OESA-2026-4846: expat security update

Q: What conditions are required for exploitation?

An attacker needs to be able to submit a large XML document to an application that reuses an Expat parser via XML_ParserReset. No authentication or user interaction is required according to the supplied vector, but exploitation requires that reset-parser reuse pattern.

Q: What is the operational impact after a successful attack?

After a large XML document is processed, later documents handled by the same reset parser can fail with XML_ERROR_NO_MEMORY. The affected parser must be recreated to restore processing.

Q: Which Expat versions are affected?

The issue affects libexpat versions 2.7.2 through 2.9.0.

Published Nov 11, 2026

Updated

expat is a stream-oriented XML parser library written in C. expat excels with files too large to fit RAM, and where performance and flexibility are crucial. Security Fix(es):

libexpat 2.7.2 through 2.9.0 contains a denial of service vulnerability because XMLParserReset zeroes the direct byte count but never offsets tracked heap allocations. Attackers can submit a large XML document so later documents on the same reset parser fail with XMLERRORNOMEMORY until it is recreated.(CVE-2026-113351)

Affected Software

1 affected componentFixes available

openeuler/expat<2.8.1-11.oe2403sp4

2.8.1-11.oe2403sp4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade openeuler/expat to a version that resolves this vulnerability.
Fixed in 2.8.1-11.oe2403sp4

Event History

Nov 11, 2026

Advisory Published

via OSV·12:26 PM

Data Sourced

via OSV·12:26 PM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-113351

Frequently Asked Questions

What conditions are required for exploitation?

An attacker needs to be able to submit a large XML document to an application that reuses an Expat parser via XML_ParserReset. No authentication or user interaction is required according to the supplied vector, but exploitation requires that reset-parser reuse pattern.

What is the operational impact after a successful attack?

After a large XML document is processed, later documents handled by the same reset parser can fail with XML_ERROR_NO_MEMORY. The affected parser must be recreated to restore processing.

Which Expat versions are affected?

The issue affects libexpat versions 2.7.2 through 2.9.0.

OESA-2026-4846: expat security update

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What conditions are required for exploitation?

What is the operational impact after a successful attack?

Which Expat versions are affected?

Company

Resources

Contact

Frequently Asked Questions

What conditions are required for exploitation?

What is the operational impact after a successful attack?

Which Expat versions are affected?