ELSA-2026-88248

ELSA-2026-88248 - expat security update

Type:	SECURITY
Impact:	IMPORTANT
Release Date:	2026-10-22

Description

[2.7.3-63]
- CVE-2026-102633 expat: expat: Denial of Service via integer overflow in
expat_realloc

[2.7.3-62]
- CVE-2026-77214 expat: expat: Information disclosure via heap buffer over-
read in XML_ParseBuffer

[2.7.3-61]
- CVE-2026-66046 expat: Expat: Denial of Service via quadratic complexity
in attribute processing

[2.7.3-60]
- CVE-2026-93990 expat: Expat: XML Injection via Malformed UTF-16 Input

[2.7.3-59]
- Fix CVE-2026-56132: out-of-bound scaffolding index store in doProlog

[2.7.3-58]
- Fix CVE-2026-50219: forbid XML_ParserFree/Reset from handlers

[2.7.3-57]
- expat: backport CVE-2026-45186 fix (attribute collision check DoS)

[2.7.3-56]
- Rebase to 2.7.3 and add VCS tag

* Thu Jun 05 2025 psklenar@redhat.com
- https://issues.redhat.com/browse/RHELMISC-13073

* Fri Mar 28 2025 Tomas Korbar
- Fix behavior change caused by fix for CVE-2024-8176

Related CVEs

CVE-2026-102633

CVE-2026-77214

Updated Packages

Release/Architecture	Filename	sha256	Superseded By Advisory	Channel Label
Oracle Linux 10 (aarch64)	expat-2.7.3-1.el10_2.7.src.rpm	a35d6fb7c349bac39b4ff4b71e8b082df4bd606d2fd1045b54bafd8f2f54e400	-	ol10_aarch64_appstream
	expat-2.7.3-1.el10_2.7.src.rpm	a35d6fb7c349bac39b4ff4b71e8b082df4bd606d2fd1045b54bafd8f2f54e400	-	ol10_aarch64_baseos_latest
	expat-2.7.3-1.el10_2.7.src.rpm	a35d6fb7c349bac39b4ff4b71e8b082df4bd606d2fd1045b54bafd8f2f54e400	-	ol10_aarch64_u2_baseos_patch
	expat-2.7.3-1.el10_2.7.aarch64.rpm	9e8211bc09ecc270d217fd2adaf3c996d37fdb05fd248ce5640cbb64ab19ffb7	-	ol10_aarch64_baseos_latest
	expat-2.7.3-1.el10_2.7.aarch64.rpm	9e8211bc09ecc270d217fd2adaf3c996d37fdb05fd248ce5640cbb64ab19ffb7	-	ol10_aarch64_u2_baseos_patch
	expat-devel-2.7.3-1.el10_2.7.aarch64.rpm	5e2a29b97dab341eeceacd3bb1c38e4ce713d8d9d441a58c2f9715e23553eab1	-	ol10_aarch64_appstream
Oracle Linux 10 (x86_64)	expat-2.7.3-1.el10_2.7.src.rpm	a35d6fb7c349bac39b4ff4b71e8b082df4bd606d2fd1045b54bafd8f2f54e400	-	ol10_x86_64_appstream
	expat-2.7.3-1.el10_2.7.src.rpm	a35d6fb7c349bac39b4ff4b71e8b082df4bd606d2fd1045b54bafd8f2f54e400	-	ol10_x86_64_baseos_latest
	expat-2.7.3-1.el10_2.7.src.rpm	a35d6fb7c349bac39b4ff4b71e8b082df4bd606d2fd1045b54bafd8f2f54e400	-	ol10_x86_64_u2_baseos_patch
	expat-2.7.3-1.el10_2.7.x86_64.rpm	3af5a07bd9831b98410b297216e59b4aa824c3c26864401aea3c3a7246dbce35	-	ol10_x86_64_baseos_latest
	expat-2.7.3-1.el10_2.7.x86_64.rpm	3af5a07bd9831b98410b297216e59b4aa824c3c26864401aea3c3a7246dbce35	-	ol10_x86_64_u2_baseos_patch
	expat-devel-2.7.3-1.el10_2.7.x86_64.rpm	188106aa9c892f7ef2f8bf0fe3a93c75f4cbd080f2f9f49cee25a45d4ffe48b6	-	ol10_x86_64_appstream

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team