In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to insufficient entropy, which results in being vulnerable to hash flooding attacks, causing a denial of service via crafted XML content.

In libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can lead to dozens of seconds of processing time.

libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in the case of a large token for which multiple buffer fills are needed.

References: [1] https://github.com/libexpat/libexpat/pull/789 [2] https://github.com/libexpat/libexpat/commit/34b598c5f594b015c513c73f06e7ced3323edbf1

An issue was discovered in libexpat before 2.6.3. nextScaffoldPart in xmlparse.c can have an integer overflow for mgroupSize on 32-bit platforms (where UINTMAX equals SIZEMAX).

Hello oss-security,

just a quick note that libexpat 2.7.2 (or "Expat 2.7.2") released today is fixing CVE-2025-59375: denial of service through forced extensive use of dynamic memory despite small parser input.

Some key links are:

- The change log of release 2.7.2 https://github.com/libexpat/libexpat/blob/R272/expat/Changes

- The ClusterFuzz finding, its payload and analysis https://github.com/libexpat/libexpat/issues/1018

- The fixing pull request https://github.com/libexpat/libexpat/pull/1034

- The official CVE metadata https://nvd.nist.gov/vuln/detail/CVE-2025-59375

Best

Sebastian

Hello oss-security,

just a quick note that libexpat 2.7.3 (or "Expat 2.7.3") released today is improving upon the original fixes to CVE-2024-8176 and CVE-2025-59375. So if you backported the original fixes, please be sure to update/extend these backports as needed.

Some key links are:

- The change log of release 2.7.3 https://github.com/libexpat/libexpat/blob/R273/expat/Changes

- The two key pull requests: https://github.com/libexpat/libexpat/pull/1048 https://github.com/libexpat/libexpat/pull/1059

Best

Sebastian

Hello oss-security,

just a quick note that libexpat 2.8.2 (or "Expat 2.8.2") released today is fixing 13 vulnerabilities of three classes:

- 1x out-of-bounds write - 3x missing control flow integrity checks - 9x integer overflow

The related section of the change log says this:

#1246 CVE-2026-50219 -- Disallow calls to functions XMLGetBuffer, XMLParse, XMLParseBuffer, XMLParserFree, XMLParserReset to guard e.g. Expat bindings from memory corruption; this CPython issue is related: https://github.com/python/cpython/issues/146169 #1267 CVE-2026-56131 -- Protect XMLResumeParser from being called from a handler, plugging a hole in the fix to CVE-2026-50219 #1272 CVE-2026-56132 -- Fix out-of-bound scaffolding index store in doProlog #1229 #1232 CVE-2026-56403 -- Integer overflow in storeAtts #1249 CVE-2026-56404 -- Integer overflow in addBinding #1251 CVE-2026-56405 -- Integer overflow in getAttributeId #1255 CVE-2026-56406 -- Integer overflow in XMLParseBuffer #1262 CVE-2026-56407 -- Integer overflow in textLen handling #565 CVE-2026-56408 -- Integer overflow in copyString (commit 16e2efd867ea8567ffa012210b52ef5918e20817) #1259 CVE-2026-56409 -- xmlwf: Integer overflow in output path join #1252 CVE-2026-56410 -- xmlwf: Integer overflow in resolveSystemId #1263 CVE-2026-56411 -- xmlwf: Integer overflow in notation list allocation #1278 CVE-2026-56412 -- Guard XMLTOKDATACHARS handler calls in doCdataSection, plugging a hole in the fix to CVE-2026-50219

Some key links are:

- The blog post about it https://blog.hartwork.org/posts/expat-2-8-2-released/

- The change log of release 2.8.2 https://github.com/libexpat/libexpat/blob/R282/expat/Changes

- The related pull requests Best

Sebastian

Hello oss-security,

just a quick note that libexpat 2.8.4 (or "Expat 2.8.4") released today is fixing four vulnerabilities:

- CVE-2026-66046 - CVE-2026-76641 - CVE-2026-76956 - CVE-2026-76957

The related part of the change log is this:

#1321 #1331 CVE-2026-66046, CVE-2026-76641 -- Fix quadratic runtime from "attribute isCdata lookups" that allowed denial of service attacks through moderately sized crafted XML input (CWE-407). The vulnerability is closely related to past CVE-2026-45186 that was fixed with Expat 2.8.1. Please note that a layer of compression around XML can significantly reduce the minimum attack payload size. Upstream CVSS 3.1 vector: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (CVSS score: 7.5) (Note the "AV:N" for network/remote.) #1322 CVE-2026-76957 -- Protect custom encoding callbacks from parser re-entry. The vulnerability is closely related to past issues CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412 that were all fixed with Expat 2.8.2. #1326 CVE-2026-76956 -- Fix inverted getentropy() return handling; allowed for hash flooding denial of services in configurations where getentropy is configured or detected as the only high quality entropy extractor. Upstream CVSS 3.1 vector: AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H (CVSS score: 5.9) (Note the "AV:N" for network/remote.)

Some key links are:

- The blog post about it https://blog.hartwork.org/posts/expat-2-8-4-released/

- The full change log of release 2.8.4 https://github.com/libexpat/libexpat/blob/R284/expat/Changes

- The fixing pull requests - https://github.com/libexpat/libexpat/pull/1321 - https://github.com/libexpat/libexpat/pull/1322 - https://github.com/libexpat/libexpat/pull/1326 - https://github.com/libexpat/libexpat/pull/1331

- The NVD CVE metadata - https://nvd.nist.gov/vuln/detail/cve-2026-66046 - https://nvd.nist.gov/vuln/detail/cve-2026-76641 - https://nvd.nist.gov/vuln/detail/cve-2026-76956 - https://nvd.nist.gov/vuln/detail/cve-2026-76957

Best

Sebastian