ELSA-2026-72448

Type: Security

Severity: Important

Published: 2026-09-29

Oracle Linux 8

[2.5.0-4] - Fix CVE-2026-66046 in expat - Resolves: RHEL-260142 [2.5.0-3] - CVE-2026-93990 expat: Expat: XML Injection via Malformed UTF-16 Input - Resolves: RHEL-268995

Evidence and freshness

Data current

Last supporting evidence check: 2026-10-24T00:16:31.173Z UTC

Official vendor advisory

Oracle Linux 8

View source

Observed 2026-10-24T00:16:31.173Z UTC. Last updated 2026-09-29T20:19:02.191Z UTC.

Upstream Advisory

View official advisory

Affected Packages

expat 2.5.0-4.el8_10
expat-devel 2.5.0-4.el8_10

Interested in being alerted when there are new versions of expat, etc? Set up an alert.