Critical Security Update for Expat: Addressing Denial of Service and XML Injection Vulnerabilities
Summary
ALSA-2026:72663: Important: expat security update. Affects expat versions < 2.5.0-6.el9_8.5. Fixed in 2.5.0-6.el9_8.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Expat is a widely-used C library designed for parsing XML documents efficiently. It is known for its speed and simplicity, making it a popular choice among developers for handling XML data. However, recent vulnerabilities have been discovered that could compromise the security of applications relying on this library, particularly in the areas of attribute processing and UTF-16 input handling.
Vulnerability Detail
The vulnerabilities identified in Expat include a Denial of Service (DoS) attack due to quadratic complexity in attribute processing (CVE-2026-66046) and an XML Injection vulnerability stemming from malformed UTF-16 input (CVE-2026-93990). These vulnerabilities can lead to application crashes or unauthorized data manipulation, posing significant risks to systems that utilize Expat for XML parsing.
How To Fix
Minimum fixed version
2.5.0-6.el9_8.5
This is the first release that contains the fix.
sudo dnf update expatTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit the input size and validate XML documents before processing them with Expat. This can help mitigate the risk of triggering the vulnerabilities until the package is updated.
Conclusion
The recent vulnerabilities in the Expat library highlight the importance of keeping software dependencies up to date. By applying the recommended updates and considering temporary workarounds, developers can safeguard their applications against potential attacks. Regular monitoring for vulnerabilities using tools like Vulert can further enhance security.
See every vulnerability recorded for expat →
FAQ
Expat is a C library for parsing XML documents, known for its efficiency and ease of use.
The vulnerabilities include a Denial of Service due to quadratic complexity in attribute processing and an XML Injection vulnerability from malformed UTF-16 input.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file like package-lock.json. Visit the Vulert playground at Vulert Scanner to check for vulnerabilities without needing to sign up.
If an immediate update is not possible, consider implementing input validation and limiting the size of XML documents processed by Expat as a temporary measure.
For detailed information about the vulnerabilities, including CVSS scores and acknowledgments, refer to the CVE pages for CVE-2026-66046 and CVE-2026-93990.
Related vulnerabilities
Recent vulnerabilities recorded for expat.
