ELSA-2026-74001

Type: Security

Severity: Unknown

Published: 2026-10-01

Oracle Linux 10

[2.7.3-61] - CVE-2026-66046 expat: Expat: Denial of Service via quadratic complexity in attribute processing [2.7.3-60] - CVE-2026-93990 expat: Expat: XML Injection via Malformed UTF-16 Input [2.7.3-59] - Fix CVE-2026-56132: out-of-bound scaffolding index store in doProlog [2.7.3-58] - Fix CVE-2026-50219: forbid XML_ParserFree/Reset from handlers [2.7.3-57] - expat: backport CVE-2026-45186 fix (attribute collision check DoS) [2.7.3-56] - Rebase to 2.7.3 and add VCS tag * Thu Jun 05 2025 [email protected] <[email protected]> - https://issues.redhat.com/browse/RHELMISC-13073 * Fri Mar 28 2025 Tomas Korbar <[email protected]> - Fix behavior change caused by fix for CVE-2024-8176 * Fri Mar 14 2025 Tomas Korbar <[email protected]> - Fix CVE-2024-8176 * Thu Nov 07 2024 Tomas Korbar <[email protected]> - Rebase to 2.6.4

Evidence and freshness

Data current

Last supporting evidence check: 2026-10-24T11:41:45.645Z UTC

Official vendor advisory

Oracle Linux 10

View source

Observed 2026-10-24T11:41:45.645Z UTC. Last updated 2026-10-01T19:19:11.544Z UTC.

Upstream Advisory

View official advisory

Affected Packages

expat 2.7.3-1.el10_2.5
expat 2.7.3-1.el10_2.5

Interested in being alerted when there are new versions of expat, etc? Set up an alert.