https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 17:50:38 +0000 https://cve.radiocsirt.org/vuln/bell-cve-2026-56131 <p><strong>Affected:</strong> Alpaquita:23: expat, Alpaquita:25: expat, Alpaquita:stream: expat, BellSoft Hardened Containers:23: expat, BellSoft Hardened Containers:25: expat, BellSoft Hardened Containers:stream: expat</p> <p><strong>Affected:</strong> Alpaquita:23: expat, Alpaquita:25: expat, Alpaquita:stream: expat, BellSoft Hardened Containers:23: expat, BellSoft Hardened Containers:25: expat, BellSoft Hardened Containers:stream: expat</p> https://cve.radiocsirt.org/vuln/bell-cve-2026-56131 https://cve.radiocsirt.org/vuln/euvd-2026-328902 EUVD-2026-328902 https://cve.radiocsirt.org/vuln/euvd-2026-328902 https://cve.radiocsirt.org/vuln/fkie_cve-2026-56131 <p>libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation. Thus, a use-after-free can occur (similar to the CVE-2026-50219 situation).</p> <p>libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation. Thus, a use-after-free can occur (similar to the CVE-2026-50219 situation).</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-56131 https://cve.radiocsirt.org/vuln/ghsa-fchf-wvcc-qf9g <p>libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation. Thus, a use-after-free can occur (similar to the CVE-2026-50219 situation).</p> <p>libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation. Thus, a use-after-free can occur (similar to the CVE-2026-50219 situation).</p> https://cve.radiocsirt.org/vuln/ghsa-fchf-wvcc-qf9g https://cve.radiocsirt.org/vuln/msrc_cve-2026-56131 msrc_CVE-2026-56131 https://cve.radiocsirt.org/vuln/msrc_cve-2026-56131 https://cve.radiocsirt.org/vuln/oesa-2026-2768 <p><strong>Affected:</strong> openEuler:22.03-LTS-SP4: expat</p> <p>expat is a stream-oriented XML parser library written in C. expat excels with files too large to fit RAM, and where performance and flexibility are crucial. Security Fix(es):</p> <p>libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation. Thus, a use-after-free can occur (similar to the CVE-2026-50219 situation).(CVE-2026-56131)</p> <p>In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold backing array reallocation is mishandled when there is data-structure sharing across parsers.(CVE-2026-56132)</p> <p><strong>Affected:</strong> openEuler:22.03-LTS-SP4: expat</p> <p>expat is a stream-oriented XML parser library written in C. expat excels with files too large to fit RAM, and where performance and flexibility are crucial. Security Fix(es):</p> <p>libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation. Thus, a use-after-free can occur (similar to the CVE-2026-50219 situation).(CVE-2026-56131)</p> <p>In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold backing array reallocation is mishandled when there is data-structure sharing across parsers.(CVE-2026-56132)</p> https://cve.radiocsirt.org/vuln/oesa-2026-2768 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11584-1 <p>expat-2.8.2-1.1 on GA media</p> <p>expat-2.8.2-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:11584-1 https://cve.radiocsirt.org/vuln/rhsa-2026:40486 <p>libexpat: libexpat: Use-after-free vulnerability due to insufficient handler call depth tracking libexpat: libexpat: Arbitrary Code Execution via integer overflow in addBinding libexpat: libexpat: Arbitrary code execution due to integer overflow</p> <p>libexpat: libexpat: Use-after-free vulnerability due to insufficient handler call depth tracking libexpat: libexpat: Arbitrary Code Execution via integer overflow in addBinding libexpat: libexpat: Arbitrary code execution due to integer overflow</p> https://cve.radiocsirt.org/vuln/rhsa-2026:40486 https://cve.radiocsirt.org/vuln/suse-su-2026:23894-1 <p>Security update for expat</p> <p>Security update for expat</p> https://cve.radiocsirt.org/vuln/suse-su-2026:23894-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-56131 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: coin3, Ubuntu:Pro:14.04:LTS: expat, Ubuntu:Pro:14.04:LTS: vnc4, Ubuntu:Pro:14.04:LTS: vtk, Ubuntu:Pro:14.04:LTS: xmlrpc-c, Ubuntu:Pro:16.04:LTS: expat, Ubuntu:Pro:16.04:LTS: ayttm, Ubuntu:Pro:16.04:LTS: cableswig, Ubuntu:16.04:LTS: cadaver, Ubuntu:Pro:16.04:LTS: coin3 and 64 more</p> <p>libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation. Thus, a use-after-free can occur (similar to the CVE-2026-50219 situation).</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: coin3, Ubuntu:Pro:14.04:LTS: expat, Ubuntu:Pro:14.04:LTS: vnc4, Ubuntu:Pro:14.04:LTS: vtk, Ubuntu:Pro:14.04:LTS: xmlrpc-c, Ubuntu:Pro:16.04:LTS: expat, Ubuntu:Pro:16.04:LTS: ayttm, Ubuntu:Pro:16.04:LTS: cableswig, Ubuntu:16.04:LTS: cadaver, Ubuntu:Pro:16.04:LTS: coin3 and 64 more</p> <p>libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation. Thus, a use-after-free can occur (similar to the CVE-2026-50219 situation).</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-56131 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2008 <p>Ein lokaler Angreifer kann mehrere Schwachstellen in expat ausnutzen, um einen Denial of Service Angriff durchzuführen oder potentiell Code auszuführen.</p> <p>Ein lokaler Angreifer kann mehrere Schwachstellen in expat ausnutzen, um einen Denial of Service Angriff durchzuführen oder potentiell Code auszuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2008