There are 22 open security issues in bookworm.
14 important issues:
- CVE-2026-45186:
In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input.
- CVE-2026-50219:
libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_GetBuffer, XML_Parse, XML_ParseBuffer, XML_ParserFree, or XML_ParserReset from within handlers in cases of a policy violation. Thus, a use-after-free can occur,
- CVE-2026-56131:
libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation. Thus, a use-after-free can occur (similar to the CVE-2026-50219 situation).
- CVE-2026-56132:
In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold backing array reallocation is mishandled when there is data-structure sharing across parsers.
- CVE-2026-56403:
libexpat before 2.8.2 has an integer overflow in storeAtts.
- CVE-2026-56404:
libexpat before 2.8.2 has an integer overflow in addBinding.
- CVE-2026-56405:
libexpat before 2.8.2 has an integer overflow in getAttributeId.
- CVE-2026-56406:
libexpat before 2.8.2 has an integer overflow in XML_ParseBuffer because it lacked a check that was present in XML_Parse.
- CVE-2026-56407:
libexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity textLen.
- CVE-2026-56408:
libexpat before 2.8.2 has an integer overflow in copyString.
- CVE-2026-56409:
xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used.
- CVE-2026-56410:
xmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId.
- CVE-2026-56411:
xmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations.
- CVE-2026-56412:
libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call depth tracking for various calls from within handlers in cases of a policy violation. Thus, a use-after-free can occur. NOTE: this issue exists because of an incomplete fix for CVE-2026-50219.
7 issues left for the package maintainer to handle:
- CVE-2025-66382:
(postponed; to be fixed through a stable update)
In libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can lead to dozens of seconds of processing time.
- CVE-2026-24515:
(needs triaging)
In libexpat before 2.7.4, XML_ExternalEntityParserCreate does not copy unknown encoding handler user data.
- CVE-2026-25210:
(needs triaging)
In libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize because there is no integer overflow check for tag buffer reallocation.
- CVE-2026-32776:
(needs triaging)
libexpat before 2.7.5 allows a NULL pointer dereference with empty external parameter entity content.
- CVE-2026-32777:
(needs triaging)
libexpat before 2.7.5 allows an infinite loop while parsing DTD content.
- CVE-2026-32778:
(needs triaging)
libexpat before 2.7.5 allows a NULL pointer dereference in the function setContext on retry after an earlier ouf-of-memory condition.
- CVE-2026-41080:
(needs triaging)
libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document.
You can find information about how to handle these issues in the security team's documentation.
1 ignored issue:
- CVE-2025-59375:
libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing.
![[bug history graph]](https://qa.debian.org/data/bts/graphs/e/expat.png){kind=link}