Expat 2.10.0 Released with Four Security Fixes
Story 3, from Lobsters
Expat 2.10.0 addresses four vulnerabilities, including improvements to billion laughs and parameter entity attacks, and memory allocation tracking. The release includes fixes for denial of service and signed integer overflow issues.
Key points
- Expat 2.10.0 fixes four security issues, including denial of service and signed integer overflow vulnerabilities.
- CVE-2026-115506 involves improvements to detect and reject billion laughs and parameter entity attacks by precomputing entity expansion.
- CVE-2026-113351 addresses memory allocation tracking issues during XML_ParserReset to prevent denial of service.
- The release was supported by funding from the Open Source Sabbatical of the City of Munich.
- The number of known unfixed security issues in Expat increased from 5 to 13 after this release.
- The release includes non-security improvements and a call for continued funding for Expat maintenance.
Why it matters
Expat is a widely used XML parser, and these vulnerabilities could be exploited to cause denial of service or memory issues. Engineers using Expat should update to 2.10.0 to mitigate these risks.
Counterpoint
The increase in known unfixed issues suggests ongoing security challenges, and the reliance on external funding for maintenance may affect long-term stability.
Sources
This summary was written by a language model and may contain errors. Read the original for the full story.