Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Expat library can cause slow XML processing
published 1 month ago
Summary
The Expat XML parser used in Oracle’s expat packages may take much longer than expected when handling certain attribute data. This slowdown could affect applications that read or write large XML files, making them less responsive. Updating to the latest version of the expat packages resolves the issue.
What to do
- Update oracle expat to version 2.1.0-15.0.7.el7_9.tuxcare.els8.
- Update oracle expat-devel to version 2.1.0-15.0.7.el7_9.tuxcare.els8.
- Update oracle expat-static to version 2.1.0-15.0.7.el7_9.tuxcare.els8.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:OracleLinux:7 | oracle | expat |
< 2.1.0-15.0.7.el7_9.tuxcare.els8 Fix: upgrade to 2.1.0-15.0.7.el7_9.tuxcare.els8
|
| TuxCare:OracleLinux:7 | oracle | expat-devel |
< 2.1.0-15.0.7.el7_9.tuxcare.els8 Fix: upgrade to 2.1.0-15.0.7.el7_9.tuxcare.els8
|
| TuxCare:OracleLinux:7 | oracle | expat-static |
< 2.1.0-15.0.7.el7_9.tuxcare.els8 Fix: upgrade to 2.1.0-15.0.7.el7_9.tuxcare.els8
|
Original advisory text
expat: Fix of CVE-2026-66046
- CVE-2026-66046: fix quadratic runtime in attribute value normalization by
resolving an attribute's declared type through the default-attribute hash
table instead of an O(n^2) scan of the element's default attributes
resolving an attribute's declared type through the default-attribute hash
table instead of an O(n^2) scan of the element's default attributes
References
- https://errata.tuxcare.com/els_os/oraclelinux7els/CLSA-2026-1790239193.html Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-66046 Vendor Advisory
Timeline
Published24 Sep 2026
Updated26 Oct 2026
First seen26 Oct 2026
Sources
CLSA-2026-1790239193 · OSV
Track software like this
Free during beta