ELSA-2026-72663

Type: Security

Severity: Unknown

Published: 2026-09-28

Oracle Linux 9

[2.5.0-6.5] - Fix CVE-2026-66046: dtdCopy out-of-bounds access via isCdata hash lookup - Resolves: RHEL-260179 [2.5.0-6.4] - CVE-2026-93990 expat: Expat: XML Injection via Malformed UTF-16 Input - Resolves: RHEL-269002

Evidence and freshness

Data current

Last supporting evidence check: 2026-10-24T11:41:45.645Z UTC

Official vendor advisory

Oracle Linux 9

View source

Observed 2026-10-24T11:41:45.645Z UTC. Last updated 2026-09-29T10:04:50.918Z UTC.

Upstream Advisory

View official advisory

Affected Packages

expat 2.5.0-6.el9_8.5
expat-devel 2.5.0-6.el9_8.5
expat-devel 2.5.0-6.el9_8.5

Interested in being alerted when there are new versions of expat, etc? Set up an alert.