Debian/expat: unknown

Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-no

Action: Upgrade expat to 2.8.4-1 or later.

Affected

Fixed versions

Sources

• osv: DEBIAN-CVE-2026-66046#Debian:14/expat
• https://security-tracker.debian.org/tracker/CVE-2026-66046

published 2026-08-18T15:16:57Z · modified 2026-10-23T17:47:31.770099504Z · JSON