https://seclists.org/oss-sec/2026/q4/469: libexpat 2.10.0 fixes two vulnerabilities

Published Nov 2, 2026

Updated

Affected Software

1 affected component

Expat Expat

Frequently Asked Questions

Which issues can be exploited as denial of service conditions?

CVE-2026-113351 fixes a denial of service involving XML_ParserReset. CVE-2026-115506 improves detection of billion laughs attacks and their variations, while CVE-2026-117610 addresses parse calls that could previously segfault.

Does compression affect exploitation of the entity-expansion issue?

Yes. A compression layer around XML can significantly reduce the minimum payload size needed for a billion laughs attack covered by CVE-2026-115506.

What should teams prioritizing a backport review?

For CVE-2026-115506, the release notice specifically calls out pull request #1439 as important when backporting. The release also includes fixes for XML_ParserReset handling, empty subparser parse calls, and signed integer overflow protections in storeAtts.

https://seclists.org/oss-sec/2026/q4/469: libexpat 2.10.0 fixes two vulnerabilities

Affected Software

Frequently Asked Questions

Which issues can be exploited as denial of service conditions?

Does compression affect exploitation of the entity-expansion issue?

What should teams prioritizing a backport review?

Company

Resources

Contact

Frequently Asked Questions

Which issues can be exploited as denial of service conditions?

Does compression affect exploitation of the entity-expansion issue?

What should teams prioritizing a backport review?