[CVE-2026-115506 ] expat: CVE-2026-115506
High(8.7) Interessata Dettagli (4) 2.5.0-1+deb12u2 · amd64 · bookworm
Interessata
dsa · expat · debian · bookworm; dsa · expat · debian · 12
2.5.0-1+deb12u2 · arm64 · bookworm
Interessata
dsa · expat · debian · bookworm; dsa · expat · debian · 12
2.5.0-1+deb12u3 · amd64 · bookworm-security
Interessata
dsa · expat · debian · bookworm; dsa · expat · debian · 12
2.5.0-1+deb12u3 · arm64 · bookworm-security
Interessata
dsa · expat · debian · bookworm; dsa · expat · debian · 12
[CVE-2026-77214 ] expat: CVE-2026-77214
High(8.3) Interessata Dettagli (4) 2.5.0-1+deb12u2 · amd64 · bookworm
Interessata · Corretta: 2.5.0-1+deb12u5
dsa · expat · debian · bookworm; dsa · expat · debian · 12
2.5.0-1+deb12u2 · arm64 · bookworm
Interessata · Corretta: 2.5.0-1+deb12u5
dsa · expat · debian · bookworm; dsa · expat · debian · 12
2.5.0-1+deb12u3 · amd64 · bookworm-security
Interessata · Corretta: 2.5.0-1+deb12u5
dsa · expat · debian · bookworm; dsa · expat · debian · 12
2.5.0-1+deb12u3 · arm64 · bookworm-security
Interessata · Corretta: 2.5.0-1+deb12u5
dsa · expat · debian · bookworm; dsa · expat · debian · 12
[CVE-2026-102633 ] libexpat versions 2.7.2 through 2.8.5 contain an integer overflow vulnerability in expat_realloc() function on 32-bit platforms when computing allocation sizes. Attackers supplying malicious XML to ap
High(8.2) Interessata Dettagli (4) 2.5.0-1+deb12u2 · amd64 · bookworm
Interessata · Corretta: 2.5.0-1+deb12u5
nvd · expat · debian · bookworm; nvd · expat · debian · 12
2.5.0-1+deb12u2 · arm64 · bookworm
Interessata · Corretta: 2.5.0-1+deb12u5
nvd · expat · debian · bookworm; nvd · expat · debian · 12
2.5.0-1+deb12u3 · amd64 · bookworm-security
Interessata · Corretta: 2.5.0-1+deb12u5
nvd · expat · debian · bookworm; nvd · expat · debian · 12
2.5.0-1+deb12u3 · arm64 · bookworm-security
Interessata · Corretta: 2.5.0-1+deb12u5
nvd · expat · debian · bookworm; nvd · expat · debian · 12
[CVE-2026-93990 ] Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16 sequences to be accepted. Attackers can supply UTF-16 encoded XML c
High(8.7) Interessata Dettagli (4) 2.5.0-1+deb12u2 · amd64 · bookworm
Interessata · Corretta: 2.5.0-1+deb12u4
nvd · expat · debian · bookworm
2.5.0-1+deb12u2 · arm64 · bookworm
Interessata · Corretta: 2.5.0-1+deb12u4
nvd · expat · debian · bookworm
2.5.0-1+deb12u3 · amd64 · bookworm-security
Interessata · Corretta: 2.5.0-1+deb12u4
nvd · expat · debian · bookworm
2.5.0-1+deb12u3 · arm64 · bookworm-security
Interessata · Corretta: 2.5.0-1+deb12u4
nvd · expat · debian · bookworm
[CVE-2026-76956 ] In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to insufficient entropy, which results in being vulnerable to hash flooding attacks, causing a denial of s
High(7.5) Sconosciuto L’associazione dei pacchetti è in corso. Osservato: Oct 23, 2026, 9:38:42 PM UTC
Dettagli (4) 2.5.0-1+deb12u2 · amd64 · bookworm
Non interessata
nvd · expat · debian · bookworm
2.5.0-1+deb12u2 · arm64 · bookworm
Non interessata
nvd · expat · debian · bookworm
2.5.0-1+deb12u3 · amd64 · bookworm-security
Non interessata
nvd · expat · debian · bookworm
2.5.0-1+deb12u3 · arm64 · bookworm-security
Non interessata
nvd · expat · debian · bookworm
[CVE-2026-66046 ] Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-no
High(8.7) Sconosciuto L’associazione dei pacchetti è in corso. Osservato: Oct 23, 2026, 9:42:28 PM UTC
Dettagli (4) 2.5.0-1+deb12u2 · amd64 · bookworm
Interessata · Corretta: 2.5.0-1+deb12u4
nvd · expat · debian · bookworm
2.5.0-1+deb12u2 · arm64 · bookworm
Interessata · Corretta: 2.5.0-1+deb12u4
nvd · expat · debian · bookworm
2.5.0-1+deb12u3 · amd64 · bookworm-security
Interessata · Corretta: 2.5.0-1+deb12u4
nvd · expat · debian · bookworm
2.5.0-1+deb12u3 · arm64 · bookworm-security
Interessata · Corretta: 2.5.0-1+deb12u4
nvd · expat · debian · bookworm
[CVE-2026-76641 ] Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory corruption by processing XML with external entity parsers created via XML_ExternalEntityParserC
High(8.7) Sconosciuto L’associazione dei pacchetti è in corso. Osservato: Oct 23, 2026, 9:42:28 PM UTC
Dettagli (4) 2.5.0-1+deb12u2 · amd64 · bookworm
Non interessata
nvd · expat · debian · bookworm
2.5.0-1+deb12u2 · arm64 · bookworm
Non interessata
nvd · expat · debian · bookworm
2.5.0-1+deb12u3 · amd64 · bookworm-security
Non interessata
nvd · expat · debian · bookworm
2.5.0-1+deb12u3 · arm64 · bookworm-security
Non interessata
nvd · expat · debian · bookworm
[CVE-2026-76957 ] libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412.
High(8.7) Sconosciuto L’associazione dei pacchetti è in corso. Osservato: Oct 23, 2026, 9:42:28 PM UTC
Dettagli (4) 2.5.0-1+deb12u2 · amd64 · bookworm
Interessata · Corretta: 2.5.0-1+deb12u3
nvd · expat · debian · bookworm
2.5.0-1+deb12u2 · arm64 · bookworm
Interessata · Corretta: 2.5.0-1+deb12u3
nvd · expat · debian · bookworm
2.5.0-1+deb12u3 · amd64 · bookworm-security
Corretta · Corretta: 2.5.0-1+deb12u3
nvd · expat · debian · bookworm
2.5.0-1+deb12u3 · arm64 · bookworm-security
Corretta · Corretta: 2.5.0-1+deb12u3
nvd · expat · debian · bookworm
[CVE-2026-72522 ] libexpat before 2.8.3 has an out-of-bounds read and resultant infinite loop because low surrogates are treated the same as high surrogates during Unicode processing in the *_toUtf16 functions.
High(8.7) Sconosciuto L’associazione dei pacchetti è in corso. Osservato: Oct 23, 2026, 9:42:29 PM UTC
Dettagli (4) 2.5.0-1+deb12u2 · amd64 · bookworm
Interessata · Corretta: 2.5.0-1+deb12u3
nvd · expat · debian · bookworm; nvd · expat · debian · 12
2.5.0-1+deb12u2 · arm64 · bookworm
Interessata · Corretta: 2.5.0-1+deb12u3
nvd · expat · debian · bookworm; nvd · expat · debian · 12
2.5.0-1+deb12u3 · amd64 · bookworm-security
Corretta · Corretta: 2.5.0-1+deb12u3
nvd · expat · debian · bookworm; nvd · expat · debian · 12
2.5.0-1+deb12u3 · arm64 · bookworm-security
Corretta · Corretta: 2.5.0-1+deb12u3
nvd · expat · debian · bookworm; nvd · expat · debian · 12
[CVE-2026-56411 ] xmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations.
High(8.7) Sconosciuto L’associazione dei pacchetti è in corso. Osservato: Oct 23, 2026, 9:45:34 PM UTC
Dettagli (4) 2.5.0-1+deb12u2 · amd64 · bookworm
Interessata · Corretta: 2.5.0-1+deb12u3
nvd · expat · debian · bookworm; nvd · expat · debian · 12
2.5.0-1+deb12u2 · arm64 · bookworm
Interessata · Corretta: 2.5.0-1+deb12u3
nvd · expat · debian · bookworm; nvd · expat · debian · 12
2.5.0-1+deb12u3 · amd64 · bookworm-security
Corretta · Corretta: 2.5.0-1+deb12u3
nvd · expat · debian · bookworm; nvd · expat · debian · 12
2.5.0-1+deb12u3 · arm64 · bookworm-security
Corretta · Corretta: 2.5.0-1+deb12u3
nvd · expat · debian · bookworm; nvd · expat · debian · 12
[CVE-2026-56410 ] xmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId.
High(8.7) Sconosciuto L’associazione dei pacchetti è in corso. Osservato: Oct 23, 2026, 9:45:34 PM UTC
Dettagli (4) 2.5.0-1+deb12u2 · amd64 · bookworm
Interessata · Corretta: 2.5.0-1+deb12u3
nvd · expat · debian · bookworm; nvd · expat · debian · 12
2.5.0-1+deb12u2 · arm64 · bookworm
Interessata · Corretta: 2.5.0-1+deb12u3
nvd · expat · debian · bookworm; nvd · expat · debian · 12
2.5.0-1+deb12u3 · amd64 · bookworm-security
Corretta · Corretta: 2.5.0-1+deb12u3
nvd · expat · debian · bookworm; nvd · expat · debian · 12
2.5.0-1+deb12u3 · arm64 · bookworm-security
Corretta · Corretta: 2.5.0-1+deb12u3
nvd · expat · debian · bookworm; nvd · expat · debian · 12
[CVE-2026-56409 ] xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used.
High(8.7) Sconosciuto L’associazione dei pacchetti è in corso. Osservato: Oct 23, 2026, 9:45:34 PM UTC
Dettagli (4) 2.5.0-1+deb12u2 · amd64 · bookworm
Interessata · Corretta: 2.5.0-1+deb12u3
nvd · expat · debian · bookworm; nvd · expat · debian · 12
2.5.0-1+deb12u2 · arm64 · bookworm
Interessata · Corretta: 2.5.0-1+deb12u3
nvd · expat · debian · bookworm; nvd · expat · debian · 12
2.5.0-1+deb12u3 · amd64 · bookworm-security
Corretta · Corretta: 2.5.0-1+deb12u3
nvd · expat · debian · bookworm; nvd · expat · debian · 12
2.5.0-1+deb12u3 · arm64 · bookworm-security
Corretta · Corretta: 2.5.0-1+deb12u3
nvd · expat · debian · bookworm; nvd · expat · debian · 12
[CVE-2026-56407 ] libexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity textLen.
High(8.7) Sconosciuto L’associazione dei pacchetti è in corso. Osservato: Oct 23, 2026, 9:45:34 PM UTC
Dettagli (4) 2.5.0-1+deb12u2 · amd64 · bookworm
Interessata · Corretta: 2.5.0-1+deb12u3
nvd · expat · debian · bookworm; nvd · expat · debian · 12
2.5.0-1+deb12u2 · arm64 · bookworm
Interessata · Corretta: 2.5.0-1+deb12u3
nvd · expat · debian · bookworm; nvd · expat · debian · 12
2.5.0-1+deb12u3 · amd64 · bookworm-security
Corretta · Corretta: 2.5.0-1+deb12u3
nvd · expat · debian · bookworm; nvd · expat · debian · 12
2.5.0-1+deb12u3 · arm64 · bookworm-security
Corretta · Corretta: 2.5.0-1+deb12u3
nvd · expat · debian · bookworm; nvd · expat · debian · 12
[CVE-2026-56406 ] libexpat before 2.8.2 has an integer overflow in XML_ParseBuffer because it lacked a check that was present in XML_Parse.
High(8.7) Sconosciuto L’associazione dei pacchetti è in corso. Osservato: Oct 23, 2026, 9:45:34 PM UTC
Dettagli (4) 2.5.0-1+deb12u2 · amd64 · bookworm
Interessata · Corretta: 2.5.0-1+deb12u3
nvd · expat · debian · bookworm; nvd · expat · debian · 12
2.5.0-1+deb12u2 · arm64 · bookworm
Interessata · Corretta: 2.5.0-1+deb12u3
nvd · expat · debian · bookworm; nvd · expat · debian · 12
2.5.0-1+deb12u3 · amd64 · bookworm-security
Corretta · Corretta: 2.5.0-1+deb12u3
nvd · expat · debian · bookworm; nvd · expat · debian · 12
2.5.0-1+deb12u3 · arm64 · bookworm-security
Corretta · Corretta: 2.5.0-1+deb12u3
nvd · expat · debian · bookworm; nvd · expat · debian · 12
[CVE-2026-56131 ] libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation. Thus, a use-after-free can occur (similar to the CVE-2026-502
High(8.7) Sconosciuto L’associazione dei pacchetti è in corso. Osservato: Oct 23, 2026, 9:45:34 PM UTC
Dettagli (4) 2.5.0-1+deb12u2 · amd64 · bookworm
Interessata · Corretta: 2.5.0-1+deb12u3
nvd · expat · debian · bookworm; nvd · expat · debian · 12
2.5.0-1+deb12u2 · arm64 · bookworm
Interessata · Corretta: 2.5.0-1+deb12u3
nvd · expat · debian · bookworm; nvd · expat · debian · 12
2.5.0-1+deb12u3 · amd64 · bookworm-security
Corretta · Corretta: 2.5.0-1+deb12u3
nvd · expat · debian · bookworm; nvd · expat · debian · 12
2.5.0-1+deb12u3 · arm64 · bookworm-security
Corretta · Corretta: 2.5.0-1+deb12u3
nvd · expat · debian · bookworm; nvd · expat · debian · 12
[CVE-2026-56132 ] In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold backing array reallocation is mishandled when there is data-structure sharing across parsers.
High(8.7) Sconosciuto L’associazione dei pacchetti è in corso. Osservato: Oct 23, 2026, 9:45:34 PM UTC
Dettagli (4) 2.5.0-1+deb12u2 · amd64 · bookworm
Interessata · Corretta: 2.5.0-1+deb12u5
nvd · expat · debian · bookworm; nvd · expat · debian · 12
2.5.0-1+deb12u2 · arm64 · bookworm
Interessata · Corretta: 2.5.0-1+deb12u5
nvd · expat · debian · bookworm; nvd · expat · debian · 12
2.5.0-1+deb12u3 · amd64 · bookworm-security
Interessata · Corretta: 2.5.0-1+deb12u5
nvd · expat · debian · bookworm; nvd · expat · debian · 12
2.5.0-1+deb12u3 · arm64 · bookworm-security
Interessata · Corretta: 2.5.0-1+deb12u5
nvd · expat · debian · bookworm; nvd · expat · debian · 12
[CVE-2026-50219 ] libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_GetBuffer, XML_Parse, XML_ParseBuffer, XML_ParserFree, or XML_ParserReset from within handlers in cases of a policy violation.
Medium(6.9) Sconosciuto L’associazione dei pacchetti è in corso. Osservato: Oct 23, 2026, 10:03:59 PM UTC
Dettagli (4) 2.5.0-1+deb12u2 · amd64 · bookworm
Interessata · Corretta: 2.5.0-1+deb12u3
nvd · expat · debian · bookworm; nvd · expat · debian · 12
2.5.0-1+deb12u2 · arm64 · bookworm
Interessata · Corretta: 2.5.0-1+deb12u3
nvd · expat · debian · bookworm; nvd · expat · debian · 12
2.5.0-1+deb12u3 · amd64 · bookworm-security
Corretta · Corretta: 2.5.0-1+deb12u3
nvd · expat · debian · bookworm; nvd · expat · debian · 12
2.5.0-1+deb12u3 · arm64 · bookworm-security
Corretta · Corretta: 2.5.0-1+deb12u3
nvd · expat · debian · bookworm; nvd · expat · debian · 12
[CVE-2026-56403 ] libexpat before 2.8.2 has an integer overflow in storeAtts.
Medium(6.9) Sconosciuto L’associazione dei pacchetti è in corso. Osservato: Oct 23, 2026, 10:03:59 PM UTC
Dettagli (4) 2.5.0-1+deb12u2 · amd64 · bookworm
Interessata · Corretta: 2.5.0-1+deb12u3
nvd · expat · debian · bookworm; nvd · expat · debian · 12
2.5.0-1+deb12u2 · arm64 · bookworm
Interessata · Corretta: 2.5.0-1+deb12u3
nvd · expat · debian · bookworm; nvd · expat · debian · 12
2.5.0-1+deb12u3 · amd64 · bookworm-security
Corretta · Corretta: 2.5.0-1+deb12u3
nvd · expat · debian · bookworm; nvd · expat · debian · 12
2.5.0-1+deb12u3 · arm64 · bookworm-security
Corretta · Corretta: 2.5.0-1+deb12u3
nvd · expat · debian · bookworm; nvd · expat · debian · 12
[CVE-2026-56404 ] libexpat before 2.8.2 has an integer overflow in addBinding.
Medium(6.9) Sconosciuto L’associazione dei pacchetti è in corso. Osservato: Oct 23, 2026, 10:03:59 PM UTC
Dettagli (4) 2.5.0-1+deb12u2 · amd64 · bookworm
Interessata · Corretta: 2.5.0-1+deb12u3
nvd · expat · debian · bookworm; nvd · expat · debian · 12
2.5.0-1+deb12u2 · arm64 · bookworm
Interessata · Corretta: 2.5.0-1+deb12u3
nvd · expat · debian · bookworm; nvd · expat · debian · 12
2.5.0-1+deb12u3 · amd64 · bookworm-security
Corretta · Corretta: 2.5.0-1+deb12u3
nvd · expat · debian · bookworm; nvd · expat · debian · 12
2.5.0-1+deb12u3 · arm64 · bookworm-security
Corretta · Corretta: 2.5.0-1+deb12u3
nvd · expat · debian · bookworm; nvd · expat · debian · 12
[CVE-2026-56405 ] libexpat before 2.8.2 has an integer overflow in getAttributeId.
Medium(6.9) Sconosciuto L’associazione dei pacchetti è in corso. Osservato: Oct 23, 2026, 10:03:59 PM UTC
Dettagli (4) 2.5.0-1+deb12u2 · amd64 · bookworm
Interessata · Corretta: 2.5.0-1+deb12u3
nvd · expat · debian · bookworm; nvd · expat · debian · 12
2.5.0-1+deb12u2 · arm64 · bookworm
Interessata · Corretta: 2.5.0-1+deb12u3
nvd · expat · debian · bookworm; nvd · expat · debian · 12
2.5.0-1+deb12u3 · amd64 · bookworm-security
Corretta · Corretta: 2.5.0-1+deb12u3
nvd · expat · debian · bookworm; nvd · expat · debian · 12
2.5.0-1+deb12u3 · arm64 · bookworm-security
Corretta · Corretta: 2.5.0-1+deb12u3
nvd · expat · debian · bookworm; nvd · expat · debian · 12
