Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
CentOS Expat library can hide markup with malformed UTF‑16
published 1 month ago
Summary
The Expat XML parsing library used in CentOS (expat, expat-devel, expat-static) could be tricked by a badly formed UTF‑16 character sequence, allowing hidden markup to bypass the parser. This can lead to incorrect processing of XML data and potential security concerns. Updating the packages to the latest version resolves the issue.
What to do
- Update centos expat to version 2.5.0-1.el8.tuxcare.els9.
- Update centos expat-devel to version 2.5.0-1.el8.tuxcare.els9.
- Update centos expat-static to version 2.5.0-1.el8.tuxcare.els9.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:CentOS:8.5 | centos | expat |
< 2.5.0-1.el8.tuxcare.els9 Fix: upgrade to 2.5.0-1.el8.tuxcare.els9
|
| TuxCare:CentOS:8.5 | centos | expat-devel |
< 2.5.0-1.el8.tuxcare.els9 Fix: upgrade to 2.5.0-1.el8.tuxcare.els9
|
| TuxCare:CentOS:8.5 | centos | expat-static |
< 2.5.0-1.el8.tuxcare.els9 Fix: upgrade to 2.5.0-1.el8.tuxcare.els9
|
Original advisory text
expat: Fix of 2 CVEs
- CVE-2026-93990: reject a UTF-16 high surrogate that is not followed by a low
surrogate, by adding LITTLE2_/BIG2_IS_INVALID_CHAR and the matching
little2_/big2_isInvalid4 vtable entries to the UTF-16 tokenizers in
lib/xmltok.c, so a lone high surrogate can no longer consume the following
code unit as a fake low surrogate and hide markup from the parser
surrogate, by adding LITTLE2_/BIG2_IS_INVALID_CHAR and the matching
little2_/big2_isInvalid4 vtable entries to the UTF-16 tokenizers in
lib/xmltok.c, so a lone high surrogate can no longer consume the following
code unit as a fake low surrogate and hide markup from the parser
References
- https://errata.tuxcare.com/els_os/centos8.5els/CLSA-2026-1790252568.html Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-66046 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-93990 Vendor Advisory
Timeline
Published24 Sep 2026
Updated26 Oct 2026
First seen26 Oct 2026
Sources
CLSA-2026-1790252568 · OSV
Track software like this
Free during beta