RHSA-2026:98478: Important: expat security update

Q: What types of impact are addressed by this update?

The update addresses denial-of-service conditions from quadratic attribute processing and an integer overflow in expat_realloc, XML injection through malformed UTF-16 input, and information disclosure through a heap buffer over-read in XML_ParseBuffer.

Q: Which installed packages should be reviewed for this advisory?

Review installations of redhat/expat. Related packages listed in the advisory are redhat/expat-debuginfo, redhat/expat-debugsource, and redhat/expat-devel.

Q: Does the advisory identify a specific configuration or exposure condition required for exploitation?

No. The provided advisory data does not state configuration prerequisites, attack-vector requirements, or whether default configurations are affected.

Published Nov 11, 2026

Updated

Expat is a C library for parsing XML documents.Security Fix(es): expat: Expat: Denial of Service via quadratic complexity in attribute processing (CVE-2026-66046) expat: Expat: XML Injection via Malformed UTF-16 Input (CVE-2026-93990) expat: expat: Denial of Service via integer overflow in expatrealloc (CVE-2026-102633) expat: expat: Information disclosure via heap buffer over-read in XMLParseBuffer (CVE-2026-77214) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected Software

16 affected componentsFixes available

redhat/expat<2.5.0-9.el9_9.4

2.5.0-9.el9_9.4

redhat/expat<2.5.0-9.el9_9.4

2.5.0-9.el9_9.4

redhat/expat-debuginfo<2.5.0-9.el9_9.4

2.5.0-9.el9_9.4

redhat/expat-debuginfo<2.5.0-9.el9_9.4

2.5.0-9.el9_9.4

redhat/expat-debugsource<2.5.0-9.el9_9.4

2.5.0-9.el9_9.4

redhat/expat-debugsource<2.5.0-9.el9_9.4

2.5.0-9.el9_9.4

redhat/expat-devel<2.5.0-9.el9_9.4

2.5.0-9.el9_9.4

redhat/expat-devel<2.5.0-9.el9_9.4

2.5.0-9.el9_9.4

redhat/expat<2.5.0-9.el9_9.4

2.5.0-9.el9_9.4

redhat/expat-debuginfo<2.5.0-9.el9_9.4

2.5.0-9.el9_9.4

redhat/expat-debugsource<2.5.0-9.el9_9.4

2.5.0-9.el9_9.4

redhat/expat-devel<2.5.0-9.el9_9.4

2.5.0-9.el9_9.4

redhat/expat<2.5.0-9.el9_9.4.aa

2.5.0-9.el9_9.4.aa

redhat/expat-debuginfo<2.5.0-9.el9_9.4.aa

2.5.0-9.el9_9.4.aa

redhat/expat-debugsource<2.5.0-9.el9_9.4.aa

2.5.0-9.el9_9.4.aa

redhat/expat-devel<2.5.0-9.el9_9.4.aa

2.5.0-9.el9_9.4.aa

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/expat to a version that resolves this vulnerability.
Fixed in 2.5.0-9.el9_9.4
Upgrade
Upgrade redhat/expat-debuginfo to a version that resolves this vulnerability.
Fixed in 2.5.0-9.el9_9.4
Upgrade
Upgrade redhat/expat-debugsource to a version that resolves this vulnerability.
Fixed in 2.5.0-9.el9_9.4
Upgrade
Upgrade redhat/expat-devel to a version that resolves this vulnerability.
Fixed in 2.5.0-9.el9_9.4
Upgrade
Upgrade redhat/expat to a version that resolves this vulnerability.
Fixed in 2.5.0-9.el9_9.4.aa
Upgrade
Upgrade redhat/expat-debuginfo to a version that resolves this vulnerability.
Fixed in 2.5.0-9.el9_9.4.aa
Upgrade
Upgrade redhat/expat-debugsource to a version that resolves this vulnerability.
Fixed in 2.5.0-9.el9_9.4.aa
Upgrade
Upgrade redhat/expat-devel to a version that resolves this vulnerability.
Fixed in 2.5.0-9.el9_9.4.aa

Event History

Nov 11, 2026

Advisory Published

via Red Hat·12:00 AM

Data Sourced

via Red Hat·12:00 AM

RemedyDescriptionAffected Software

Frequently Asked Questions

What types of impact are addressed by this update?

The update addresses denial-of-service conditions from quadratic attribute processing and an integer overflow in expat_realloc, XML injection through malformed UTF-16 input, and information disclosure through a heap buffer over-read in XML_ParseBuffer.

Which installed packages should be reviewed for this advisory?

Review installations of redhat/expat. Related packages listed in the advisory are redhat/expat-debuginfo, redhat/expat-debugsource, and redhat/expat-devel.

Does the advisory identify a specific configuration or exposure condition required for exploitation?

No. The provided advisory data does not state configuration prerequisites, attack-vector requirements, or whether default configurations are affected.

RHSA-2026:98478: Important: expat security update

Affected Software

Remediation

Event History

Frequently Asked Questions

What types of impact are addressed by this update?

Which installed packages should be reviewed for this advisory?

Does the advisory identify a specific configuration or exposure condition required for exploitation?

Company

Resources

Contact

Frequently Asked Questions

What types of impact are addressed by this update?

Which installed packages should be reviewed for this advisory?

Does the advisory identify a specific configuration or exposure condition required for exploitation?