Expat Security Update — AlmaLinux 8 (ALSA-2026:92323)

ALSA-2026:92323 updates expat on AlmaLinux 8, fixing CVE-2026-102633 (denial of service via integer overflow in expat_realloc) and CVE-2026-77214 (information disclosure), aggregate CVSS 5.9 (CWE-190 integer overflow). Expat parses XML for countless applications — update with dnf update expat and restart services that use it.

High 5.9 CVSS 2026-10-29

AlmaLinux 8

Was das unter einer SharedLicense-Lizenz bedeutet

XML-parsing flaws are reached by any input containing XML: an integer overflow in the allocator can crash parsers handling crafted documents, and the information-disclosure item can leak parser memory into application responses.

Type:

security

Severity:

important

Release date:

2026-10-29

Description:

Expat is a C library for parsing XML documents.

Security Fix(es):

* expat: expat: Denial of Service via integer overflow in expat_realloc (CVE-2026-102633)
* expat: expat: Information disclosure via heap buffer over-read in XML_ParseBuffer (CVE-2026-77214)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References:

Updated packages listed below:

Architecture	Package	Checksum
aarch64	expat-2.5.0-6.el8_10.aarch64.rpm	a341893df9cda707d22a3a5ae6ae61cd7c16594004a59f5e0fce8ec31c191974
aarch64	expat-devel-2.5.0-6.el8_10.aarch64.rpm	cd169a56740423a57dc8f1aeaa37c47ade61cba634228679f35803273c731954
i686	expat-devel-2.5.0-6.el8_10.i686.rpm	35858e8cad9286ad1625ac86263a7a33d58611f0afcabc62708f1148126e20e0
i686	expat-2.5.0-6.el8_10.i686.rpm	d2f21ea4698539f248381267485f9fd43544a981eb76e4e32494d13efaf131a0
ppc64le	expat-devel-2.5.0-6.el8_10.ppc64le.rpm	a5f2c1022280e23cb1e67143e5c2575e72cdc3cbbe3266727909f038f14cb033
ppc64le	expat-2.5.0-6.el8_10.ppc64le.rpm	d3ba5c2a5b8042584a2352deebdea730edd6fec91a254a65221ca5b76e0f6aa6
s390x	expat-devel-2.5.0-6.el8_10.s390x.rpm	127b61a0324e775a90a08a7b92e00232416888f12793cfad0f07adc05f8678c0
s390x	expat-2.5.0-6.el8_10.s390x.rpm	3a37f0f0d6d411a87fd991c693d4facb9124eac04d41fa5ffe571dd0915ec259
x86_64	expat-devel-2.5.0-6.el8_10.x86_64.rpm	3cba20adb10b45d1d89843913836ee3e23c640ca52352713d1fa5cb476c6f440
x86_64	expat-2.5.0-6.el8_10.x86_64.rpm	b2c98ea7042af67ec166e02801ef68fc9c030fe8872439697889550b1b177d10

Notes:

This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.

Häufig gestellte Fragen

What is ALSA-2026:92323?

It is AlmaLinux's expat erratum, fixing CVE-2026-102633 (denial of service via integer overflow in expat_realloc) and CVE-2026-77214 (information disclosure) — aggregate CVSS 5.9, integer-overflow class (CWE-190).

Who is affected?

Any AlmaLinux 8 server with expat installed — it is a near-universal dependency pulled in by PHP, Apache modules and countless applications that parse XML.

How do I apply the fix?

Run dnf update expat, then restart services that link it (PHP-FPM, Apache) so they load the patched library.

How would this flaw be exploited?

By submitting a small crafted XML document that drives expat's allocator into an integer overflow — crashing the parsing process (DoS) or, with the disclosure item, leaking memory contents into output.

Referenzen

Sicherheitshinweise

System auf Schwachstellen prüfen

Wählen Sie Ihr Produkt und Betriebssystem, um die passenden Fix-Befehle zu sehen.

System prüfen

Häufig gestellte Fragen

Verwandte Warnhinweise

System auf Schwachstellen prüfen