Vulnerability-Lookup

RHSA-2026:65568

Vulnerability from csaf_redhat - Published: 2026-09-08 17:18 - Updated: 2026-09-29 17:19

Summary

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Severity

Important

Notes

Topic: An update for Red Hat Hardened Images RPMs is now available.

Details: This update includes the following RPMs: expat: * expat-2.8.4-0.1.hum1 (aarch64, x86_64) * expat-devel-2.8.4-0.1.hum1 (aarch64, x86_64) * expat-static-2.8.4-0.1.hum1 (aarch64, x86_64) * expat-2.8.4-0.1.hum1.src (src) Security Fix(es): expat: * CVE-2026-66046 * CVE-2026-76641 * CVE-2026-76956 * CVE-2026-76957

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-56411

A flaw was found in libexpat, a software library used for parsing XML (Extensible Markup Language) documents. An attacker could exploit an integer overflow vulnerability in the `xmlwf` utility by crafting malicious `NOTATION` declarations. This could lead to the disclosure of sensitive information or potentially allow the attacker to execute unauthorized code, impacting the confidentiality and integrity of data.

6.9 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L

CWE-190 - Integer Overflow or Wraparound

Affected products

Fixed 7 products

Product	Version	Remediation
Unresolved product id: Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@aarch64	—	Vendor Fix fix
Unresolved product id: Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@src	—	Vendor Fix fix
Unresolved product id: Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@x86_64	—	Vendor Fix fix
Unresolved product id: Red Hat Hardened Images:expat-devel-0:2.8.4-0.1.hum1@aarch64	—	Vendor Fix fix
Unresolved product id: Red Hat Hardened Images:expat-devel-0:2.8.4-0.1.hum1@x86_64	—	Vendor Fix fix
Unresolved product id: Red Hat Hardened Images:expat-static-0:2.8.4-0.1.hum1@aarch64	—	Vendor Fix fix
Unresolved product id: Red Hat Hardened Images:expat-static-0:2.8.4-0.1.hum1@x86_64	—	Vendor Fix fix

Threats

Impact Moderate

CVE-2026-66046

A flaw was found in the Expat XML parsing library. A remote, unauthenticated attacker can supply a specially crafted XML document to trigger quadratic algorithmic complexity in the storeAtts() function, causing excessive CPU consumption and a denial of service

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-407 - Inefficient Algorithmic Complexity

Affected products

Fixed 7 products, the same list as for CVE-2026-56411

Threats

Impact Important

CVE-2026-76641

A flaw was found in Expat. Attackers can exploit an out-of-bounds read vulnerability by processing XML with external entity parsers created via XML_ExternalEntityParserCreate. This can lead to memory corruption. Specifically, a mismatch in struct sizes can cause a read past memory boundaries, potentially resulting in a denial of service (DoS) due to a segfault or incorrect handling of XML attributes.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-125 - Out-of-bounds Read

Affected products

Fixed 7 products, the same list as for CVE-2026-56411

Threats

Impact Important

CVE-2026-76956

A flaw was found in libexpat. This vulnerability arises from the software misinterpreting a return code, leading to insufficient randomness (entropy) for hash functions. A remote attacker could exploit this by sending specially crafted XML content, triggering hash flooding attacks. This can result in a denial of service (DoS), making the affected system or application unavailable to legitimate users.

5.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-331 - Insufficient Entropy

Affected products

Fixed 7 products, the same list as for CVE-2026-56411

Threats

Impact Moderate

CVE-2026-76957

A flaw was found in libexpat. The library's handling of custom encoding callbacks lacks proper tracking of handler call depth, which can lead to a use-after-free vulnerability. This memory corruption flaw could allow a local attacker to cause a denial of service or potentially execute arbitrary code.

4.9 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

CWE-825 - Expired Pointer Dereference

Affected products

Fixed 7 products, the same list as for CVE-2026-56411

Threats

Impact Moderate

References

38 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:65568	self
https://access.redhat.com/security/cve/CVE-2026-66046	external
https://access.redhat.com/security/cve/CVE-2026-76641	external
https://access.redhat.com/security/cve/CVE-2026-76956	external
https://access.redhat.com/security/cve/CVE-2026-76957	external
https://access.redhat.com/security/updates/classi…	external
https://images.redhat.com/	external
https://access.redhat.com/security/cve/CVE-2026-56411	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-56411	self
https://bugzilla.redhat.com/show_bug.cgi?id=2491202	external
https://www.cve.org/CVERecord?id=CVE-2026-56411	external
https://nvd.nist.gov/vuln/detail/CVE-2026-56411	external
https://github.com/libexpat/libexpat/pull/1263	external
https://access.redhat.com/security/cve/CVE-2026-66046	self
https://bugzilla.redhat.com/show_bug.cgi?id=2517901	external
https://www.cve.org/CVERecord?id=CVE-2026-66046	external
https://nvd.nist.gov/vuln/detail/CVE-2026-66046	external
https://github.com/libexpat/libexpat/pull/1321	external
https://www.vulncheck.com/advisories/expat-denial…	external
https://access.redhat.com/security/cve/CVE-2026-76641	self
https://bugzilla.redhat.com/show_bug.cgi?id=2520649	external
https://www.cve.org/CVERecord?id=CVE-2026-76641	external
https://nvd.nist.gov/vuln/detail/CVE-2026-76641	external
https://github.com/libexpat/libexpat/commit/98599…	external
https://github.com/libexpat/libexpat/pull/1331	external
https://www.vulncheck.com/advisories/expat-out-of…	external
https://access.redhat.com/security/cve/CVE-2026-76956	self
https://bugzilla.redhat.com/show_bug.cgi?id=2520124	external
https://www.cve.org/CVERecord?id=CVE-2026-76956	external
https://nvd.nist.gov/vuln/detail/CVE-2026-76956	external
https://github.com/libexpat/libexpat/pull/1326	external
https://access.redhat.com/security/cve/CVE-2026-76957	self
https://bugzilla.redhat.com/show_bug.cgi?id=2520125	external
https://www.cve.org/CVERecord?id=CVE-2026-76957	external
https://nvd.nist.gov/vuln/detail/CVE-2026-76957	external
https://github.com/libexpat/libexpat/pull/1322	external
https://github.com/libexpat/libexpat/pull/1329	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for Red Hat Hardened Images RPMs is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This update includes the following RPMs:\n\nexpat:\n  * expat-2.8.4-0.1.hum1 (aarch64, x86_64)\n  * expat-devel-2.8.4-0.1.hum1 (aarch64, x86_64)\n  * expat-static-2.8.4-0.1.hum1 (aarch64, x86_64)\n  * expat-2.8.4-0.1.hum1.src (src)\n\nSecurity Fix(es):\n\nexpat:\n  * CVE-2026-66046\n  * CVE-2026-76641\n  * CVE-2026-76956\n  * CVE-2026-76957",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:65568",
        "url": "https://access.redhat.com/errata/RHSA-2026:65568"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-66046",
        "url": "https://access.redhat.com/security/cve/CVE-2026-66046"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-76641",
        "url": "https://access.redhat.com/security/cve/CVE-2026-76641"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-76956",
        "url": "https://access.redhat.com/security/cve/CVE-2026-76956"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-76957",
        "url": "https://access.redhat.com/security/cve/CVE-2026-76957"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://images.redhat.com/",
        "url": "https://images.redhat.com/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-56411",
        "url": "https://access.redhat.com/security/cve/CVE-2026-56411"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_65568.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
    "tracking": {
      "current_release_date": "2026-09-29T17:19:55+00:00",
      "generator": {
        "date": "2026-09-29T17:19:55+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.0"
        }
      },
      "id": "RHSA-2026:65568",
      "initial_release_date": "2026-09-08T17:18:36+00:00",
      "revision_history": [
        {
          "date": "2026-09-08T17:18:36+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-09-16T20:06:23+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-09-29T17:19:55+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Hardened Images",
                "product": {
                  "name": "Red Hat Hardened Images",
                  "product_id": "Red Hat Hardened Images",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:hummingbird:1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Hardened Images"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "expat-0:2.8.4-0.1.hum1@aarch64",
                "product": {
                  "name": "expat-0:2.8.4-0.1.hum1@aarch64",
                  "product_id": "expat-0:2.8.4-0.1.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/expat@2.8.4-0.1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "expat-devel-0:2.8.4-0.1.hum1@aarch64",
                "product": {
                  "name": "expat-devel-0:2.8.4-0.1.hum1@aarch64",
                  "product_id": "expat-devel-0:2.8.4-0.1.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/expat-devel@2.8.4-0.1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "expat-static-0:2.8.4-0.1.hum1@aarch64",
                "product": {
                  "name": "expat-static-0:2.8.4-0.1.hum1@aarch64",
                  "product_id": "expat-static-0:2.8.4-0.1.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/expat-static@2.8.4-0.1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "expat-0:2.8.4-0.1.hum1@src",
                "product": {
                  "name": "expat-0:2.8.4-0.1.hum1@src",
                  "product_id": "expat-0:2.8.4-0.1.hum1@src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/expat@2.8.4-0.1.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "expat-0:2.8.4-0.1.hum1@x86_64",
                "product": {
                  "name": "expat-0:2.8.4-0.1.hum1@x86_64",
                  "product_id": "expat-0:2.8.4-0.1.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/expat@2.8.4-0.1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "expat-devel-0:2.8.4-0.1.hum1@x86_64",
                "product": {
                  "name": "expat-devel-0:2.8.4-0.1.hum1@x86_64",
                  "product_id": "expat-devel-0:2.8.4-0.1.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/expat-devel@2.8.4-0.1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "expat-static-0:2.8.4-0.1.hum1@x86_64",
                "product": {
                  "name": "expat-static-0:2.8.4-0.1.hum1@x86_64",
                  "product_id": "expat-static-0:2.8.4-0.1.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/expat-static@2.8.4-0.1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "expat-0:2.8.4-0.1.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@aarch64"
        },
        "product_reference": "expat-0:2.8.4-0.1.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "expat-0:2.8.4-0.1.hum1@src as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@src"
        },
        "product_reference": "expat-0:2.8.4-0.1.hum1@src",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "expat-0:2.8.4-0.1.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@x86_64"
        },
        "product_reference": "expat-0:2.8.4-0.1.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "expat-devel-0:2.8.4-0.1.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:expat-devel-0:2.8.4-0.1.hum1@aarch64"
        },
        "product_reference": "expat-devel-0:2.8.4-0.1.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "expat-devel-0:2.8.4-0.1.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:expat-devel-0:2.8.4-0.1.hum1@x86_64"
        },
        "product_reference": "expat-devel-0:2.8.4-0.1.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "expat-static-0:2.8.4-0.1.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:expat-static-0:2.8.4-0.1.hum1@aarch64"
        },
        "product_reference": "expat-static-0:2.8.4-0.1.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "expat-static-0:2.8.4-0.1.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:expat-static-0:2.8.4-0.1.hum1@x86_64"
        },
        "product_reference": "expat-static-0:2.8.4-0.1.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-56411",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "discovery_date": "2026-06-21T17:00:49.451859+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2491202"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in libexpat, a software library used for parsing XML (Extensible Markup Language) documents. An attacker could exploit an integer overflow vulnerability in the `xmlwf` utility by crafting malicious `NOTATION` declarations. This could lead to the disclosure of sensitive information or potentially allow the attacker to execute unauthorized code, impacting the confidentiality and integrity of data.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "expat: libexpat: Integer Overflow Vulnerability Leading to Information Disclosure or Code Execution",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@aarch64",
          "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@src",
          "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@x86_64",
          "Red Hat Hardened Images:expat-devel-0:2.8.4-0.1.hum1@aarch64",
          "Red Hat Hardened Images:expat-devel-0:2.8.4-0.1.hum1@x86_64",
          "Red Hat Hardened Images:expat-static-0:2.8.4-0.1.hum1@aarch64",
          "Red Hat Hardened Images:expat-static-0:2.8.4-0.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56411"
        },
        {
          "category": "external",
          "summary": "RHBZ#2491202",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491202"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56411",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56411"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56411",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56411"
        },
        {
          "category": "external",
          "summary": "https://github.com/libexpat/libexpat/pull/1263",
          "url": "https://github.com/libexpat/libexpat/pull/1263"
        }
      ],
      "release_date": "2026-06-21T15:56:42.729000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-08T17:18:36+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@src",
            "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@x86_64",
            "Red Hat Hardened Images:expat-devel-0:2.8.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:expat-devel-0:2.8.4-0.1.hum1@x86_64",
            "Red Hat Hardened Images:expat-static-0:2.8.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:expat-static-0:2.8.4-0.1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:65568"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@src",
            "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@x86_64",
            "Red Hat Hardened Images:expat-devel-0:2.8.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:expat-devel-0:2.8.4-0.1.hum1@x86_64",
            "Red Hat Hardened Images:expat-static-0:2.8.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:expat-static-0:2.8.4-0.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "expat: libexpat: Integer Overflow Vulnerability Leading to Information Disclosure or Code Execution"
    },
    {
      "cve": "CVE-2026-66046",
      "cwe": {
        "id": "CWE-407",
        "name": "Inefficient Algorithmic Complexity"
      },
      "discovery_date": "2026-08-18T14:21:00.212292+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2517901"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Expat XML parsing library. A remote, unauthenticated attacker can supply a specially crafted XML document to trigger quadratic algorithmic complexity in the storeAtts() function, causing excessive CPU consumption and a denial of service",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "expat: Expat: Denial of Service via quadratic complexity in attribute processing",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "An Important severity denial of service vulnerability exists in the Expat library due to inefficient algorithmic complexity when processing XML attributes. Applications parsing untrusted XML are susceptible to remote, unauthenticated attacks where a specially crafted XML payload causes excessive CPU exhaustion, ultimately resulting in service unavailability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@aarch64",
          "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@src",
          "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@x86_64",
          "Red Hat Hardened Images:expat-devel-0:2.8.4-0.1.hum1@aarch64",
          "Red Hat Hardened Images:expat-devel-0:2.8.4-0.1.hum1@x86_64",
          "Red Hat Hardened Images:expat-static-0:2.8.4-0.1.hum1@aarch64",
          "Red Hat Hardened Images:expat-static-0:2.8.4-0.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-66046"
        },
        {
          "category": "external",
          "summary": "RHBZ#2517901",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517901"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-66046",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-66046"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-66046",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-66046"
        },
        {
          "category": "external",
          "summary": "https://github.com/libexpat/libexpat/pull/1321",
          "url": "https://github.com/libexpat/libexpat/pull/1321"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/expat-denial-of-service-via-storeatts-quadratic-complexity",
          "url": "https://www.vulncheck.com/advisories/expat-denial-of-service-via-storeatts-quadratic-complexity"
        }
      ],
      "release_date": "2026-08-18T14:10:05.176000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-08T17:18:36+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@src",
            "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@x86_64",
            "Red Hat Hardened Images:expat-devel-0:2.8.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:expat-devel-0:2.8.4-0.1.hum1@x86_64",
            "Red Hat Hardened Images:expat-static-0:2.8.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:expat-static-0:2.8.4-0.1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:65568"
        },
        {
          "category": "workaround",
          "details": "To mitigate, avoid parsing untrusted XML where possible. Where parsing is required, restrict sources using network controls and enforce strict limits on document size, attribute counts, and request rates at the application or proxy level. Additionally, apply strict execution timeouts to cap parser cost and interrupt processes before they can exhaust CPU resources.",
          "product_ids": [
            "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@src",
            "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@x86_64",
            "Red Hat Hardened Images:expat-devel-0:2.8.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:expat-devel-0:2.8.4-0.1.hum1@x86_64",
            "Red Hat Hardened Images:expat-static-0:2.8.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:expat-static-0:2.8.4-0.1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@src",
            "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@x86_64",
            "Red Hat Hardened Images:expat-devel-0:2.8.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:expat-devel-0:2.8.4-0.1.hum1@x86_64",
            "Red Hat Hardened Images:expat-static-0:2.8.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:expat-static-0:2.8.4-0.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "expat: Expat: Denial of Service via quadratic complexity in attribute processing"
    },
    {
      "cve": "CVE-2026-76641",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2026-08-20T17:52:14.726881+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2520649"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Expat. Attackers can exploit an out-of-bounds read vulnerability by processing XML with external entity parsers created via XML_ExternalEntityParserCreate. This can lead to memory corruption. Specifically, a mismatch in struct sizes can cause a read past memory boundaries, potentially resulting in a denial of service (DoS) due to a segfault or incorrect handling of XML attributes.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "expat: Expat: Denial of Service via XML external entity parsing",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Important: An out-of-bounds read vulnerability in Expat can lead to memory corruption and denial of service when processing specially crafted XML with external entity parsers.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@aarch64",
          "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@src",
          "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@x86_64",
          "Red Hat Hardened Images:expat-devel-0:2.8.4-0.1.hum1@aarch64",
          "Red Hat Hardened Images:expat-devel-0:2.8.4-0.1.hum1@x86_64",
          "Red Hat Hardened Images:expat-static-0:2.8.4-0.1.hum1@aarch64",
          "Red Hat Hardened Images:expat-static-0:2.8.4-0.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-76641"
        },
        {
          "category": "external",
          "summary": "RHBZ#2520649",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2520649"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-76641",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-76641"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-76641",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76641"
        },
        {
          "category": "external",
          "summary": "https://github.com/libexpat/libexpat/commit/98599f6dcc2b460410881fe420f5f55d6bec63bf",
          "url": "https://github.com/libexpat/libexpat/commit/98599f6dcc2b460410881fe420f5f55d6bec63bf"
        },
        {
          "category": "external",
          "summary": "https://github.com/libexpat/libexpat/pull/1331",
          "url": "https://github.com/libexpat/libexpat/pull/1331"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/expat-out-of-bounds-read-via-dtdcopy",
          "url": "https://www.vulncheck.com/advisories/expat-out-of-bounds-read-via-dtdcopy"
        }
      ],
      "release_date": "2026-08-20T17:31:10.610000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-08T17:18:36+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@src",
            "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@x86_64",
            "Red Hat Hardened Images:expat-devel-0:2.8.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:expat-devel-0:2.8.4-0.1.hum1@x86_64",
            "Red Hat Hardened Images:expat-static-0:2.8.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:expat-static-0:2.8.4-0.1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:65568"
        },
        {
          "category": "workaround",
          "details": "To mitigate this implement a strict \"accept known good\" input validation strategy that rejects any data failing to match expected specifications. Rigorously validate all length arguments, offsets, and buffer size calculations before using them to access memory boundaries. Additionally, avoid relying solely on sentinels (such as NUL characters) within untrusted input to determine array or buffer lengths. Finally, apply defense-in-depth by combining allowlists with denylists to aggressively drop outright malformed inputs before processing begins.",
          "product_ids": [
            "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@src",
            "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@x86_64",
            "Red Hat Hardened Images:expat-devel-0:2.8.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:expat-devel-0:2.8.4-0.1.hum1@x86_64",
            "Red Hat Hardened Images:expat-static-0:2.8.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:expat-static-0:2.8.4-0.1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@src",
            "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@x86_64",
            "Red Hat Hardened Images:expat-devel-0:2.8.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:expat-devel-0:2.8.4-0.1.hum1@x86_64",
            "Red Hat Hardened Images:expat-static-0:2.8.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:expat-static-0:2.8.4-0.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "expat: Expat: Denial of Service via XML external entity parsing"
    },
    {
      "cve": "CVE-2026-76956",
      "cwe": {
        "id": "CWE-331",
        "name": "Insufficient Entropy"
      },
      "discovery_date": "2026-08-20T04:40:54.658217+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2520124"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in libexpat. This vulnerability arises from the software misinterpreting a return code, leading to insufficient randomness (entropy) for hash functions. A remote attacker could exploit this by sending specially crafted XML content, triggering hash flooding attacks. This can result in a denial of service (DoS), making the affected system or application unavailable to legitimate users.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libexpat: libexpat: Denial of Service via hash flooding attack with crafted XML",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat ships libexpat (packaged as \"expat\") across many products. This vulnerability was introduced in libexpat 2.8.2. Most Red Hat products ship expat versions prior to 2.8.2 and are therefore not affected. Only products shipping expat 2.8.2 or 2.8.3 are vulnerable to this hash flooding denial of service.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@aarch64",
          "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@src",
          "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@x86_64",
          "Red Hat Hardened Images:expat-devel-0:2.8.4-0.1.hum1@aarch64",
          "Red Hat Hardened Images:expat-devel-0:2.8.4-0.1.hum1@x86_64",
          "Red Hat Hardened Images:expat-static-0:2.8.4-0.1.hum1@aarch64",
          "Red Hat Hardened Images:expat-static-0:2.8.4-0.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-76956"
        },
        {
          "category": "external",
          "summary": "RHBZ#2520124",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2520124"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-76956",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-76956"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-76956",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76956"
        },
        {
          "category": "external",
          "summary": "https://github.com/libexpat/libexpat/pull/1326",
          "url": "https://github.com/libexpat/libexpat/pull/1326"
        }
      ],
      "release_date": "2026-08-20T04:22:51.381000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-08T17:18:36+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@src",
            "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@x86_64",
            "Red Hat Hardened Images:expat-devel-0:2.8.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:expat-devel-0:2.8.4-0.1.hum1@x86_64",
            "Red Hat Hardened Images:expat-static-0:2.8.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:expat-static-0:2.8.4-0.1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:65568"
        },
        {
          "category": "workaround",
          "details": "There is no mitigation for this flaw other than updating to libexpat 2.8.4 or later.",
          "product_ids": [
            "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@src",
            "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@x86_64",
            "Red Hat Hardened Images:expat-devel-0:2.8.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:expat-devel-0:2.8.4-0.1.hum1@x86_64",
            "Red Hat Hardened Images:expat-static-0:2.8.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:expat-static-0:2.8.4-0.1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@src",
            "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@x86_64",
            "Red Hat Hardened Images:expat-devel-0:2.8.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:expat-devel-0:2.8.4-0.1.hum1@x86_64",
            "Red Hat Hardened Images:expat-static-0:2.8.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:expat-static-0:2.8.4-0.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "libexpat: libexpat: Denial of Service via hash flooding attack with crafted XML"
    },
    {
      "cve": "CVE-2026-76957",
      "cwe": {
        "id": "CWE-825",
        "name": "Expired Pointer Dereference"
      },
      "discovery_date": "2026-08-20T04:40:57.555835+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2520125"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in libexpat. The library\u0027s handling of custom encoding callbacks lacks proper tracking of handler call depth, which can lead to a use-after-free vulnerability. This memory corruption flaw could allow a local attacker to cause a denial of service or potentially execute arbitrary code.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libexpat: libexpat: Memory corruption vulnerability allows arbitrary code execution or denial of service",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat ships libexpat (packaged as \"expat\") across many products. All versions of expat prior to 2.8.4 are affected by this use-after-free vulnerability. Exploitation requires triggering the vulnerable code path through custom encoding callbacks, which is not a common usage pattern.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@aarch64",
          "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@src",
          "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@x86_64",
          "Red Hat Hardened Images:expat-devel-0:2.8.4-0.1.hum1@aarch64",
          "Red Hat Hardened Images:expat-devel-0:2.8.4-0.1.hum1@x86_64",
          "Red Hat Hardened Images:expat-static-0:2.8.4-0.1.hum1@aarch64",
          "Red Hat Hardened Images:expat-static-0:2.8.4-0.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-76957"
        },
        {
          "category": "external",
          "summary": "RHBZ#2520125",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2520125"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-76957",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-76957"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-76957",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76957"
        },
        {
          "category": "external",
          "summary": "https://github.com/libexpat/libexpat/pull/1322",
          "url": "https://github.com/libexpat/libexpat/pull/1322"
        },
        {
          "category": "external",
          "summary": "https://github.com/libexpat/libexpat/pull/1329",
          "url": "https://github.com/libexpat/libexpat/pull/1329"
        }
      ],
      "release_date": "2026-08-20T04:28:04.788000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-08T17:18:36+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@src",
            "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@x86_64",
            "Red Hat Hardened Images:expat-devel-0:2.8.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:expat-devel-0:2.8.4-0.1.hum1@x86_64",
            "Red Hat Hardened Images:expat-static-0:2.8.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:expat-static-0:2.8.4-0.1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:65568"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@src",
            "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@x86_64",
            "Red Hat Hardened Images:expat-devel-0:2.8.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:expat-devel-0:2.8.4-0.1.hum1@x86_64",
            "Red Hat Hardened Images:expat-static-0:2.8.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:expat-static-0:2.8.4-0.1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@src",
            "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@x86_64",
            "Red Hat Hardened Images:expat-devel-0:2.8.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:expat-devel-0:2.8.4-0.1.hum1@x86_64",
            "Red Hat Hardened Images:expat-static-0:2.8.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:expat-static-0:2.8.4-0.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "libexpat: libexpat: Memory corruption vulnerability allows arbitrary code execution or denial of service"
    }
  ]
}

CVE-2026-56411 (GCVE-0-2026-56411)

Vulnerability from cvelistv5 – Published: 2026-06-21 15:56 – Updated: 2026-06-22 16:31

Summary

xmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations.

Severity

6.9 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-22 16:31 UTC

CWE

CWE-190 - Integer Overflow or Wraparound

Assigner

mitre mitre root Scorecard

References

1 reference

URL	Tags
https://github.com/libexpat/libexpat/pull/1263

Impacted products

1 product

Vendor	Product	Version
libexpat project	libexpat	Affected: 0 , < 2.8.2 (semver) cpe:2.3:a:libexpat_project:libexpat::::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-56411",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-22T16:31:23.529292Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-22T16:31:30.518Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "libexpat",
          "vendor": "libexpat project",
          "versions": [
            {
              "lessThan": "2.8.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:libexpat_project:libexpat:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.8.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "xmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "CWE-190 Integer Overflow or Wraparound",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-21T15:56:42.729Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://github.com/libexpat/libexpat/pull/1263"
        }
      ],
      "x_generator": {
        "engine": "CVE-Request-form 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2026-56411",
    "datePublished": "2026-06-21T15:56:42.729Z",
    "dateReserved": "2026-06-21T15:56:42.365Z",
    "dateUpdated": "2026-06-22T16:31:30.518Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-66046 (GCVE-0-2026-66046)

Vulnerability from cvelistv5 – Published: 2026-08-18 14:10 – Updated: 2026-08-21 11:20 X_Open Source

Title

Expat Denial of Service via storeAtts() Quadratic Complexity

Summary

Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an O(N^2) linear scan of elementType->defaultAtts to determine CDATA status. A remote unauthenticated attacker can supply a single well-formed XML document of a few megabytes to an application parsing untrusted XML to cause excessive CPU consumption, resulting in denial of service without requiring authentication, external entity resolution, or non-default parser options.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-20 13:48 UTC

CWE

CWE-407 - Inefficient Algorithmic Complexity

Assigner

VulnCheck mitre root Scorecard

References

2 references

URL	Tags
https://github.com/libexpat/libexpat/pull/1321	issue-tracking
https://www.vulncheck.com/advisories/expat-denial…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
libexpat project	libexpat	Affected: 0 , ≤ 2.8.3 (semver)

Date Public

2026-08-13 00:00

Credits

Fabian Wahle (Hap Security) Sebastian Pipping VulnCheck

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-66046",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-20T13:48:24.577412Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-20T15:24:17.474Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "packageURL": "pkg:github/libexpat/libexpat",
          "product": "libexpat",
          "repo": "https://github.com/libexpat/libexpat",
          "vendor": "libexpat project",
          "versions": [
            {
              "lessThanOrEqual": "2.8.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Fabian Wahle (Hap Security)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Sebastian Pipping"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulnCheck"
        }
      ],
      "datePublic": "2026-08-13T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an O(N^2) linear scan of elementType-\u003edefaultAtts to determine CDATA status. A remote unauthenticated attacker can supply a single well-formed XML document of a few megabytes to an application parsing untrusted XML to cause excessive CPU consumption, resulting in denial of service without requiring authentication, external entity resolution, or non-default parser options."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-407",
              "description": "Inefficient Algorithmic Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-21T11:20:55.742Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "Pull Request",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/libexpat/libexpat/pull/1321"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/expat-denial-of-service-via-storeatts-quadratic-complexity"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "tags": [
        "x_open-source"
      ],
      "title": "Expat Denial of Service via storeAtts() Quadratic Complexity",
      "x_generator": {
        "engine": "vulncheck"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-66046",
    "datePublished": "2026-08-18T14:10:05.176Z",
    "dateReserved": "2026-07-23T20:45:17.817Z",
    "dateUpdated": "2026-08-21T11:20:55.742Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-76641 (GCVE-0-2026-76641)

Vulnerability from cvelistv5 – Published: 2026-08-20 17:31 – Updated: 2026-08-21 11:21 X_Open Source

Title

Expat Out-of-Bounds Read via dtdCopy

Summary

Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory corruption by processing XML with external entity parsers created via XML_ExternalEntityParserCreate. A struct size mismatch between ELEMENT_TYPE members causes storeAtts to read the attIndex member past allocated memory boundaries, resulting in failure to normalize whitespace in non-CDATA attributes or a wild pointer dereference causing a segfault. This vulnerability was introduced by the fix for CVE-2026-66046.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-20 18:48 UTC

CWE

CWE-125 - Out-of-bounds Read

Assigner

VulnCheck mitre root Scorecard

References

3 references

URL	Tags
https://github.com/libexpat/libexpat/pull/1331	issue-tracking
https://github.com/libexpat/libexpat/commit/98599…	patch
https://www.vulncheck.com/advisories/expat-out-of…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
libexpat	libexpat	Affected: 0 , ≤ 2.8.3 (semver)

Date Public

2026-08-19 00:00

Credits

ZeyouLiu (@liuzeyouzeyou) ZeyouLiu (@liuzeyouzeyou)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-76641",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-20T18:48:51.305928Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-20T18:49:21.993Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "packageURL": "pkg:github/libexpat/libexpat",
          "product": "libexpat",
          "repo": "https://github.com/libexpat/libexpat",
          "vendor": "libexpat",
          "versions": [
            {
              "lessThanOrEqual": "2.8.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "ZeyouLiu (@liuzeyouzeyou)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "ZeyouLiu (@liuzeyouzeyou)"
        }
      ],
      "datePublic": "2026-08-19T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory corruption by processing XML with external entity parsers created via XML_ExternalEntityParserCreate. A struct size mismatch between ELEMENT_TYPE members causes storeAtts to read the attIndex member past allocated memory boundaries, resulting in failure to normalize whitespace in non-CDATA attributes or a wild pointer dereference causing a segfault. This vulnerability was introduced by the fix for CVE-2026-66046."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-21T11:21:12.314Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "Pull Request",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/libexpat/libexpat/pull/1331"
        },
        {
          "name": "Patch Commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/libexpat/libexpat/commit/98599f6dcc2b460410881fe420f5f55d6bec63bf"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/expat-out-of-bounds-read-via-dtdcopy"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "tags": [
        "x_open-source"
      ],
      "title": "Expat Out-of-Bounds Read via dtdCopy",
      "x_generator": {
        "engine": "vulncheck"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-76641",
    "datePublished": "2026-08-20T17:31:10.610Z",
    "dateReserved": "2026-08-19T14:53:58.575Z",
    "dateUpdated": "2026-08-21T11:21:12.314Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-76956 (GCVE-0-2026-76956)

Vulnerability from cvelistv5 – Published: 2026-08-20 04:22 – Updated: 2026-08-20 17:42

Summary

In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to insufficient entropy, which results in being vulnerable to hash flooding attacks, causing a denial of service via crafted XML content.

Severity

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-20 15:05 UTC

CWE

CWE-394 - Unexpected Status Code or Return Value

Assigner

mitre mitre root Scorecard

References

2 references

URL	Tags
https://github.com/libexpat/libexpat/pull/1326
https://github.com/libexpat/libexpat/pull/1329

Impacted products

1 product

Vendor	Product	Version
libexpat project	libexpat	Affected: 2.8.2 , < 2.8.4 (semver) cpe:2.3:a:libexpat_project:libexpat::::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-76956",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-20T15:05:31.739781Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-20T15:26:28.115Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "libexpat",
          "vendor": "libexpat project",
          "versions": [
            {
              "lessThan": "2.8.4",
              "status": "affected",
              "version": "2.8.2",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:libexpat_project:libexpat:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.8.4",
                  "versionStartIncluding": "2.8.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy\u0027s return code leads to insufficient entropy, which results in being vulnerable to hash flooding attacks, causing a denial of service via crafted XML content."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-394",
              "description": "CWE-394 Unexpected Status Code or Return Value",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-20T17:42:38.849Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://github.com/libexpat/libexpat/pull/1326"
        },
        {
          "url": "https://github.com/libexpat/libexpat/pull/1329"
        }
      ],
      "x_generator": {
        "engine": "CVE-Request-form 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2026-76956",
    "datePublished": "2026-08-20T04:22:51.381Z",
    "dateReserved": "2026-08-20T04:22:50.503Z",
    "dateUpdated": "2026-08-20T17:42:38.849Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-76957 (GCVE-0-2026-76957)

Vulnerability from cvelistv5 – Published: 2026-08-20 04:28 – Updated: 2026-08-20 15:26

Summary

libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412.

Severity

4.9 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-20 15:05 UTC

CWE

CWE-416 - Use After Free

Assigner

mitre mitre root Scorecard

References

2 references

URL	Tags
https://github.com/libexpat/libexpat/pull/1322
https://github.com/libexpat/libexpat/pull/1329

Impacted products

1 product

Vendor	Product	Version
libexpat project	libexpat	Affected: 0 , < 2.8.4 (semver) cpe:2.3:a:libexpat_project:libexpat::::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-76957",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-20T15:05:41.792254Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-20T15:26:27.942Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "libexpat",
          "vendor": "libexpat project",
          "versions": [
            {
              "lessThan": "2.8.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:libexpat_project:libexpat:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.8.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-416",
              "description": "CWE-416 Use After Free",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-20T04:28:04.788Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://github.com/libexpat/libexpat/pull/1322"
        },
        {
          "url": "https://github.com/libexpat/libexpat/pull/1329"
        }
      ],
      "x_generator": {
        "engine": "CVE-Request-form 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2026-76957",
    "datePublished": "2026-08-20T04:28:04.788Z",
    "dateReserved": "2026-08-20T04:28:04.012Z",
    "dateUpdated": "2026-08-20T15:26:27.942Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2026:65568

CVE-2026-56411 (GCVE-0-2026-56411)

CVE-2026-66046 (GCVE-0-2026-66046)

CVE-2026-76641 (GCVE-0-2026-76641)

CVE-2026-76956 (GCVE-0-2026-76956)

CVE-2026-76957 (GCVE-0-2026-76957)

Tags

Sightings

Nomenclature

Related by attack behaviour