","modified":"2026-06-01T00:33:23.32212131Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1773928179","title":"expat: Fix of CVE-2026-25210","description":"- Fix CVE-2026-25210: integer overflow in doContent tag buffer reallocation","status":"published","published":"2026-03-19T13:49:46Z","modified":"2026-06-01T00:32:43.62829998Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1773928447","title":"expat: Fix of CVE-2026-25210","description":"- CVE-2026-25210: fix integer overflow in tag buffer reallocation in\n  doContent function","status":"published","published":"2026-04-17T17:30:39Z","modified":"2026-06-01T00:33:14.614902922Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1773930526","title":"Fix CVE(s): CVE-2026-25210","description":"   * SECURITY UPDATE: integer overflow in doContent tag buffer reallocation.\n     - debian/patches/CVE-2026-25210.patch: add overflow check for tag\n       buffer reallocation\n     - CVE-2026-25210","status":"published","published":"2026-03-19T14:28:50Z","modified":"2026-06-04T10:03:20.890576Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1773930717","title":"Fix CVE(s): CVE-2026-25210","description":"   * SECURITY UPDATE: integer overflow in doContent tag buffer reallocation.\n     - debian/patches/CVE-2026-25210.patch: add overflow check for tag\n       buffer reallocation\n     - CVE-2026-25210","status":"published","published":"2026-03-19T14:32:01Z","modified":"2026-06-04T10:03:52.05058Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1774006814","title":"expat: Fix of CVE-2026-25210","description":"- CVE-2026-25210: fix integer overflow in tag buffer reallocation in doContent","status":"published","published":"2026-03-20T11:40:18Z","modified":"2026-06-01T00:32:08.86186839Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1774009875","title":"Fix CVE(s): CVE-2026-25210","description":"   * SECURITY UPDATE: integer overflow in doContent tag buffer reallocation.\n     - debian/patches/CVE-2026-25210.patch: add overflow check for tag\n       buffer reallocation\n     - CVE-2026-25210","status":"published","published":"2026-03-20T12:31:20Z","modified":"2026-06-04T10:04:18.51669Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1774021165","title":"expat: Fix of CVE-2026-25210","description":"- CVE-2026-25210: fix memory corruption via integer overflow in doContent\n  function during tag buffer reallocation","status":"published","published":"2026-03-23T14:52:23Z","modified":"2026-06-01T00:33:16.78945638Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1774021417","title":"expat: Fix of CVE-2026-25210","description":"- CVE-2026-25210: fix memory corruption via integer overflow in doContent\n  function during tag buffer reallocation","status":"published","published":"2026-03-20T15:43:42Z","modified":"2026-06-01T00:33:26.217631782Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1774283473","title":"Fix CVE(s): CVE-2026-25210","description":"   * SECURITY UPDATE: Improve determination of buffer size bufSize in\n   function doContent\n     - debian/patches/CVE-2026-25210.patch: fix integer overflow in\n       doContent tag buffer reallocation\n     - CVE-2026-25210","status":"published","published":"2026-03-23T16:31:18Z","modified":"2026-06-04T10:03:28.254839Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"MGASA-2026-0031","title":"Updated expat packages fix security vulnerabilities","description":"In libexpat before 2.7.4, XML_ExternalEntityParserCreate does not copy\nunknown encoding handler user data. (CVE-2026-24515)\nIn libexpat before 2.7.4, the doContent function does not properly\ndetermine the buffer size bufSize because there is no integer overflow\ncheck for tag buffer reallocation. (CVE-2026-25210)\n","status":"published","published":"2026-02-04T18:09:51Z","modified":"2026-04-16T04:41:27.947032714Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2026:10144-1","title":"expat-2.7.4-1.1 on GA media","description":"These are all security issues fixed in the expat-2.7.4-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-02-04T00:00:00Z","modified":"2026-03-23T04:54:30.269171Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:20306-1","title":"Security update for expat","description":"This update for expat fixes the following issues:\n\n- CVE-2026-24515: failure to copy the encoding handler data passed to XML_SetUnknownEncodingHandler may cause a NULL\n  dereference (bsc#1257144).\n- CVE-2026-25210: lack of buffer size check can lead to an integer overflow (bsc#1257496).\n","status":"published","published":"2026-03-03T16:13:34Z","modified":"2026-03-23T04:54:50.555009Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"SUSE-SU-2026:0386-1","title":"Security update for expat","description":"This update for expat fixes the following issues:\n\n- CVE-2026-24515: Fixed a null dereference in XML_ExternalEntityParserCreate. (bsc#1257144)\n- CVE-2026-25210: Fixed an integer overflow in doContent. (bsc#1257496)\n","status":"published","published":"2026-02-05T08:30:37Z","modified":"2026-03-23T04:52:12.578146Z","updated_at":"2026-11-02T15:54:00.846737Z"},{"id":"SUSE-SU-2026:0646-1","title":"Security update for expat","description":"This update for expat fixes the following issues:\n\n- CVE-2026-24515: Fixed a null dereference in XML_ExternalEntityParserCreate. (bsc#1257144)\n- CVE-2026-25210: Fixed an integer overflow in doContent. (bsc#1257496)\n","status":"published","published":"2026-02-25T16:29:24Z","modified":"2026-02-26T16:17:04.532268Z","updated_at":"2026-11-02T15:54:00.846737Z"},{"id":"SUSE-SU-2026:0647-1","title":"Security update for expat","description":"This update for expat fixes the following issues:\n\n- CVE-2026-24515: Fixed a null dereference in XML_ExternalEntityParserCreate. (bsc#1257144)\n- CVE-2026-25210: Fixed an integer overflow in doContent. (bsc#1257496)\n","status":"published","published":"2026-02-25T16:30:09Z","modified":"2026-02-26T16:17:05.672614Z","updated_at":"2026-11-02T15:54:00.846737Z"},{"id":"SUSE-SU-2026:0826-1","title":"Security update for expat","description":"This update for expat fixes the following issues:\n\n- CVE-2026-24515: Fixed a null dereference in XML_ExternalEntityParserCreate. (bsc#1257144)\n- CVE-2026-25210: Fixed an integer overflow in doContent. (bsc#1257496)\n","status":"published","published":"2026-03-05T15:16:40Z","modified":"2026-03-06T15:30:06.122584Z","updated_at":"2026-11-02T15:54:01.262144Z"},{"id":"SUSE-SU-2026:20350-1","title":"Security update for expat","description":"This update for expat fixes the following issues:\n\n- CVE-2026-24515: failure to copy the encoding handler data passed to XML_SetUnknownEncodingHandler may cause a NULL\n  dereference (bsc#1257144).\n- CVE-2026-25210: lack of buffer size check can lead to an integer overflow (bsc#1257496).\n","status":"published","published":"2026-02-13T16:46:23Z","modified":"2026-03-23T04:53:17.916642Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"SUSE-SU-2026:20481-1","title":"Security update for expat","description":"This update for expat fixes the following issues:\n\n- CVE-2026-24515: failure to copy the encoding handler data passed to XML_SetUnknownEncodingHandler may cause a NULL\n  dereference (bsc#1257144).\n- CVE-2026-25210: lack of buffer size check can lead to an integer overflow (bsc#1257496).\n","status":"published","published":"2026-02-17T09:35:30Z","modified":"2026-03-23T04:52:58.963695Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"SUSE-SU-2026:20627-1","title":"Security update for expat","description":"This update for expat fixes the following issues:\n\n- CVE-2026-24515: failure to copy the encoding handler data passed to XML_SetUnknownEncodingHandler may cause a NULL\n  dereference (bsc#1257144).\n- CVE-2026-25210: lack of buffer size check can lead to an integer overflow (bsc#1257496).\n","status":"published","published":"2026-03-03T16:04:58Z","modified":"2026-03-23T04:53:05.590779Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"SUSE-SU-2026:20642-1","title":"Security update for expat","description":"This update for expat fixes the following issues:\n\n- CVE-2026-24515: failure to copy the encoding handler data passed to XML_SetUnknownEncodingHandler may cause a NULL\n  dereference (bsc#1257144).\n- CVE-2026-25210: lack of buffer size check can lead to an integer overflow (bsc#1257496).\n","status":"published","published":"2026-03-03T16:04:58Z","modified":"2026-03-23T04:53:05.882975Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"SUSE-SU-2026:24323-1","title":"Security update for expat","description":"This update for expat fixes the following issues:\n\n- CVE-2025-59375: denial of service (resource consumption) caused by processing malformed small documents (bsc#1249584).\n- CVE-2026-24515: NULL dereference (CWE-476) due to function XML_ExternalEntityParserCreate() failing to copy the\n  encoding handler data passed to XML_SetUnknownEncodingHandler() from the parent to the subparser (bsc#1257144).\n- CVE-2026-25210: lack of buffer size check can lead to an integer overflow (bsc#1257496).\n- CVE-2026-32776: NULL pointer dereference when processing empty external parameter entities inside an entity\n  declaration value (bsc#1259726).\n- CVE-2026-32777: denial of service due to infinite loop in DTD content parsing (bsc#1259711).\n- CVE-2026-32778: NULL pointer dereference in `setContext` on retry after an out-of-memory condition\n  (bsc#1259729).\n- CVE-2026-41080: crafted XML document can cause a denial of service (bsc#1262263).\n- CVE-2026-45186: denial of service via moderately sized crafted XML input (bsc#1264713).\n- CVE-2026-50219: lack of handler call depth tracking for calls to XML_* functions from within handlers in cases of a\n  policy violation (bsc#1267631).\n- CVE-2026-56131: lack of handler call depth tracking for calls to XML_ResumeParser from within\n  handlers in cases of a policy violation (bsc#1268572).\n- CVE-2026-56132: heap-based buffer overflow in doProlog in xmlparse.c (bsc#1268573).\n- CVE-2026-56403,CVE-2026-56404,CVE-2026-56405,CVE-2026-56406,\n  CVE-2026-56407,CVE-2026-56408,CVE-2026-56409,CVE-2026-56410,\n  CVE-2026-56411,CVE-2026-56412: multiple integer overflow vulnerabilities (bsc#1275115).\n- CVE-2026-66046: denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts()\n  function (bsc#1275732).\n- CVE-2026-72522: out-of-bounds read and resultant infinite loop due to low surrogates being treated the same\n  as high surrogates during Unicode processing (bsc#1275594).\n- CVE-2026-76641: out-of-bounds read vulnerability that allows attackers to trigger\n  memory corruption (bsc#1275915).\n- CVE-2026-76956: denial of service via hash flooding attacks (bsc#1275860).\n- CVE-2026-76957: lack of handler call depth tracking with custom encoding callbacks. Thus, a use-\n  after-free can occur (bsc#1275859).\n- CVE-2026-77214: out-of-bounds read due to insufficient checks in `XML_ParseBuffer()` (bsc#1284334).\n- CVE-2026-93990: fails to validate low surrogates following high surrogates in UTF-16 input (bsc#1282347).\n- CVE-2026-102633: Denial of Service via integer overflow in expat_realloc (bsc#1283493).\n\nUpdate to 2.8.5 (jsc#PED-16154):\n\n * Bug fixes:\n * Fix an OOM-related memory leak on a failed overflow check\n * Fix memory alignment for architectures with 128bit pointers\n * Mark XML_SetHashSalt deprecated\n * CMake: only add /source-charset:utf-8 when /utf-8 is not present\n * lib: resolve undefined behavior from overshifting a signed int\n * lib: support read-only hash table lookup with non-zero-terminated\n keys\n * lib: use a C99 bool for ENTITY.open\n * version info bumped from 13:3:12 to 13:4:12\n * fix support for 2+ GiB documents (regression from 2.8.2)\n * reject empty version in the XML declaration\n * fix printf format for AIX\n * CMake|AIX: enable EXPAT_DEV_URANDOM by default\n * version info bumped from 13:2:12 to 13:3:12\n * Existing API function XML_SetHashSalt is now deprecated\n * because of its limitations, and its use should be\n * considered a vulnerability. Please either use the new API\n * function XML_SetHashSalt16Bytes (with known-high-quality\n * entropy input only!) instead, or leave the derivation of\n * a 16-bytes hash salt from high quality entropy to Expat's\n * internal machinery (by *not* calling either of the two\n * XML_SetHashSalt* functions).\n * xmlwf: Fix a memory leak\n * WASI: Fix format specifiers for 32bit WASI SDK\n * Fix alignment of internal allocations for some non-amd64\n architectures (e.g. sparc32); fixes up on the fix to\n CVE-2025-59375 (of Expat 2.7.2)\n * Fix a class of false positives where input should have been\n rejected with error XML_ERROR_ASYNC_ENTITY; regression from\n CVE-2024-8176 (of Expat 2.7.0)\n * Prove and regression-proof absence of integer overflow\n from function expat_realloc\n * Remove \"harmless\" cast that truncated a size_t to unsigned\n * xmlwf: Resolve use of functions XML_GetErrorLineNumber\n and XML_GetErrorColumnNumber\n * CVE-2025-59375 -- Disallow use of disproportional amounts of\n dynamic memory from within an Expat parser\n * xmlwf: Fix (internal) help generator\n * xmlwf: Mention supported environment variables in\n","status":"published","published":"2026-10-17T13:49:25Z","modified":"2026-10-27T17:23:13.622800769Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:24554-1","title":"Security update for expat","description":"This update for expat fixes the following issues:\n\n- CVE-2025-59375: denial of service (resource consumption) caused by processing malformed small documents (bsc#1249584).\n- CVE-2026-24515: NULL dereference (CWE-476) due to function XML_ExternalEntityParserCreate() failing to copy the\n  encoding handler data passed to XML_SetUnknownEncodingHandler() from the parent to the subparser (bsc#1257144).\n- CVE-2026-25210: lack of buffer size check can lead to an integer overflow (bsc#1257496).\n- CVE-2026-32776: NULL pointer dereference when processing empty external parameter entities inside an entity\n  declaration value (bsc#1259726).\n- CVE-2026-32777: denial of service due to infinite loop in DTD content parsing (bsc#1259711).\n- CVE-2026-32778: NULL pointer dereference in `setContext` on retry after an out-of-memory condition\n  (bsc#1259729).\n- CVE-2026-41080: crafted XML document can cause a denial of service (bsc#1262263).\n- CVE-2026-45186: denial of service via moderately sized crafted XML input (bsc#1264713).\n- CVE-2026-50219: lack of handler call depth tracking for calls to XML_* functions from within handlers in cases of a\n  policy violation (bsc#1267631).\n- CVE-2026-56131: lack of handler call depth tracking for calls to XML_ResumeParser from within\n  handlers in cases of a policy violation (bsc#1268572).\n- CVE-2026-56132: heap-based buffer overflow in doProlog in xmlparse.c (bsc#1268573).\n- CVE-2026-56403,CVE-2026-56404,CVE-2026-56405,CVE-2026-56406,\n  CVE-2026-56407,CVE-2026-56408,CVE-2026-56409,CVE-2026-56410,\n  CVE-2026-56411,CVE-2026-56412: multiple integer overflow vulnerabilities (bsc#1275115).\n- CVE-2026-66046: denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts()\n  function (bsc#1275732).\n- CVE-2026-72522: out-of-bounds read and resultant infinite loop due to low surrogates being treated the same\n  as high surrogates during Unicode processing (bsc#1275594).\n- CVE-2026-76641: out-of-bounds read vulnerability that allows attackers to trigger\n  memory corruption (bsc#1275915).\n- CVE-2026-76956: denial of service via hash flooding attacks (bsc#1275860).\n- CVE-2026-76957: lack of handler call depth tracking with custom encoding callbacks. Thus, a use-\n  after-free can occur (bsc#1275859).\n- CVE-2026-77214: out-of-bounds read due to insufficient checks in `XML_ParseBuffer()` (bsc#1284334).\n- CVE-2026-93990: fails to validate low surrogates following high surrogates in UTF-16 input (bsc#1282347).\n- CVE-2026-102633: Denial of Service via integer overflow in expat_realloc (bsc#1283493).\n\nChanges for expat:\n\nUpdate to 2.8.5 (jsc#PED-16154):\n\n * Bug fixes:\n * Fix an OOM-related memory leak on a failed overflow check\n * Fix memory alignment for architectures with 128bit pointers\n * Mark XML_SetHashSalt deprecated\n * CMake: only add /source-charset:utf-8 when /utf-8 is not present\n * lib: resolve undefined behavior from overshifting a signed int\n * lib: support read-only hash table lookup with non-zero-terminated\n keys\n * lib: use a C99 bool for ENTITY.open\n * version info bumped from 13:3:12 to 13:4:12\n * fix support for 2+ GiB documents (regression from 2.8.2)\n * reject empty version in the XML declaration\n * fix printf format for AIX\n * CMake|AIX: enable EXPAT_DEV_URANDOM by default\n * version info bumped from 13:2:12 to 13:3:12\n * Existing API function XML_SetHashSalt is now deprecated\n * because of its limitations, and its use should be\n * considered a vulnerability. Please either use the new API\n * function XML_SetHashSalt16Bytes (with known-high-quality\n * entropy input only!) instead, or leave the derivation of\n * a 16-bytes hash salt from high quality entropy to Expat's\n * internal machinery (by *not* calling either of the two\n * XML_SetHashSalt* functions).\n * xmlwf: Fix a memory leak\n * WASI: Fix format specifiers for 32bit WASI SDK\n * Fix alignment of internal allocations for some non-amd64\n architectures (e.g. sparc32); fixes up on the fix to\n CVE-2025-59375 (of Expat 2.7.2)\n * Fix a class of false positives where input should have been\n rejected with error XML_ERROR_ASYNC_ENTITY; regression from\n CVE-2024-8176 (of Expat 2.7.0)\n * Prove and regression-proof absence of integer overflow\n from function expat_realloc\n * Remove \"harmless\" cast that truncated a size_t to unsigned\n * xmlwf: Resolve use of functions XML_GetErrorLineNumber\n and XML_GetErrorColumnNumber\n * CVE-2025-59375 -- Disallow use of disproportional amounts of\n dynamic memory from within an Expat parser\n * xmlwf: Fix (internal) help generator\n * xmlwf: Mention supported environment variables in\n","status":"published","published":"2026-10-27T14:41:39Z","modified":"2026-11-07T17:23:17.381879846Z","updated_at":"2026-11-07T17:50:39.727056Z"},{"id":"SUSE-SU-2026:4615-1","title":"Security update for expat","description":"This update for expat fixes the following issues:\n\n- CVE-2025-59375: denial of service (resource consumption) caused by processing malformed small documents (bsc#1249584).\n- CVE-2026-24515: NULL dereference (CWE-476) due to function XML_ExternalEntityParserCreate() failing to copy the\n  encoding handler data passed to XML_SetUnknownEncodingHandler() from the parent to the subparser (bsc#1257144).\n- CVE-2026-25210: lack of buffer size check can lead to an integer overflow (bsc#1257496).\n- CVE-2026-32776: NULL pointer dereference when processing empty external parameter entities inside an entity\n  declaration value (bsc#1259726).\n- CVE-2026-32777: denial of service due to infinite loop in DTD content parsing (bsc#1259711).\n- CVE-2026-32778: NULL pointer dereference in `setContext` on retry after an out-of-memory condition\n  (bsc#1259729).\n- CVE-2026-41080: crafted XML document can cause a denial of service (bsc#1262263).\n- CVE-2026-45186: denial of service via moderately sized crafted XML input (bsc#1264713).\n- CVE-2026-50219: lack of handler call depth tracking for calls to XML_* functions from within handlers in cases of a\n  policy violation (bsc#1267631).\n- CVE-2026-56131: lack of handler call depth tracking for calls to XML_ResumeParser from within\n  handlers in cases of a policy violation (bsc#1268572).\n- CVE-2026-56132: heap-based buffer overflow in doProlog in xmlparse.c (bsc#1268573).\n- CVE-2026-56403,CVE-2026-56404,CVE-2026-56405,CVE-2026-56406,\n  CVE-2026-56407,CVE-2026-56408,CVE-2026-56409,CVE-2026-56410,\n  CVE-2026-56411,CVE-2026-56412: multiple integer overflow vulnerabilities (bsc#1275115).\n- CVE-2026-66046: denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts()\n  function (bsc#1275732).\n- CVE-2026-72522: out-of-bounds read and resultant infinite loop due to low surrogates being treated the same\n  as high surrogates during Unicode processing (bsc#1275594).\n- CVE-2026-76641: out-of-bounds read vulnerability that allows attackers to trigger\n  memory corruption (bsc#1275915).\n- CVE-2026-76956: denial of service via hash flooding attacks (bsc#1275860).\n- CVE-2026-76957: lack of handler call depth tracking with custom encoding callbacks. Thus, a use-\n  after-free can occur (bsc#1275859).\n- CVE-2026-77214: out-of-bounds read due to insufficient checks in `XML_ParseBuffer()` (bsc#1284334).\n- CVE-2026-93990: fails to validate low surrogates following high surrogates in UTF-16 input (bsc#1282347).\n- CVE-2026-102633: Denial of Service via integer overflow in expat_realloc (bsc#1283493).\n\nUpdate to 2.8.5 (jsc#PED-16154):\n\t\n * Bug fixes:\n * Fix an OOM-related memory leak on a failed overflow check\n * Fix memory alignment for architectures with 128bit pointers\n * Mark XML_SetHashSalt deprecated\n * CMake: only add /source-charset:utf-8 when /utf-8 is not present\n * lib: resolve undefined behavior from overshifting a signed int\n * lib: support read-only hash table lookup with non-zero-terminated\n keys\n * lib: use a C99 bool for ENTITY.open\n * version info bumped from 13:3:12 to 13:4:12\n * fix support for 2+ GiB documents (regression from 2.8.2)\n * reject empty version in the XML declaration\n * fix printf format for AIX\n * CMake|AIX: enable EXPAT_DEV_URANDOM by default\n * version info bumped from 13:2:12 to 13:3:12\n * Existing API function XML_SetHashSalt is now deprecated\n * because of its limitations, and its use should be\n * considered a vulnerability. Please either use the new API\n * function XML_SetHashSalt16Bytes (with known-high-quality\n * entropy input only!) instead, or leave the derivation of\n * a 16-bytes hash salt from high quality entropy to Expat's\n * internal machinery (by *not* calling either of the two\n * XML_SetHashSalt* functions).\n * xmlwf: Fix a memory leak\n * WASI: Fix format specifiers for 32bit WASI SDK\n * Fix alignment of internal allocations for some non-amd64\n architectures (e.g. sparc32); fixes up on the fix to\n CVE-2025-59375 (of Expat 2.7.2)\n * Fix a class of false positives where input should have been\n rejected with error XML_ERROR_ASYNC_ENTITY; regression from\n CVE-2024-8176 (of Expat 2.7.0)\n * Prove and regression-proof absence of integer overflow\n from function expat_realloc\n * Remove 'harmless' cast that truncated a size_t to unsigned\n * xmlwf: Resolve use of functions XML_GetErrorLineNumber\n and XML_GetErrorColumnNumber\n * CVE-2025-59375 -- Disallow use of disproportional amounts of\n dynamic memory from within an Expat parser\n * xmlwf: Fix (internal) help generator\n * xmlwf: Mention supported environment variables in\n","status":"published","published":"2026-10-12T07:20:23Z","modified":"2026-10-13T10:30:04.873577795Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4619-1","title":"Security update for expat","description":"This update for expat fixes the following issues:\n\n- CVE-2025-59375: denial of service (resource consumption) caused by processing malformed small documents (bsc#1249584).\n- CVE-2026-24515: NULL dereference (CWE-476) due to function XML_ExternalEntityParserCreate() failing to copy the\n  encoding handler data passed to XML_SetUnknownEncodingHandler() from the parent to the subparser (bsc#1257144).\n- CVE-2026-25210: lack of buffer size check can lead to an integer overflow (bsc#1257496).\n- CVE-2026-32776: NULL pointer dereference when processing empty external parameter entities inside an entity\n  declaration value (bsc#1259726).\n- CVE-2026-32777: denial of service due to infinite loop in DTD content parsing (bsc#1259711).\n- CVE-2026-32778: NULL pointer dereference in `setContext` on retry after an out-of-memory condition\n  (bsc#1259729).\n- CVE-2026-41080: crafted XML document can cause a denial of service (bsc#1262263).\n- CVE-2026-45186: denial of service via moderately sized crafted XML input (bsc#1264713).\n- CVE-2026-50219: lack of handler call depth tracking for calls to XML_* functions from within handlers in cases of a\n  policy violation (bsc#1267631).\n- CVE-2026-56131: lack of handler call depth tracking for calls to XML_ResumeParser from within\n  handlers in cases of a policy violation (bsc#1268572).\n- CVE-2026-56132: heap-based buffer overflow in doProlog in xmlparse.c (bsc#1268573).\n- CVE-2026-56403,CVE-2026-56404,CVE-2026-56405,CVE-2026-56406,\n  CVE-2026-56407,CVE-2026-56408,CVE-2026-56409,CVE-2026-56410,\n  CVE-2026-56411,CVE-2026-56412: multiple integer overflow vulnerabilities (bsc#1275115).\n- CVE-2026-66046: denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts()\n  function (bsc#1275732).\n- CVE-2026-72522: out-of-bounds read and resultant infinite loop due to low surrogates being treated the same\n  as high surrogates during Unicode processing (bsc#1275594).\n- CVE-2026-76641: out-of-bounds read vulnerability that allows attackers to trigger\n  memory corruption (bsc#1275915).\n- CVE-2026-76956: denial of service via hash flooding attacks (bsc#1275860).\n- CVE-2026-76957: lack of handler call depth tracking with custom encoding callbacks. Thus, a use-\n  after-free can occur (bsc#1275859).\n- CVE-2026-77214: out-of-bounds read due to insufficient checks in `XML_ParseBuffer()` (bsc#1284334).\n- CVE-2026-93990: fails to validate low surrogates following high surrogates in UTF-16 input (bsc#1282347).\n- CVE-2026-102633: Denial of Service via integer overflow in expat_realloc (bsc#1283493).\n\nUpdate to 2.8.5 (jsc#PED-16154):\n\t\n * Bug fixes:\n * Fix an OOM-related memory leak on a failed overflow check\n * Fix memory alignment for architectures with 128bit pointers\n * Mark XML_SetHashSalt deprecated\n * CMake: only add /source-charset:utf-8 when /utf-8 is not present\n * lib: resolve undefined behavior from overshifting a signed int\n * lib: support read-only hash table lookup with non-zero-terminated\n keys\n * lib: use a C99 bool for ENTITY.open\n * version info bumped from 13:3:12 to 13:4:12\n * fix support for 2+ GiB documents (regression from 2.8.2)\n * reject empty version in the XML declaration\n * fix printf format for AIX\n * CMake|AIX: enable EXPAT_DEV_URANDOM by default\n * version info bumped from 13:2:12 to 13:3:12\n * Existing API function XML_SetHashSalt is now deprecated\n * because of its limitations, and its use should be\n * considered a vulnerability. Please either use the new API\n * function XML_SetHashSalt16Bytes (with known-high-quality\n * entropy input only!) instead, or leave the derivation of\n * a 16-bytes hash salt from high quality entropy to Expat's\n * internal machinery (by *not* calling either of the two\n * XML_SetHashSalt* functions).\n * xmlwf: Fix a memory leak\n * WASI: Fix format specifiers for 32bit WASI SDK\n * Fix a class of false positives where input should have been\n   rejected with error XML_ERROR_ASYNC_ENTITY; regression from\n   earlier security fix (of Expat 2.7.0)\n * Prove and regression-proof absence of integer overflow\n from function expat_realloc\n * Remove 'harmless' cast that truncated a size_t to unsigned\n * xmlwf: Resolve use of functions XML_GetErrorLineNumber\n   and XML_GetErrorColumnNumber\n * CVE-2025-59375 -- Disallow use of disproportional amounts of\n   dynamic memory from within an Expat parser\n * xmlwf: Fix (internal) help generator\n * xmlwf: Mention supported environment variables in\n","status":"published","published":"2026-10-19T08:29:07Z","modified":"2026-10-19T09:43:18.179140646Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4623-1","title":"Security update for expat","description":"This update for expat fixes the following issues:\n  \n- CVE-2025-59375: denial of service (resource consumption) caused by processing malformed small documents (bsc#1249584).\n- CVE-2026-24515: NULL dereference (CWE-476) due to function XML_ExternalEntityParserCreate() failing to copy the\n  encoding handler data passed to XML_SetUnknownEncodingHandler() from the parent to the subparser (bsc#1257144).\n- CVE-2026-25210: lack of buffer size check can lead to an integer overflow (bsc#1257496).\n- CVE-2026-32776: NULL pointer dereference when processing empty external parameter entities inside an entity\n  declaration value (bsc#1259726).\n- CVE-2026-32777: denial of service due to infinite loop in DTD content parsing (bsc#1259711).\n- CVE-2026-32778: NULL pointer dereference in `setContext` on retry after an out-of-memory condition\n  (bsc#1259729).\n- CVE-2026-41080: crafted XML document can cause a denial of service (bsc#1262263).\n- CVE-2026-45186: denial of service via moderately sized crafted XML input (bsc#1264713).\n- CVE-2026-50219: lack of handler call depth tracking for calls to XML_* functions from within handlers in cases of a\n  policy violation (bsc#1267631).\n- CVE-2026-56131: lack of handler call depth tracking for calls to XML_ResumeParser from within\n  handlers in cases of a policy violation (bsc#1268572).\n- CVE-2026-56132: heap-based buffer overflow in doProlog in xmlparse.c (bsc#1268573).\n- CVE-2026-56403,CVE-2026-56404,CVE-2026-56405,CVE-2026-56406,\n  CVE-2026-56407,CVE-2026-56408,CVE-2026-56409,CVE-2026-56410,\n  CVE-2026-56411,CVE-2026-56412: multiple integer overflow vulnerabilities (bsc#1275115).\n- CVE-2026-66046: denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts()\n  function (bsc#1275732).\n- CVE-2026-72522: out-of-bounds read and resultant infinite loop due to low surrogates being treated the same\n  as high surrogates during Unicode processing (bsc#1275594).\n- CVE-2026-76641: out-of-bounds read vulnerability that allows attackers to trigger\n  memory corruption (bsc#1275915).\n- CVE-2026-76956: denial of service via hash flooding attacks (bsc#1275860).\n- CVE-2026-76957: lack of handler call depth tracking with custom encoding callbacks. Thus, a use-\n  after-free can occur (bsc#1275859).\n- CVE-2026-77214: out-of-bounds read due to insufficient checks in `XML_ParseBuffer()` (bsc#1284334).\n- CVE-2026-93990: fails to validate low surrogates following high surrogates in UTF-16 input (bsc#1282347).\n- CVE-2026-102633: Denial of Service via integer overflow in expat_realloc (bsc#1283493).\n\nUpdate to 2.8.5 (jsc#PED-16154):\n\t\n * Bug fixes:\n * Fix an OOM-related memory leak on a failed overflow check\n * Fix memory alignment for architectures with 128bit pointers\n * Mark XML_SetHashSalt deprecated\n * CMake: only add /source-charset:utf-8 when /utf-8 is not present\n * lib: resolve undefined behavior from overshifting a signed int\n * lib: support read-only hash table lookup with non-zero-terminated\n keys\n * lib: use a C99 bool for ENTITY.open\n * version info bumped from 13:3:12 to 13:4:12\n * fix support for 2+ GiB documents (regression from 2.8.2)\n * reject empty version in the XML declaration\n * fix printf format for AIX\n * CMake|AIX: enable EXPAT_DEV_URANDOM by default\n * version info bumped from 13:2:12 to 13:3:12\n * Existing API function XML_SetHashSalt is now deprecated\n * because of its limitations, and its use should be\n * considered a vulnerability. Please either use the new API\n * function XML_SetHashSalt16Bytes (with known-high-quality\n * entropy input only!) instead, or leave the derivation of\n * a 16-bytes hash salt from high quality entropy to Expat's\n * internal machinery (by *not* calling either of the two\n * XML_SetHashSalt* functions).\n * xmlwf: Fix a memory leak\n * WASI: Fix format specifiers for 32bit WASI SDK\n * Fix alignment of internal allocations for some non-amd64\n architectures (e.g. sparc32); fixes up on the fix to\n CVE-2025-59375 (of Expat 2.7.2)\n * Fix a class of false positives where input should have been\n rejected with error XML_ERROR_ASYNC_ENTITY; regression from\n CVE-2024-8176 (of Expat 2.7.0)\n * Prove and regression-proof absence of integer overflow\n from function expat_realloc\n * Remove 'harmless' cast that truncated a size_t to unsigned\n * xmlwf: Resolve use of functions XML_GetErrorLineNumber\n and XML_GetErrorColumnNumber\n * CVE-2025-59375 -- Disallow use of disproportional amounts of\n dynamic memory from within an Expat parser\n * xmlwf: Fix (internal) help generator\n * xmlwf: Mention supported environment variables in\n","status":"published","published":"2026-10-12T07:27:49Z","modified":"2026-10-13T10:30:05.847197418Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"USN-8022-2","title":"expat vulnerabilities","description":"USN-8022-1 fixed vulnerabilities in Expat. This update provides the\ncorresponding updates for Ubuntu 24.04 LTS.\n\nOriginal advisory details:\n\n It was discovered that Expat incorrectly handled the initialization of parsers\n for external entities. An attacker could possibly use this issue to cause a\n denial of service. (CVE-2026-24515)\n\n It was discovered that Expat incorrectly handled integer calculations when\n allocating memory for XML tags. An attacker could possibly use this issue to\n cause a denial of service or execute arbitrary code. (CVE-2026-25210)","status":"published","published":"2026-02-16T07:59:27Z","modified":"2026-04-27T18:38:48.914241Z","updated_at":"2026-11-02T16:58:22.951676Z"}]}}