{"id":"CLSA-2026-1788369761","summary":"Fix CVE(s): CVE-2026-56131, CVE-2026-76957","details":"   * SECURITY UPDATE: Use-after-free because the application-supplied\n     XML_Encoding.convert and XML_Encoding.release callbacks were left\n     outside handler call depth tracking, so a same-parser call made from\n     inside them freed state the running parse still owned (libexpat\n     before 2.8.4)\n     - debian/patches/CVE-2026-76957.patch: install the trampolines\n       callUnknownEncodingConvert() and callUnknownEncodingRelease() in\n       handleUnknownEncoding(), passing the parser itself to\n       XmlInitUnknownEncoding() as the converter's user data, so the\n       reentrancy counter is bumped around the application callbacks and\n       the existing forbidden-call rejection rules apply to them too;\n       routing release through the trampoline also clears\n       m_unknownEncodingRelease/m_unknownEncodingData so it runs exactly\n       once on every path; also carries upstream's regression test into\n       tests/runtests.c (2.2.6 has neither tests/misc_tests.c nor\n       tests/handlers.c, so the test brings a local equivalent of\n       forbidden_calls_character_handler())\n     - CVE-2026-76957\n   * SECURITY UPDATE: Use-after-free because handler call depth tracking\n     was absent entirely, leaving XML_GetBuffer, XML_Parse,\n     XML_ParseBuffer, XML_ParserFree, XML_ParserReset and\n     XML_ResumeParser callable from inside a handler, and the\n     XML_TOK_DATA_CHARS handler calls in doCdataSection() untracked\n     (libexpat before 2.8.2)\n     - debian/patches/CVE-2026-56131.patch: introduce\n       m_handlerCallDepth with beforeHandler()/afterHandler() around\n       every handler invocation and isCalledFromInsideHandler() guards on\n       the six affected entry points; this is the prerequisite the\n       CVE-2026-76957 fix builds on, and it is the same 33-commit\n       backport already shipped for expat 2.2.5 on ubuntu18.04els,\n       regenerated against 2.2.6\n     - CVE-2026-56131\n     - CVE-2026-50219\n     - CVE-2026-56412","modified":"2026-10-26T09:43:30.426674793Z","published":"2026-09-09T09:35:49Z","upstream":["CVE-2026-50219","CVE-2026-56131","CVE-2026-56412","CVE-2026-76957"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/debian10els/CLSA-2026-1788369761.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56131"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76957"}],"affected":[{"package":{"name":"expat","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/expat?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.6-2+deb10u7+tuxcare.els9"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1788369761.json"}},{"package":{"name":"libexpat1","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/libexpat1?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.6-2+deb10u7+tuxcare.els9"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1788369761.json"}},{"package":{"name":"libexpat1-dev","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/libexpat1-dev?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.6-2+deb10u7+tuxcare.els9"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1788369761.json"}}],"schema_version":"1.9.0"}