CLSA-2026-1791254668
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1791254668.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1791254668
- Upstream
CVE (2)
- Published
- 2026-10-06T02:44:39Z
- Modified
- 2026-10-26T09:31:53Z
- Summary
- Fix CVE(s): CVE-2026-66046, CVE-2026-93990
- Details
-
- SECURITY UPDATE: XML injection via malformed UTF-16 input: a high
surrogate not followed by a low surrogate is accepted and consumes
the following code unit, hiding markup characters from the parser
(libexpat through 2.8.4)
- debian/patches/CVE-2026-93990.patch: reject a UTF-16 high surrogate whose second code unit is not a low surrogate by defining IS_INVALID_CHAR (and isInvalid4 for XML_MIN_SIZE) for the little2_/big2_ encodings; also carries upstream's regression test into tests/runtests.c
- CVE-2026-93990
- SECURITY UPDATE: Denial of service via quadratic complexity in
storeAtts(), which scanned elementType->defaultAtts linearly to
determine the CDATA status of every non-normalized attribute
(libexpat through 2.8.3)
- debian/patches/CVE-2026-66046.patch: store the index of the first default attribute declaration in the per-element hash table and use a hash lookup instead of the linear scan; includes upstream's follow-up for dtdCopy() so that external entity parsers do not read past the hash table entries
- CVE-2026-66046
- SECURITY UPDATE: XML injection via malformed UTF-16 input: a high
surrogate not followed by a low surrogate is accepted and consumes
the following code unit, hiding markup characters from the parser
(libexpat through 2.8.4)
- References
Affected packages
TuxCare:Debian:10 / expat
Package
- Name
- expat
- Purl
- pkg:deb/tuxcare/expat?distro=debian-10
TuxCare:Debian:10 / libexpat1
Package
- Name
- libexpat1
- Purl
- pkg:deb/tuxcare/libexpat1?distro=debian-10