RHSA-2026:65568

Vulnerability from csaf_redhat - Published: 2026-09-08 17:18 - Updated: 2026-11-11 19:10
Summary
Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
Severity
Important
Notes
Topic: An update for Red Hat Hardened Images RPMs is now available.
Details: This update includes the following RPMs: expat: * expat-2.8.4-0.1.hum1 (aarch64, x86_64) * expat-devel-2.8.4-0.1.hum1 (aarch64, x86_64) * expat-static-2.8.4-0.1.hum1 (aarch64, x86_64) * expat-2.8.4-0.1.hum1.src (src) Security Fix(es): expat: * CVE-2026-66046 * CVE-2026-76641 * CVE-2026-76956 * CVE-2026-76957
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
CVE-2026-56411

A flaw was found in libexpat, a software library used for parsing XML (Extensible Markup Language) documents. An attacker could exploit an integer overflow vulnerability in the `xmlwf` utility by crafting malicious `NOTATION` declarations. This could lead to the disclosure of sensitive information or potentially allow the attacker to execute unauthorized code, impacting the confidentiality and integrity of data.

6.9 (Medium)
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
CWE-190 - Integer Overflow or Wraparound
Affected products
Product Identifier Version Remediation
Unresolved product id: Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@src —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:expat-devel-0:2.8.4-0.1.hum1@aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:expat-devel-0:2.8.4-0.1.hum1@x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:expat-static-0:2.8.4-0.1.hum1@aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:expat-static-0:2.8.4-0.1.hum1@x86_64 —
Vendor Fix fix
Workaround
Threats
Impact Moderate
CVE-2026-66046

A flaw was found in the Expat XML parsing library. A remote, unauthenticated attacker can supply a specially crafted XML document to trigger quadratic algorithmic complexity in the storeAtts() function, causing excessive CPU consumption and a denial of service

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-407 - Inefficient Algorithmic Complexity
Affected products
Fixed 7 products, the same list as for CVE-2026-56411
Threats
Impact Important
CVE-2026-76641

A flaw was found in Expat. Attackers can exploit an out-of-bounds read vulnerability by processing XML with external entity parsers created via XML_ExternalEntityParserCreate. This can lead to memory corruption. Specifically, a mismatch in struct sizes can cause a read past memory boundaries, potentially resulting in a denial of service (DoS) due to a segfault or incorrect handling of XML attributes.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-125 - Out-of-bounds Read
Affected products
Fixed 7 products, the same list as for CVE-2026-56411
Threats
Impact Important
CVE-2026-76956

A flaw was found in libexpat. This vulnerability arises from the software misinterpreting a return code, leading to insufficient randomness (entropy) for hash functions. A remote attacker could exploit this by sending specially crafted XML content, triggering hash flooding attacks. This can result in a denial of service (DoS), making the affected system or application unavailable to legitimate users.

5.9 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-331 - Insufficient Entropy
Affected products
Fixed 7 products, the same list as for CVE-2026-56411
Threats
Impact Moderate
CVE-2026-76957

A flaw was found in libexpat. The library's handling of custom encoding callbacks lacks proper tracking of handler call depth, which can lead to a use-after-free vulnerability. This memory corruption flaw could allow a local attacker to cause a denial of service or potentially execute arbitrary code.

4.9 (Medium)
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
CWE-825 - Expired Pointer Dereference
Affected products
Fixed 7 products, the same list as for CVE-2026-56411
Threats
Impact Moderate
References
URL Category
https://access.redhat.com/errata/RHSA-2026:65568 self
https://access.redhat.com/security/cve/CVE-2026-66046 external
https://access.redhat.com/security/cve/CVE-2026-76641 external
https://access.redhat.com/security/cve/CVE-2026-76956 external
https://access.redhat.com/security/cve/CVE-2026-76957 external
https://access.redhat.com/security/updates/classi… external
https://images.redhat.com/ external
https://access.redhat.com/security/cve/CVE-2026-56411 external
https://security.access.redhat.com/data/csaf/v2/a… self
https://access.redhat.com/security/cve/CVE-2026-56411 self
https://bugzilla.redhat.com/show_bug.cgi?id=2491202 external
https://www.cve.org/CVERecord?id=CVE-2026-56411 external
https://nvd.nist.gov/vuln/detail/CVE-2026-56411 external
https://github.com/libexpat/libexpat/pull/1263 external
https://access.redhat.com/security/cve/CVE-2026-66046 self
https://bugzilla.redhat.com/show_bug.cgi?id=2517901 external
https://www.cve.org/CVERecord?id=CVE-2026-66046 external
https://nvd.nist.gov/vuln/detail/CVE-2026-66046 external
https://github.com/libexpat/libexpat/pull/1321 external
https://www.vulncheck.com/advisories/expat-denial… external
https://access.redhat.com/security/cve/CVE-2026-76641 self
https://bugzilla.redhat.com/show_bug.cgi?id=2520649 external
https://www.cve.org/CVERecord?id=CVE-2026-76641 external
https://nvd.nist.gov/vuln/detail/CVE-2026-76641 external
https://github.com/libexpat/libexpat/commit/98599… external
https://github.com/libexpat/libexpat/pull/1331 external
https://www.vulncheck.com/advisories/expat-out-of… external
https://access.redhat.com/security/cve/CVE-2026-76956 self
https://bugzilla.redhat.com/show_bug.cgi?id=2520124 external
https://www.cve.org/CVERecord?id=CVE-2026-76956 external
https://nvd.nist.gov/vuln/detail/CVE-2026-76956 external
https://github.com/libexpat/libexpat/pull/1326 external
https://access.redhat.com/security/cve/CVE-2026-76957 self
https://bugzilla.redhat.com/show_bug.cgi?id=2520125 external
https://www.cve.org/CVERecord?id=CVE-2026-76957 external
https://nvd.nist.gov/vuln/detail/CVE-2026-76957 external
https://github.com/libexpat/libexpat/pull/1322 external
https://github.com/libexpat/libexpat/pull/1329 external
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for Red Hat Hardened Images RPMs is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This update includes the following RPMs:\n\nexpat:\n  * expat-2.8.4-0.1.hum1 (aarch64, x86_64)\n  * expat-devel-2.8.4-0.1.hum1 (aarch64, x86_64)\n  * expat-static-2.8.4-0.1.hum1 (aarch64, x86_64)\n  * expat-2.8.4-0.1.hum1.src (src)\n\nSecurity Fix(es):\n\nexpat:\n  * CVE-2026-66046\n  * CVE-2026-76641\n  * CVE-2026-76956\n  * CVE-2026-76957",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:65568",
        "url": "https://access.redhat.com/errata/RHSA-2026:65568"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-66046",
        "url": "https://access.redhat.com/security/cve/CVE-2026-66046"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-76641",
        "url": "https://access.redhat.com/security/cve/CVE-2026-76641"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-76956",
        "url": "https://access.redhat.com/security/cve/CVE-2026-76956"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-76957",
        "url": "https://access.redhat.com/security/cve/CVE-2026-76957"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://images.redhat.com/",
        "url": "https://images.redhat.com/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-56411",
        "url": "https://access.redhat.com/security/cve/CVE-2026-56411"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_65568.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
    "tracking": {
      "current_release_date": "2026-11-11T19:10:47+00:00",
      "generator": {
        "date": "2026-11-11T19:10:47+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.5"
        }
      },
      "id": "RHSA-2026:65568",
      "initial_release_date": "2026-09-08T17:18:36+00:00",
      "revision_history": [
        {
          "date": "2026-09-08T17:18:36+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-09-16T20:06:23+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-11-11T19:10:47+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Hardened Images",
                "product": {
                  "name": "Red Hat Hardened Images",
                  "product_id": "Red Hat Hardened Images",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:hummingbird:1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Hardened Images"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "expat-0:2.8.4-0.1.hum1@aarch64",
                "product": {
                  "name": "expat-0:2.8.4-0.1.hum1@aarch64",
                  "product_id": "expat-0:2.8.4-0.1.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/expat@2.8.4-0.1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "expat-devel-0:2.8.4-0.1.hum1@aarch64",
                "product": {
                  "name": "expat-devel-0:2.8.4-0.1.hum1@aarch64",
                  "product_id": "expat-devel-0:2.8.4-0.1.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/expat-devel@2.8.4-0.1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "expat-static-0:2.8.4-0.1.hum1@aarch64",
                "product": {
                  "name": "expat-static-0:2.8.4-0.1.hum1@aarch64",
                  "product_id": "expat-static-0:2.8.4-0.1.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/expat-static@2.8.4-0.1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "expat-0:2.8.4-0.1.hum1@src",
                "product": {
                  "name": "expat-0:2.8.4-0.1.hum1@src",
                  "product_id": "expat-0:2.8.4-0.1.hum1@src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/expat@2.8.4-0.1.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "expat-0:2.8.4-0.1.hum1@x86_64",
                "product": {
                  "name": "expat-0:2.8.4-0.1.hum1@x86_64",
                  "product_id": "expat-0:2.8.4-0.1.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/expat@2.8.4-0.1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "expat-devel-0:2.8.4-0.1.hum1@x86_64",
                "product": {
                  "name": "expat-devel-0:2.8.4-0.1.hum1@x86_64",
                  "product_id": "expat-devel-0:2.8.4-0.1.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/expat-devel@2.8.4-0.1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "expat-static-0:2.8.4-0.1.hum1@x86_64",
                "product": {
                  "name": "expat-static-0:2.8.4-0.1.hum1@x86_64",
                  "product_id": "expat-static-0:2.8.4-0.1.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/expat-static@2.8.4-0.1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "expat-0:2.8.4-0.1.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@aarch64"
        },
        "product_reference": "expat-0:2.8.4-0.1.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "expat-0:2.8.4-0.1.hum1@src as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@src"
        },
        "product_reference": "expat-0:2.8.4-0.1.hum1@src",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "expat-0:2.8.4-0.1.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@x86_64"
        },
        "product_reference": "expat-0:2.8.4-0.1.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "expat-devel-0:2.8.4-0.1.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:expat-devel-0:2.8.4-0.1.hum1@aarch64"
        },
        "product_reference": "expat-devel-0:2.8.4-0.1.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "expat-devel-0:2.8.4-0.1.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:expat-devel-0:2.8.4-0.1.hum1@x86_64"
        },
        "product_reference": "expat-devel-0:2.8.4-0.1.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "expat-static-0:2.8.4-0.1.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:expat-static-0:2.8.4-0.1.hum1@aarch64"
        },
        "product_reference": "expat-static-0:2.8.4-0.1.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "expat-static-0:2.8.4-0.1.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:expat-static-0:2.8.4-0.1.hum1@x86_64"
        },
        "product_reference": "expat-static-0:2.8.4-0.1.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-56411",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "discovery_date": "2026-06-21T17:00:49.451859+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2491202"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in libexpat, a software library used for parsing XML (Extensible Markup Language) documents. An attacker could exploit an integer overflow vulnerability in the `xmlwf` utility by crafting malicious `NOTATION` declarations. This could lead to the disclosure of sensitive information or potentially allow the attacker to execute unauthorized code, impacting the confidentiality and integrity of data.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "expat: libexpat: Integer Overflow Vulnerability Leading to Information Disclosure or Code Execution",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A moderate-impact flaw was found in libexpat (expat), an XML parsing library. An integer overflow exists in the endDoctypeDecl function and can be triggered when parsing a crafted XML document containing malicious NOTATION declarations, for example via the xmlwf utility. An attacker able to supply a malicious XML document that is then processed by an affected application on the local system could exploit this flaw to disclose sensitive information or potentially execute unauthorized code, impacting the confidentiality and integrity of data. Red Hat rates this flaw Moderate severity (CVSS 3.1 score 6.9, vector AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L), consistent with the upstream severity, because exploitation requires local processing of a crafted XML file and the attack complexity is high. Affected Red Hat offerings, including Red Hat Ansible Automation Platform lightspeed chatbot container images, Red Hat OpenShift AI components, Ansible Services, Exploit Intelligence, Insights lightspeed agents, and Red Hat Hardened Images shipping expat, bundle the vulnerable expat library as a dependency. Fixes for the affected products are currently deferred, so the vulnerable expat code remains in the shipped releases until an updated build is delivered; the residual risk is limited by the local attack vector, the high attack complexity, and the requirement to process attacker-crafted XML input.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@aarch64",
          "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@src",
          "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@x86_64",
          "Red Hat Hardened Images:expat-devel-0:2.8.4-0.1.hum1@aarch64",
          "Red Hat Hardened Images:expat-devel-0:2.8.4-0.1.hum1@x86_64",
          "Red Hat Hardened Images:expat-static-0:2.8.4-0.1.hum1@aarch64",
          "Red Hat Hardened Images:expat-static-0:2.8.4-0.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56411"
        },
        {
          "category": "external",
          "summary": "RHBZ#2491202",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491202"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56411",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56411"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56411",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56411"
        },
        {
          "category": "external",
          "summary": "https://github.com/libexpat/libexpat/pull/1263",
          "url": "https://github.com/libexpat/libexpat/pull/1263"
        }
      ],
      "release_date": "2026-06-21T15:56:42.729000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-08T17:18:36+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@src",
            "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@x86_64",
            "Red Hat Hardened Images:expat-devel-0:2.8.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:expat-devel-0:2.8.4-0.1.hum1@x86_64",
            "Red Hat Hardened Images:expat-static-0:2.8.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:expat-static-0:2.8.4-0.1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:65568"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@src",
            "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@x86_64",
            "Red Hat Hardened Images:expat-devel-0:2.8.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:expat-devel-0:2.8.4-0.1.hum1@x86_64",
            "Red Hat Hardened Images:expat-static-0:2.8.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:expat-static-0:2.8.4-0.1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@src",
            "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@x86_64",
            "Red Hat Hardened Images:expat-devel-0:2.8.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:expat-devel-0:2.8.4-0.1.hum1@x86_64",
            "Red Hat Hardened Images:expat-static-0:2.8.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:expat-static-0:2.8.4-0.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "expat: libexpat: Integer Overflow Vulnerability Leading to Information Disclosure or Code Execution"
    },
    {
      "cve": "CVE-2026-66046",
      "cwe": {
        "id": "CWE-407",
        "name": "Inefficient Algorithmic Complexity"
      },
      "discovery_date": "2026-08-18T14:21:00.212292+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2517901"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Expat XML parsing library. A remote, unauthenticated attacker can supply a specially crafted XML document to trigger quadratic algorithmic complexity in the storeAtts() function, causing excessive CPU consumption and a denial of service",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "expat: Expat: Denial of Service via quadratic complexity in attribute processing",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "An Important severity denial of service vulnerability exists in the Expat library due to inefficient algorithmic complexity when processing XML attributes. Applications parsing untrusted XML are susceptible to remote, unauthenticated attacks where a specially crafted XML payload causes excessive CPU exhaustion, ultimately resulting in service unavailability.\n\nThis vulnerability could affect Firefox and Thunderbird, but the DoS attack impact is limited just to the slowdown of tab which loads affected page. The benefit of such attack is questionable, and there are a lot of different ways to cause similar DoS effect. The CVE-2026-76641 fixes CVE-2026-66046.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@aarch64",
          "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@src",
          "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@x86_64",
          "Red Hat Hardened Images:expat-devel-0:2.8.4-0.1.hum1@aarch64",
          "Red Hat Hardened Images:expat-devel-0:2.8.4-0.1.hum1@x86_64",
          "Red Hat Hardened Images:expat-static-0:2.8.4-0.1.hum1@aarch64",
          "Red Hat Hardened Images:expat-static-0:2.8.4-0.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-66046"
        },
        {
          "category": "external",
          "summary": "RHBZ#2517901",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517901"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-66046",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-66046"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-66046",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-66046"
        },
        {
          "category": "external",
          "summary": "https://github.com/libexpat/libexpat/pull/1321",
          "url": "https://github.com/libexpat/libexpat/pull/1321"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/expat-denial-of-service-via-storeatts-quadratic-complexity",
          "url": "https://www.vulncheck.com/advisories/expat-denial-of-service-via-storeatts-quadratic-complexity"
        }
      ],
      "release_date": "2026-08-18T14:10:05.176000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-08T17:18:36+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@src",
            "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@x86_64",
            "Red Hat Hardened Images:expat-devel-0:2.8.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:expat-devel-0:2.8.4-0.1.hum1@x86_64",
            "Red Hat Hardened Images:expat-static-0:2.8.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:expat-static-0:2.8.4-0.1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:65568"
        },
        {
          "category": "workaround",
          "details": "To mitigate, avoid parsing untrusted XML where possible. Where parsing is required, restrict sources using network controls and enforce strict limits on document size, attribute counts, and request rates at the application or proxy level. Additionally, apply strict execution timeouts to cap parser cost and interrupt processes before they can exhaust CPU resources.",
          "product_ids": [
            "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@src",
            "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@x86_64",
            "Red Hat Hardened Images:expat-devel-0:2.8.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:expat-devel-0:2.8.4-0.1.hum1@x86_64",
            "Red Hat Hardened Images:expat-static-0:2.8.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:expat-static-0:2.8.4-0.1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@src",
            "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@x86_64",
            "Red Hat Hardened Images:expat-devel-0:2.8.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:expat-devel-0:2.8.4-0.1.hum1@x86_64",
            "Red Hat Hardened Images:expat-static-0:2.8.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:expat-static-0:2.8.4-0.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "expat: Expat: Denial of Service via quadratic complexity in attribute processing"
    },
    {
      "cve": "CVE-2026-76641",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2026-08-20T17:52:14.726881+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2520649"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Expat. Attackers can exploit an out-of-bounds read vulnerability by processing XML with external entity parsers created via XML_ExternalEntityParserCreate. This can lead to memory corruption. Specifically, a mismatch in struct sizes can cause a read past memory boundaries, potentially resulting in a denial of service (DoS) due to a segfault or incorrect handling of XML attributes.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "expat: Expat: Denial of Service via XML external entity parsing",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Important: An out-of-bounds read vulnerability in Expat can lead to memory corruption and denial of service when processing specially crafted XML with external entity parsers.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@aarch64",
          "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@src",
          "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@x86_64",
          "Red Hat Hardened Images:expat-devel-0:2.8.4-0.1.hum1@aarch64",
          "Red Hat Hardened Images:expat-devel-0:2.8.4-0.1.hum1@x86_64",
          "Red Hat Hardened Images:expat-static-0:2.8.4-0.1.hum1@aarch64",
          "Red Hat Hardened Images:expat-static-0:2.8.4-0.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-76641"
        },
        {
          "category": "external",
          "summary": "RHBZ#2520649",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2520649"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-76641",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-76641"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-76641",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76641"
        },
        {
          "category": "external",
          "summary": "https://github.com/libexpat/libexpat/commit/98599f6dcc2b460410881fe420f5f55d6bec63bf",
          "url": "https://github.com/libexpat/libexpat/commit/98599f6dcc2b460410881fe420f5f55d6bec63bf"
        },
        {
          "category": "external",
          "summary": "https://github.com/libexpat/libexpat/pull/1331",
          "url": "https://github.com/libexpat/libexpat/pull/1331"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/expat-out-of-bounds-read-via-dtdcopy",
          "url": "https://www.vulncheck.com/advisories/expat-out-of-bounds-read-via-dtdcopy"
        }
      ],
      "release_date": "2026-08-20T17:31:10.610000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-08T17:18:36+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@src",
            "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@x86_64",
            "Red Hat Hardened Images:expat-devel-0:2.8.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:expat-devel-0:2.8.4-0.1.hum1@x86_64",
            "Red Hat Hardened Images:expat-static-0:2.8.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:expat-static-0:2.8.4-0.1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:65568"
        },
        {
          "category": "workaround",
          "details": "To mitigate this implement a strict \"accept known good\" input validation strategy that rejects any data failing to match expected specifications. Rigorously validate all length arguments, offsets, and buffer size calculations before using them to access memory boundaries. Additionally, avoid relying solely on sentinels (such as NUL characters) within untrusted input to determine array or buffer lengths. Finally, apply defense-in-depth by combining allowlists with denylists to aggressively drop outright malformed inputs before processing begins.",
          "product_ids": [
            "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@src",
            "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@x86_64",
            "Red Hat Hardened Images:expat-devel-0:2.8.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:expat-devel-0:2.8.4-0.1.hum1@x86_64",
            "Red Hat Hardened Images:expat-static-0:2.8.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:expat-static-0:2.8.4-0.1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@src",
            "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@x86_64",
            "Red Hat Hardened Images:expat-devel-0:2.8.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:expat-devel-0:2.8.4-0.1.hum1@x86_64",
            "Red Hat Hardened Images:expat-static-0:2.8.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:expat-static-0:2.8.4-0.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "expat: Expat: Denial of Service via XML external entity parsing"
    },
    {
      "cve": "CVE-2026-76956",
      "cwe": {
        "id": "CWE-331",
        "name": "Insufficient Entropy"
      },
      "discovery_date": "2026-08-20T04:40:54.658217+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2520124"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in libexpat. This vulnerability arises from the software misinterpreting a return code, leading to insufficient randomness (entropy) for hash functions. A remote attacker could exploit this by sending specially crafted XML content, triggering hash flooding attacks. This can result in a denial of service (DoS), making the affected system or application unavailable to legitimate users.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libexpat: libexpat: Denial of Service via hash flooding attack with crafted XML",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat ships libexpat (packaged as \"expat\") across many products. This vulnerability was introduced in libexpat 2.8.2. Most Red Hat products ship expat versions prior to 2.8.2 and are therefore not affected. Only products shipping expat 2.8.2 or 2.8.3 are vulnerable to this hash flooding denial of service.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@aarch64",
          "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@src",
          "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@x86_64",
          "Red Hat Hardened Images:expat-devel-0:2.8.4-0.1.hum1@aarch64",
          "Red Hat Hardened Images:expat-devel-0:2.8.4-0.1.hum1@x86_64",
          "Red Hat Hardened Images:expat-static-0:2.8.4-0.1.hum1@aarch64",
          "Red Hat Hardened Images:expat-static-0:2.8.4-0.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-76956"
        },
        {
          "category": "external",
          "summary": "RHBZ#2520124",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2520124"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-76956",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-76956"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-76956",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76956"
        },
        {
          "category": "external",
          "summary": "https://github.com/libexpat/libexpat/pull/1326",
          "url": "https://github.com/libexpat/libexpat/pull/1326"
        }
      ],
      "release_date": "2026-08-20T04:22:51.381000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-08T17:18:36+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@src",
            "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@x86_64",
            "Red Hat Hardened Images:expat-devel-0:2.8.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:expat-devel-0:2.8.4-0.1.hum1@x86_64",
            "Red Hat Hardened Images:expat-static-0:2.8.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:expat-static-0:2.8.4-0.1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:65568"
        },
        {
          "category": "workaround",
          "details": "There is no mitigation for this flaw other than updating to libexpat 2.8.4 or later.",
          "product_ids": [
            "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@src",
            "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@x86_64",
            "Red Hat Hardened Images:expat-devel-0:2.8.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:expat-devel-0:2.8.4-0.1.hum1@x86_64",
            "Red Hat Hardened Images:expat-static-0:2.8.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:expat-static-0:2.8.4-0.1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@src",
            "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@x86_64",
            "Red Hat Hardened Images:expat-devel-0:2.8.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:expat-devel-0:2.8.4-0.1.hum1@x86_64",
            "Red Hat Hardened Images:expat-static-0:2.8.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:expat-static-0:2.8.4-0.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "libexpat: libexpat: Denial of Service via hash flooding attack with crafted XML"
    },
    {
      "cve": "CVE-2026-76957",
      "cwe": {
        "id": "CWE-825",
        "name": "Expired Pointer Dereference"
      },
      "discovery_date": "2026-08-20T04:40:57.555835+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2520125"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in libexpat. The library\u0027s handling of custom encoding callbacks lacks proper tracking of handler call depth, which can lead to a use-after-free vulnerability. This memory corruption flaw could allow a local attacker to cause a denial of service or potentially execute arbitrary code.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libexpat: libexpat: Memory corruption vulnerability allows arbitrary code execution or denial of service",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat ships libexpat (packaged as \"expat\") across many products. All versions of expat prior to 2.8.4 are affected by this use-after-free vulnerability. Exploitation requires triggering the vulnerable code path through custom encoding callbacks, which is not a common usage pattern.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@aarch64",
          "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@src",
          "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@x86_64",
          "Red Hat Hardened Images:expat-devel-0:2.8.4-0.1.hum1@aarch64",
          "Red Hat Hardened Images:expat-devel-0:2.8.4-0.1.hum1@x86_64",
          "Red Hat Hardened Images:expat-static-0:2.8.4-0.1.hum1@aarch64",
          "Red Hat Hardened Images:expat-static-0:2.8.4-0.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-76957"
        },
        {
          "category": "external",
          "summary": "RHBZ#2520125",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2520125"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-76957",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-76957"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-76957",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76957"
        },
        {
          "category": "external",
          "summary": "https://github.com/libexpat/libexpat/pull/1322",
          "url": "https://github.com/libexpat/libexpat/pull/1322"
        },
        {
          "category": "external",
          "summary": "https://github.com/libexpat/libexpat/pull/1329",
          "url": "https://github.com/libexpat/libexpat/pull/1329"
        }
      ],
      "release_date": "2026-08-20T04:28:04.788000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-08T17:18:36+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@src",
            "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@x86_64",
            "Red Hat Hardened Images:expat-devel-0:2.8.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:expat-devel-0:2.8.4-0.1.hum1@x86_64",
            "Red Hat Hardened Images:expat-static-0:2.8.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:expat-static-0:2.8.4-0.1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:65568"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@src",
            "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@x86_64",
            "Red Hat Hardened Images:expat-devel-0:2.8.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:expat-devel-0:2.8.4-0.1.hum1@x86_64",
            "Red Hat Hardened Images:expat-static-0:2.8.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:expat-static-0:2.8.4-0.1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@src",
            "Red Hat Hardened Images:expat-0:2.8.4-0.1.hum1@x86_64",
            "Red Hat Hardened Images:expat-devel-0:2.8.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:expat-devel-0:2.8.4-0.1.hum1@x86_64",
            "Red Hat Hardened Images:expat-static-0:2.8.4-0.1.hum1@aarch64",
            "Red Hat Hardened Images:expat-static-0:2.8.4-0.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "libexpat: libexpat: Memory corruption vulnerability allows arbitrary code execution or denial of service"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON
How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.