ELSA-2026-64810-0

ELSA-2026-64810-0 - expat security update

Type:	SECURITY
Impact:	MODERATE
Release Date:	2026-09-08

Description

[2.7.3-59]
- Fix CVE-2026-56132: out-of-bound scaffolding index store in doProlog

[2.7.3-58]
- Fix CVE-2026-50219: forbid XML_ParserFree/Reset from handlers

[2.7.3-57]
- expat: backport CVE-2026-45186 fix (attribute collision check DoS)

[2.7.3-56]
- Rebase to 2.7.3 and add VCS tag

* Thu Jun 05 2025 psklenar@redhat.com
- https://issues.redhat.com/browse/RHELMISC-13073

* Fri Mar 28 2025 Tomas Korbar
- Fix behavior change caused by fix for CVE-2024-8176

* Fri Mar 14 2025 Tomas Korbar
- Fix CVE-2024-8176

* Thu Nov 07 2024 Tomas Korbar
- Rebase to 2.6.4

* Tue Oct 29 2024 Troy Dawson
- Bump release for October 2024 mass rebuild:

* Wed Jul 03 2024 Tomas Korbar
- Rebase to 2.6.2

Related CVEs

CVE-2026-50219

CVE-2026-56132

Updated Packages

Release/Architecture	Filename	sha256	Superseded By Advisory	Channel Label
Oracle Linux 10 (aarch64)	expat-2.7.3-1.el10_2.3.src.rpm	ac9c2dec406794d857cd73adf09864a79ab7c0faa22859cc50613179fdb6c68a	-	ol10_aarch64_appstream
	expat-2.7.3-1.el10_2.3.src.rpm	ac9c2dec406794d857cd73adf09864a79ab7c0faa22859cc50613179fdb6c68a	-	ol10_aarch64_baseos_latest
	expat-2.7.3-1.el10_2.3.src.rpm	ac9c2dec406794d857cd73adf09864a79ab7c0faa22859cc50613179fdb6c68a	-	ol10_aarch64_u2_baseos_patch
	expat-2.7.3-1.el10_2.3.aarch64.rpm	25a15707907d6e1b6365ce521ab6a8a1c4dc42f495a18e2a059562fdad26eb74	-	ol10_aarch64_baseos_latest
	expat-2.7.3-1.el10_2.3.aarch64.rpm	25a15707907d6e1b6365ce521ab6a8a1c4dc42f495a18e2a059562fdad26eb74	-	ol10_aarch64_u2_baseos_patch
	expat-devel-2.7.3-1.el10_2.3.aarch64.rpm	b34278bcac999332be2c2160bbe6167e59c8ee4cfeaa5d2dd0f6debfa122a32f	-	ol10_aarch64_appstream
Oracle Linux 10 (x86_64)	expat-2.7.3-1.el10_2.3.src.rpm	ac9c2dec406794d857cd73adf09864a79ab7c0faa22859cc50613179fdb6c68a	-	ol10_x86_64_appstream
	expat-2.7.3-1.el10_2.3.src.rpm	ac9c2dec406794d857cd73adf09864a79ab7c0faa22859cc50613179fdb6c68a	-	ol10_x86_64_baseos_latest
	expat-2.7.3-1.el10_2.3.src.rpm	ac9c2dec406794d857cd73adf09864a79ab7c0faa22859cc50613179fdb6c68a	-	ol10_x86_64_u2_baseos_patch
	expat-2.7.3-1.el10_2.3.x86_64.rpm	f45fd4d3524d1d721d06a0385ca5e5d7b1c82127ad5a6c5a95a8f51fe14fa84a	-	ol10_x86_64_baseos_latest
	expat-2.7.3-1.el10_2.3.x86_64.rpm	f45fd4d3524d1d721d06a0385ca5e5d7b1c82127ad5a6c5a95a8f51fe14fa84a	-	ol10_x86_64_u2_baseos_patch
	expat-devel-2.7.3-1.el10_2.3.x86_64.rpm	92ddff37822727aaa698171c14b7a334c34df72d8764c365a03db0e9ca0bd72e	-	ol10_x86_64_appstream

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team