Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
Expat XML Parsing Error: Denial of Service Risk
published 5 months ago
Summary
Expat, a library used for parsing XML documents, has a vulnerability that could cause a denial of service if it's given malicious XML data. This means that an attacker could potentially make the system crash or become unresponsive. To stay secure, update the Expat library to the latest version.
What to do
- Update rocky expat to version 0:2.5.0-2.el8_10.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Rocky Linux:8 | rocky | expat |
< 0:2.5.0-2.el8_10 Fix: upgrade to 0:2.5.0-2.el8_10
|
Original advisory text
Important: expat security update
Expat is a C library for parsing XML documents.
Security Fix(es):
* libexpat: denial of service via crafted XML input (CVE-2026-45186)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Security Fix(es):
* libexpat: denial of service via crafted XML input (CVE-2026-45186)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
- https://errata.rockylinux.org/RLSA-2026:22721 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2468575 Third Party Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published5 Jun 2026
Updated5 Jun 2026
First seen5 Jun 2026
Sources
RLSA-2026:22721 · OSV
Track software like this
Free during beta