UnratedFix available
expat vulnerabilities
It was discovered that Expat did not correctly handle certain integer arithmetic. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-56406, CVE-2026-56407, CVE-2026-56409, CVE-2026-56410, CVE-2026-56411) It was discovered that Expat did not correctly track handler call depth. An attacker could possibly use this issue to cause Expat to crash or execute arbitrary code. (CVE-2026-56131) It was discovered that Expat did not correctly handle certain memory operations. An attacker could possibly use this issue to cause Expat to crash or execute arbitrary code. (CVE-2026-56132) It was discovered that Expat did not correctly handle certain Unicode characters. An attacker could possibly use this issue to cause Expat to use excessive resources, leading to a denial of service. (CVE-2026-72522) It was discovered that Expat did not correctly process certain XML attributes. A remote attacker could possibly use this issue to cause Expat to use excessive resources, leading to a denial of service. (CVE-2026-66046) It was discovered that Expat did not correctly handle certain external entities. An attacker could possibly use this issue to cause Expat to crash or execute arbitrary code. (CVE-2026-76641) It was discovered that Expat did not correctly track handler call depth with custom encodings. An attacker could possibly use this issue to cause Expat to crash or execute arbitrary code. (CVE-2026-76957)
Announced Source revision 1
Original source ↗USN-8813-1
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:USN-8813-1
expat
Source reference: /affected/0/package/name
- Affected versions
- 2.1.0-4
Source reference:
/affected/0/versions2.1.0-4ubuntu1Source reference:
/affected/0/versions2.1.0-4ubuntu1.1Source reference:
/affected/0/versions2.1.0-4ubuntu1.2Source reference:
/affected/0/versions2.1.0-4ubuntu1.3Source reference:
/affected/0/versions2.1.0-4ubuntu1.4Source reference:
/affected/0/versions2.1.0-4ubuntu1.4+esm1Source reference:
/affected/0/versions2.1.0-4ubuntu1.4+esm2Source reference:
/affected/0/versions2.1.0-4ubuntu1.4+esm4Source reference:
/affected/0/versions2.1.0-4ubuntu1.4+esm6Source reference:
/affected/0/versions2.1.0-4ubuntu1.4+esm7Source reference:
/affected/0/versions2.1.0-4ubuntu1.4+esm8Source reference:
/affected/0/versions2.1.0-4ubuntu1.4+esm9Source reference:
/affected/0/versions2.1.0-4ubuntu1.4+esm10Source reference:
/affected/0/versions2.1.0-4ubuntu1.4+esm11Source reference:
/affected/0/versions2.1.0-4ubuntu1.4+esm12Source reference:
/affected/0/versions - Fixed versions
- 2.1.0-4ubuntu1.4+esm13
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
expat
Source reference: /affected/1/package/name
- Affected versions
- 2.1.0-7
Source reference:
/affected/1/versions2.1.0-7ubuntu0.16.04.1Source reference:
/affected/1/versions2.1.0-7ubuntu0.16.04.2Source reference:
/affected/1/versions2.1.0-7ubuntu0.16.04.3Source reference:
/affected/1/versions2.1.0-7ubuntu0.16.04.4Source reference:
/affected/1/versions2.1.0-7ubuntu0.16.04.5Source reference:
/affected/1/versions2.1.0-7ubuntu0.16.04.5+esm2Source reference:
/affected/1/versions2.1.0-7ubuntu0.16.04.5+esm5Source reference:
/affected/1/versions2.1.0-7ubuntu0.16.04.5+esm6Source reference:
/affected/1/versions2.1.0-7ubuntu0.16.04.5+esm7Source reference:
/affected/1/versions2.1.0-7ubuntu0.16.04.5+esm8Source reference:
/affected/1/versions2.1.0-7ubuntu0.16.04.5+esm9Source reference:
/affected/1/versions2.1.0-7ubuntu0.16.04.5+esm10Source reference:
/affected/1/versions2.1.0-7ubuntu0.16.04.5+esm11Source reference:
/affected/1/versions2.1.0-7ubuntu0.16.04.5+esm12Source reference:
/affected/1/versions2.1.0-7ubuntu0.16.04.5+esm13Source reference:
/affected/1/versions - Fixed versions
- 2.1.0-7ubuntu0.16.04.5+esm14
Source reference:
/affected/1/ranges - Prerequisites
- Not stated in this record
expat
Source reference: /affected/2/package/name
- Affected versions
- 2.2.3-1
Source reference:
/affected/2/versions2.2.3-2Source reference:
/affected/2/versions2.2.5-0ubuntu2Source reference:
/affected/2/versions2.2.5-3Source reference:
/affected/2/versions2.2.5-3ubuntu0.1Source reference:
/affected/2/versions2.2.5-3ubuntu0.2Source reference:
/affected/2/versions2.2.5-3ubuntu0.4Source reference:
/affected/2/versions2.2.5-3ubuntu0.7Source reference:
/affected/2/versions2.2.5-3ubuntu0.8Source reference:
/affected/2/versions2.2.5-3ubuntu0.9Source reference:
/affected/2/versions2.2.5-3ubuntu0.9+esm1Source reference:
/affected/2/versions2.2.5-3ubuntu0.9+esm2Source reference:
/affected/2/versions2.2.5-3ubuntu0.9+esm3Source reference:
/affected/2/versions2.2.5-3ubuntu0.9+esm4Source reference:
/affected/2/versions - Fixed versions
- 2.2.5-3ubuntu0.9+esm5
Source reference:
/affected/2/ranges - Prerequisites
- Not stated in this record
expat
Source reference: /affected/3/package/name
- Affected versions
- 2.2.7-2
Source reference:
/affected/3/versions2.2.9-1Source reference:
/affected/3/versions2.2.9-1build1Source reference:
/affected/3/versions2.2.9-1ubuntu0.2Source reference:
/affected/3/versions2.2.9-1ubuntu0.4Source reference:
/affected/3/versions2.2.9-1ubuntu0.5Source reference:
/affected/3/versions2.2.9-1ubuntu0.6Source reference:
/affected/3/versions2.2.9-1ubuntu0.7Source reference:
/affected/3/versions2.2.9-1ubuntu0.8Source reference:
/affected/3/versions2.2.9-1ubuntu0.8+esm1Source reference:
/affected/3/versions2.2.9-1ubuntu0.8+esm2Source reference:
/affected/3/versions - Fixed versions
- 2.2.9-1ubuntu0.8+esm3
Source reference:
/affected/3/ranges - Prerequisites
- Not stated in this record
expat
Source reference: /affected/4/package/name
- Affected versions
- 2.4.1-2
Source reference:
/affected/4/versions2.4.1-3Source reference:
/affected/4/versions2.4.2-1Source reference:
/affected/4/versions2.4.3-1Source reference:
/affected/4/versions2.4.3-2Source reference:
/affected/4/versions2.4.4-1Source reference:
/affected/4/versions2.4.6-1Source reference:
/affected/4/versions2.4.7-1Source reference:
/affected/4/versions2.4.7-1ubuntu0.1Source reference:
/affected/4/versions2.4.7-1ubuntu0.2Source reference:
/affected/4/versions2.4.7-1ubuntu0.3Source reference:
/affected/4/versions2.4.7-1ubuntu0.4Source reference:
/affected/4/versions2.4.7-1ubuntu0.5Source reference:
/affected/4/versions2.4.7-1ubuntu0.6Source reference:
/affected/4/versions2.4.7-1ubuntu0.7Source reference:
/affected/4/versions2.4.7-1ubuntu0.8Source reference:
/affected/4/versions - Fixed versions
- 2.4.7-1ubuntu0.9
Source reference:
/affected/4/ranges - Prerequisites
- Not stated in this record
expat
Source reference: /affected/5/package/name
- Affected versions
- 2.5.0-2
Source reference:
/affected/5/versions2.6.0-1Source reference:
/affected/5/versions2.6.1-2Source reference:
/affected/5/versions2.6.1-2build1Source reference:
/affected/5/versions2.6.1-2ubuntu0.1Source reference:
/affected/5/versions2.6.1-2ubuntu0.2Source reference:
/affected/5/versions2.6.1-2ubuntu0.3Source reference:
/affected/5/versions2.6.1-2ubuntu0.4Source reference:
/affected/5/versions2.6.1-2ubuntu0.5Source reference:
/affected/5/versions - Fixed versions
- 2.6.1-2ubuntu0.6
Source reference:
/affected/5/ranges - Prerequisites
- Not stated in this record
expat
Source reference: /affected/6/package/name
- Affected versions
- 2.7.1-2
Source reference:
/affected/6/versions2.7.3-1Source reference:
/affected/6/versions2.7.4-1Source reference:
/affected/6/versions2.7.4-1ubuntu0.1Source reference:
/affected/6/versions - Fixed versions
- 2.7.4-1ubuntu0.2
Source reference:
/affected/6/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.1.0-4ubuntu1.4+esm13"
}
]
}
],
"package": {
"name": "expat",
"purl": "pkg:deb/ubuntu/expat?arch=source&distro=esm-infra-legacy%2Ftrusty",
"ecosystem": "Ubuntu:Pro:14.04:LTS"
},
"versions": [
"2.1.0-4",
"2.1.0-4ubuntu1",
"2.1.0-4ubuntu1.1",
"2.1.0-4ubuntu1.2",
"2.1.0-4ubuntu1.3",
"2.1.0-4ubuntu1.4",
"2.1.0-4ubuntu1.4+esm1",
"2.1.0-4ubuntu1.4+esm2",
"2.1.0-4ubuntu1.4+esm4",
"2.1.0-4ubuntu1.4+esm6",
"2.1.0-4ubuntu1.4+esm7",
"2.1.0-4ubuntu1.4+esm8",
"2.1.0-4ubuntu1.4+esm9",
"2.1.0-4ubuntu1.4+esm10",
"2.1.0-4ubuntu1.4+esm11",
"2.1.0-4ubuntu1.4+esm12"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8813-1.json",
"cves_map": {
"cves": [
{
"id": "CVE-2026-56131",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-56132",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L"
},
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-56406",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-56407",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-56409",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-56410",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-66046",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-72522",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-76641",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-76957",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
}
],
"ecosystem": "Ubuntu:Pro:14.04:LTS"
}
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "expat",
"binary_version": "2.1.0-4ubuntu1.4+esm13"
},
{
"binary_name": "lib64expat1",
"binary_version": "2.1.0-4ubuntu1.4+esm13"
},
{
"binary_name": "libexpat1",
"binary_version": "2.1.0-4ubuntu1.4+esm13"
}
],
"availability": "Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.1.0-7ubuntu0.16.04.5+esm14"
}
]
}
],
"package": {
"name": "expat",
"purl": "pkg:deb/ubuntu/expat?arch=source&distro=esm-infra-legacy%2Fxenial",
"ecosystem": "Ubuntu:Pro:16.04:LTS"
},
"versions": [
"2.1.0-7",
"2.1.0-7ubuntu0.16.04.1",
"2.1.0-7ubuntu0.16.04.2",
"2.1.0-7ubuntu0.16.04.3",
"2.1.0-7ubuntu0.16.04.4",
"2.1.0-7ubuntu0.16.04.5",
"2.1.0-7ubuntu0.16.04.5+esm2",
"2.1.0-7ubuntu0.16.04.5+esm5",
"2.1.0-7ubuntu0.16.04.5+esm6",
"2.1.0-7ubuntu0.16.04.5+esm7",
"2.1.0-7ubuntu0.16.04.5+esm8",
"2.1.0-7ubuntu0.16.04.5+esm9",
"2.1.0-7ubuntu0.16.04.5+esm10",
"2.1.0-7ubuntu0.16.04.5+esm11",
"2.1.0-7ubuntu0.16.04.5+esm12",
"2.1.0-7ubuntu0.16.04.5+esm13"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8813-1.json",
"cves_map": {
"cves": [
{
"id": "CVE-2026-56131",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-56132",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L"
},
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-56406",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-56407",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-56409",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-56410",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-66046",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-72522",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-76641",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-76957",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
}
],
"ecosystem": "Ubuntu:Pro:16.04:LTS"
}
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "expat",
"binary_version": "2.1.0-7ubuntu0.16.04.5+esm14"
},
{
"binary_name": "lib64expat1",
"binary_version": "2.1.0-7ubuntu0.16.04.5+esm14"
},
{
"binary_name": "libexpat1",
"binary_version": "2.1.0-7ubuntu0.16.04.5+esm14"
}
],
"availability": "Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.2.5-3ubuntu0.9+esm5"
}
]
}
],
"package": {
"name": "expat",
"purl": "pkg:deb/ubuntu/expat?arch=source&distro=esm-infra%2Fbionic",
"ecosystem": "Ubuntu:Pro:18.04:LTS"
},
"versions": [
"2.2.3-1",
"2.2.3-2",
"2.2.5-0ubuntu2",
"2.2.5-3",
"2.2.5-3ubuntu0.1",
"2.2.5-3ubuntu0.2",
"2.2.5-3ubuntu0.4",
"2.2.5-3ubuntu0.7",
"2.2.5-3ubuntu0.8",
"2.2.5-3ubuntu0.9",
"2.2.5-3ubuntu0.9+esm1",
"2.2.5-3ubuntu0.9+esm2",
"2.2.5-3ubuntu0.9+esm3",
"2.2.5-3ubuntu0.9+esm4"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8813-1.json",
"cves_map": {
"cves": [
{
"id": "CVE-2026-56131",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-56132",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L"
},
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-56406",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-56407",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-56409",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-56410",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-56411",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-66046",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-72522",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-76641",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-76957",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
}
],
"ecosystem": "Ubuntu:Pro:18.04:LTS"
}
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "expat",
"binary_version": "2.2.5-3ubuntu0.9+esm5"
},
{
"binary_name": "libexpat1",
"binary_version": "2.2.5-3ubuntu0.9+esm5"
}
],
"availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.2.9-1ubuntu0.8+esm3"
}
]
}
],
"package": {
"name": "expat",
"purl": "pkg:deb/ubuntu/expat?arch=source&distro=esm-infra%2Ffocal",
"ecosystem": "Ubuntu:Pro:20.04:LTS"
},
"versions": [
"2.2.7-2",
"2.2.9-1",
"2.2.9-1build1",
"2.2.9-1ubuntu0.2",
"2.2.9-1ubuntu0.4",
"2.2.9-1ubuntu0.5",
"2.2.9-1ubuntu0.6",
"2.2.9-1ubuntu0.7",
"2.2.9-1ubuntu0.8",
"2.2.9-1ubuntu0.8+esm1",
"2.2.9-1ubuntu0.8+esm2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8813-1.json",
"cves_map": {
"cves": [
{
"id": "CVE-2026-56131",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-56132",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L"
},
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-56406",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-56407",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-56409",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-56410",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-56411",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-66046",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-72522",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-76641",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-76957",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
}
],
"ecosystem": "Ubuntu:Pro:20.04:LTS"
}
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "expat",
"binary_version": "2.2.9-1ubuntu0.8+esm3"
},
{
"binary_name": "libexpat1",
"binary_version": "2.2.9-1ubuntu0.8+esm3"
}
],
"availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.4.7-1ubuntu0.9"
}
]
}
],
"package": {
"name": "expat",
"purl": "pkg:deb/ubuntu/expat?arch=source&distro=jammy",
"ecosystem": "Ubuntu:22.04:LTS"
},
"versions": [
"2.4.1-2",
"2.4.1-3",
"2.4.2-1",
"2.4.3-1",
"2.4.3-2",
"2.4.4-1",
"2.4.6-1",
"2.4.7-1",
"2.4.7-1ubuntu0.1",
"2.4.7-1ubuntu0.2",
"2.4.7-1ubuntu0.3",
"2.4.7-1ubuntu0.4",
"2.4.7-1ubuntu0.5",
"2.4.7-1ubuntu0.6",
"2.4.7-1ubuntu0.7",
"2.4.7-1ubuntu0.8"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8813-1.json",
"cves_map": {
"cves": [
{
"id": "CVE-2026-56131",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-56132",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L"
},
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-56406",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-56407",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-56409",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-56410",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-56411",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-66046",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-72522",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-76641",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-76957",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
}
],
"ecosystem": "Ubuntu:22.04:LTS"
}
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "expat",
"binary_version": "2.4.7-1ubuntu0.9"
},
{
"binary_name": "libexpat1",
"binary_version": "2.4.7-1ubuntu0.9"
}
],
"availability": "No subscription required"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.6.1-2ubuntu0.6"
}
]
}
],
"package": {
"name": "expat",
"purl": "pkg:deb/ubuntu/expat?arch=source&distro=noble",
"ecosystem": "Ubuntu:24.04:LTS"
},
"versions": [
"2.5.0-2",
"2.6.0-1",
"2.6.1-2",
"2.6.1-2build1",
"2.6.1-2ubuntu0.1",
"2.6.1-2ubuntu0.2",
"2.6.1-2ubuntu0.3",
"2.6.1-2ubuntu0.4",
"2.6.1-2ubuntu0.5"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8813-1.json",
"cves_map": {
"cves": [
{
"id": "CVE-2026-56131",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-56132",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L"
},
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-56406",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-56407",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-56409",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-56410",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-56411",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-66046",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-72522",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-76641",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-76957",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
}
],
"ecosystem": "Ubuntu:24.04:LTS"
}
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "expat",
"binary_version": "2.6.1-2ubuntu0.6"
},
{
"binary_name": "libexpat1",
"binary_version": "2.6.1-2ubuntu0.6"
}
],
"availability": "No subscription required"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.7.4-1ubuntu0.2"
}
]
}
],
"package": {
"name": "expat",
"purl": "pkg:deb/ubuntu/expat?arch=source&distro=resolute",
"ecosystem": "Ubuntu:26.04:LTS"
},
"versions": [
"2.7.1-2",
"2.7.3-1",
"2.7.4-1",
"2.7.4-1ubuntu0.1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8813-1.json",
"cves_map": {
"cves": [
{
"id": "CVE-2026-56131",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-56132",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L"
},
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-56406",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-56407",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-56409",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-56410",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-56411",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-66046",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-72522",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-76641",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-76957",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
}
],
"ecosystem": "Ubuntu:26.04:LTS"
}
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "expat",
"binary_version": "2.7.4-1ubuntu0.2"
},
{
"binary_name": "libexpat1",
"binary_version": "2.7.4-1ubuntu0.2"
}
],
"availability": "No subscription required"
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #14644 · Revision 1
- Added to Heist Feed
- Publisher date