ELSA-2026-74001

ELSA-2026-74001 - expat security update

Type:	SECURITY
Impact:	IMPORTANT
Release Date:	2026-10-01

Description

[2.7.3-61]
- CVE-2026-66046 expat: Expat: Denial of Service via quadratic complexity
in attribute processing

[2.7.3-60]
- CVE-2026-93990 expat: Expat: XML Injection via Malformed UTF-16 Input

[2.7.3-59]
- Fix CVE-2026-56132: out-of-bound scaffolding index store in doProlog

[2.7.3-58]
- Fix CVE-2026-50219: forbid XML_ParserFree/Reset from handlers

[2.7.3-57]
- expat: backport CVE-2026-45186 fix (attribute collision check DoS)

[2.7.3-56]
- Rebase to 2.7.3 and add VCS tag

* Thu Jun 05 2025 psklenar@redhat.com
- https://issues.redhat.com/browse/RHELMISC-13073

* Fri Mar 28 2025 Tomas Korbar
- Fix behavior change caused by fix for CVE-2024-8176

* Fri Mar 14 2025 Tomas Korbar
- Fix CVE-2024-8176

* Thu Nov 07 2024 Tomas Korbar
- Rebase to 2.6.4

Related CVEs

CVE-2026-66046

CVE-2026-93990

Updated Packages

Release/Architecture	Filename	sha256	Superseded By Advisory	Channel Label
Oracle Linux 10 (aarch64)	expat-2.7.3-1.el10_2.5.src.rpm	fbf9985fa4c3ba1fb6fdf80da02d8c3e8ead308a0c543e37ba71477f5170a070	-	ol10_aarch64_appstream
	expat-2.7.3-1.el10_2.5.src.rpm	fbf9985fa4c3ba1fb6fdf80da02d8c3e8ead308a0c543e37ba71477f5170a070	-	ol10_aarch64_baseos_latest
	expat-2.7.3-1.el10_2.5.src.rpm	fbf9985fa4c3ba1fb6fdf80da02d8c3e8ead308a0c543e37ba71477f5170a070	-	ol10_aarch64_u2_baseos_patch
	expat-2.7.3-1.el10_2.5.aarch64.rpm	5d13cc27a822e91ff3e2ec9ca52c7a25eb04cb510f6c8ed42dfd7342567bdbfd	-	ol10_aarch64_baseos_latest
	expat-2.7.3-1.el10_2.5.aarch64.rpm	5d13cc27a822e91ff3e2ec9ca52c7a25eb04cb510f6c8ed42dfd7342567bdbfd	-	ol10_aarch64_u2_baseos_patch
	expat-devel-2.7.3-1.el10_2.5.aarch64.rpm	a3ccc635cbbaaff51f59b3d95c02f7b1a0226a1c98ca27141a290d3a75c99c42	-	ol10_aarch64_appstream
Oracle Linux 10 (x86_64)	expat-2.7.3-1.el10_2.5.src.rpm	fbf9985fa4c3ba1fb6fdf80da02d8c3e8ead308a0c543e37ba71477f5170a070	-	ol10_x86_64_appstream
	expat-2.7.3-1.el10_2.5.src.rpm	fbf9985fa4c3ba1fb6fdf80da02d8c3e8ead308a0c543e37ba71477f5170a070	-	ol10_x86_64_baseos_latest
	expat-2.7.3-1.el10_2.5.src.rpm	fbf9985fa4c3ba1fb6fdf80da02d8c3e8ead308a0c543e37ba71477f5170a070	-	ol10_x86_64_u2_baseos_patch
	expat-2.7.3-1.el10_2.5.x86_64.rpm	84c159921eaf4d3d5c66a439ef7f8de926c7908d7a65f9a6d51dd6f09df53d07	-	ol10_x86_64_baseos_latest
	expat-2.7.3-1.el10_2.5.x86_64.rpm	84c159921eaf4d3d5c66a439ef7f8de926c7908d7a65f9a6d51dd6f09df53d07	-	ol10_x86_64_u2_baseos_patch
	expat-devel-2.7.3-1.el10_2.5.x86_64.rpm	ad0f6c0babb6f7cc6e5454b44d1b711c5980901d94db672e617478cad2101e7d	-	ol10_x86_64_appstream

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team