UnratedFix available

Security update for expat

Type: advisorySources: OSV

This update for expat fixes the following issues: - CVE-2025-59375: denial of service (resource consumption) caused by processing malformed small documents (bsc#1249584). - CVE-2026-24515: NULL dereference (CWE-476) due to function XML_ExternalEntityParserCreate() failing to copy the encoding handler data passed to XML_SetUnknownEncodingHandler() from the parent to the subparser (bsc#1257144). - CVE-2026-25210: lack of buffer size check can lead to an integer overflow (bsc#1257496). - CVE-2026-32776: NULL pointer dereference when processing empty external parameter entities inside an entity declaration value (bsc#1259726). - CVE-2026-32777: denial of service due to infinite loop in DTD content parsing (bsc#1259711). - CVE-2026-32778: NULL pointer dereference in `setContext` on retry after an out-of-memory condition (bsc#1259729). - CVE-2026-41080: crafted XML document can cause a denial of service (bsc#1262263). - CVE-2026-45186: denial of service via moderately sized crafted XML input (bsc#1264713). - CVE-2026-50219: lack of handler call depth tracking for calls to XML_* functions from within handlers in cases of a policy violation (bsc#1267631). - CVE-2026-56131: lack of handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation (bsc#1268572). - CVE-2026-56132: heap-based buffer overflow in doProlog in xmlparse.c (bsc#1268573). - CVE-2026-56403,CVE-2026-56404,CVE-2026-56405,CVE-2026-56406, CVE-2026-56407,CVE-2026-56408,CVE-

Products: expat
Affected versions: Not specified
Fixed versions: 2.8.5-150700.3.15.1
CVEs: CVE-2025-59375, CVE-2026-102633, CVE-2026-24515, CVE-2026-25210, CVE-2026-32776, CVE-2026-32777, CVE-2026-32778, CVE-2026-41080, CVE-2026-45186, CVE-2026-50219, CVE-2026-56131, CVE-2026-56132, CVE-2026-56403, CVE-2026-56404, CVE-2026-56405, CVE-2026-56406, CVE-2026-56407, CVE-2026-56408, CVE-2026-56409, CVE-2026-56410, CVE-2026-56411, CVE-2026-56412, CVE-2026-66046, CVE-2026-72522, CVE-2026-76641, CVE-2026-76956, CVE-2026-76957, CVE-2026-77214, CVE-2026-93990
Confirmed fixed CVEs: Not specified
Updated in this feed: 31 Oct 2026, 08:03 UTC · Revision 1

Source evidence

Security update for expat

core-osv · Original source

Published 19 Oct 2026, 08:29 UTC

osv:SUSE-SU-2026:4619-1

expat

Fixed versions: 2.8.5-150700.3.15.1

Complete source record

{
  "id": "0e60e2097e0d097ed93a1e278f04fa33ee761613b93331602d2e8e72c8f8474c",
  "url": "https://osv.dev/vulnerability/SUSE-SU-2026%3A4619-1",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Security update for expat",
    "summary": "This update for expat fixes the following issues: - CVE-2025-59375: denial of service (resource consumption) caused by processing malformed small documents (bsc#1249584). - CVE-2026-24515: NULL dereference (CWE-476) due to function XML_ExternalEntityParserCreate() failing to copy the encoding handler data passed to XML_SetUnknownEncodingHandler() from the parent to the subparser (bsc#1257144). - CVE-2026-25210: lack of buffer size check can lead to an integer overflow (bsc#1257496). - CVE-2026-32776: NULL pointer dereference when processing empty external parameter entities inside an entity declaration value (bsc#1259726). - CVE-2026-32777: denial of service due to infinite loop in DTD content parsing (bsc#1259711). - CVE-2026-32778: NULL pointer dereference in `setContext` on retry after an out-of-memory condition (bsc#1259729). - CVE-2026-41080: crafted XML document can cause a denial of service (bsc#1262263). - CVE-2026-45186: denial of service via moderately sized crafted XML input (bsc#1264713). - CVE-2026-50219: lack of handler call depth tracking for calls to XML_* functions from within handlers in cases of a policy violation (bsc#1267631). - CVE-2026-56131: lack of handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation (bsc#1268572). - CVE-2026-56132: heap-based buffer overflow in doProlog in xmlparse.c (bsc#1268573). - CVE-2026-56403,CVE-2026-56404,CVE-2026-56405,CVE-2026-56406, CVE-2026-56407,CVE-2026-56408,CVE-",
    "evidence": "osv:SUSE-SU-2026:4619-1",
    "products": [
      {
        "name": {
          "value": "expat",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "2.8.5-150700.3.15.1",
            "evidence": "/affected/0/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "SUSE-SU-2026:4619-1",
      "aliases": [
        "SUSE-SU-2026:4619-1"
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "2.8.5-150700.3.15.1"
                }
              ]
            }
          ],
          "package": {
            "name": "expat",
            "purl": "pkg:rpm/suse/expat&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP7",
            "ecosystem": "SUSE:Linux Enterprise Module for Basesystem 15 SP7"
          },
          "database_specific": {
            "source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4619-1.json"
          },
          "ecosystem_specific": {
            "binaries": [
              {
                "expat": "2.8.5-150700.3.15.1",
                "libexpat1": "2.8.5-150700.3.15.1",
                "libexpat-devel": "2.8.5-150700.3.15.1",
                "libexpat1-32bit": "2.8.5-150700.3.15.1"
              }
            ]
          }
        }
      ],
      "modified": "2026-10-19T09:43:18.179140646Z",
      "provider": "osv",
      "upstream": [
        "CVE-2025-59375",
        "CVE-2026-102633",
        "CVE-2026-24515",
        "CVE-2026-25210",
        "CVE-2026-32776",
        "CVE-2026-32777",
        "CVE-2026-32778",
        "CVE-2026-41080",
        "CVE-2026-45186",
        "CVE-2026-50219",
        "CVE-2026-56131",
        "CVE-2026-56132",
        "CVE-2026-56403",
        "CVE-2026-56404",
        "CVE-2026-56405",
        "CVE-2026-56406",
        "CVE-2026-56407",
        "CVE-2026-56408",
        "CVE-2026-56409",
        "CVE-2026-56410",
        "CVE-2026-56411",
        "CVE-2026-56412",
        "CVE-2026-66046",
        "CVE-2026-72522",
        "CVE-2026-76641",
        "CVE-2026-76956",
        "CVE-2026-76957",
        "CVE-2026-77214",
        "CVE-2026-93990"
      ],
      "references": [
        "https://www.suse.com/support/update/announcement/2026/suse-su-20264619-1/",
        "https://bugzilla.suse.com/1249584",
        "https://bugzilla.suse.com/1257144",
        "https://bugzilla.suse.com/1257496",
        "https://bugzilla.suse.com/1259711",
        "https://bugzilla.suse.com/1259726",
        "https://bugzilla.suse.com/1259729",
        "https://bugzilla.suse.com/1262263",
        "https://bugzilla.suse.com/1264713",
        "https://bugzilla.suse.com/1267631",
        "https://bugzilla.suse.com/1268572",
        "https://bugzilla.suse.com/1268573",
        "https://bugzilla.suse.com/1275115",
        "https://bugzilla.suse.com/1275594",
        "https://bugzilla.suse.com/1275732",
        "https://bugzilla.suse.com/1275859",
        "https://bugzilla.suse.com/1275860",
        "https://bugzilla.suse.com/1275915",
        "https://bugzilla.suse.com/1282347",
        "https://bugzilla.suse.com/1283493",
        "https://bugzilla.suse.com/1284334",
        "https://www.suse.com/security/cve/CVE-2025-59375",
        "https://www.suse.com/security/cve/CVE-2026-102633",
        "https://www.suse.com/security/cve/CVE-2026-24515",
        "https://www.suse.com/security/cve/CVE-2026-25210",
        "https://www.suse.com/security/cve/CVE-2026-32776",
        "https://www.suse.com/security/cve/CVE-2026-32777",
        "https://www.suse.com/security/cve/CVE-2026-32778",
        "https://www.suse.com/security/cve/CVE-2026-41080",
        "https://www.suse.com/security/cve/CVE-2026-45186",
        "https://www.suse.com/security/cve/CVE-2026-50219",
        "https://www.suse.com/security/cve/CVE-2026-56131",
        "https://www.suse.com/security/cve/CVE-2026-56132",
        "https://www.suse.com/security/cve/CVE-2026-56403",
        "https://www.suse.com/security/cve/CVE-2026-56404",
        "https://www.suse.com/security/cve/CVE-2026-56405",
        "https://www.suse.com/security/cve/CVE-2026-56406",
        "https://www.suse.com/security/cve/CVE-2026-56407",
        "https://www.suse.com/security/cve/CVE-2026-56408",
        "https://www.suse.com/security/cve/CVE-2026-56409",
        "https://www.suse.com/security/cve/CVE-2026-56410",
        "https://www.suse.com/security/cve/CVE-2026-56411",
        "https://www.suse.com/security/cve/CVE-2026-56412",
        "https://www.suse.com/security/cve/CVE-2026-66046",
        "https://www.suse.com/security/cve/CVE-2026-72522",
        "https://www.suse.com/security/cve/CVE-2026-76641",
        "https://www.suse.com/security/cve/CVE-2026-76956",
        "https://www.suse.com/security/cve/CVE-2026-76957",
        "https://www.suse.com/security/cve/CVE-2026-77214",
        "https://www.suse.com/security/cve/CVE-2026-93990"
      ]
    },
    "related_cves": [
      {
        "value": "CVE-2025-59375",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-102633",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-24515",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-25210",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-32776",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-32777",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-32778",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-41080",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-45186",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-50219",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-56131",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-56132",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-56403",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-56404",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-56405",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-56406",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-56407",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-56408",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-56409",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-56410",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-56411",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-56412",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-66046",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-72522",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-76641",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-76956",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-76957",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-77214",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-93990",
        "evidence": "/upstream"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 374529,
  "published_at": "2026-10-19T08:29:07+00:00"
}