{"id":"CLSA-2026-1790290820","summary":"Fix CVE(s): CVE-2026-66046, CVE-2026-93990","details":"   * SECURITY UPDATE: denial of service through quadratic runtime in the\n     default-attribute lookup performed by storeAtts()\n     - debian/patches/CVE-2026-66046.patch: resolve the CDATA-ness of a\n       specified attribute through the per-element defaultAttForName hash\n       table instead of a linear scan of defaultAtts, and fold in the\n       upstream follow-up that makes dtdCopy create entries of the same\n       size so storeAtts does not read .attIndex out of bounds (libexpat\n       PR #1321, PR #1331).\n     - CVE-2026-66046\n   * SECURITY UPDATE: malformed UTF-16 accepted because a high surrogate was\n     not required to be followed by a low surrogate\n     - debian/patches/CVE-2026-93990.patch: reject a 4-byte UTF-16 sequence\n       whose second code unit is not a low surrogate, in both the little2_\n       and big2_ tokenizers (libexpat PR #1282).\n     - CVE-2026-93990","modified":"2026-10-26T09:32:04.279735540Z","published":"2026-09-24T23:00:32Z","upstream":["CVE-2026-66046","CVE-2026-93990"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2026-1790290820.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-66046"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93990"}],"affected":[{"package":{"name":"expat","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/expat?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3ubuntu0.9+tuxcare.els12"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1790290820.json"}},{"package":{"name":"libexpat1","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/libexpat1?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3ubuntu0.9+tuxcare.els12"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1790290820.json"}},{"package":{"name":"libexpat1-dev","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/libexpat1-dev?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3ubuntu0.9+tuxcare.els12"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1790290820.json"}}],"schema_version":"1.9.0"}