Alpine/expat: unknown

Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-no

Action: Upgrade expat to 2.8.4-r0 or later.

Affected

Fixed versions

Sources

• osv: ALPINE-CVE-2026-66046#Alpine:v3.23/expat
• https://security.alpinelinux.org/vuln/CVE-2026-66046

published 2026-08-18T15:16:57Z · modified 2026-10-01T02:17:49.389480731Z · JSON