{"id":"openSUSE-SU-2026:22177-1","summary":"Security update for expat","details":"This update for expat fixes the following issues:\n\n- CVE-2026-77214: out-of-bounds read due to insufficient checks in `XML_ParseBuffer()` (bsc#1284334).\n- CVE-2026-93990: fails to validate low surrogates following high surrogates in UTF-16 input (bsc#1282347).\n- CVE-2026-102633: denial of service via integer overflow in expat_realloc (bsc#1283493).\n\nChanges for expat:\n\nUpdate to 2.8.5 (jsc#PED-16154):\n\n * Bug fixes:\n * Fix an OOM-related memory leak on a failed overflow check\n * Fix memory alignment for architectures with 128bit pointers\n * Mark XML_SetHashSalt deprecated\n","modified":"2026-11-01T17:23:29.413374471Z","published":"2026-10-27T16:07:43Z","related":["CVE-2026-102633","CVE-2026-32776","CVE-2026-32777","CVE-2026-32778","CVE-2026-56403","CVE-2026-56404","CVE-2026-56405","CVE-2026-77214","CVE-2026-93990"],"upstream":["CVE-2026-102633","CVE-2026-32776","CVE-2026-32777","CVE-2026-32778","CVE-2026-56403","CVE-2026-56404","CVE-2026-56405","CVE-2026-77214","CVE-2026-93990"],"references":[{"type":"ADVISORY"},{"type":"REPORT","url":"https://bugzilla.suse.com/1275115"},{"type":"REPORT","url":"https://bugzilla.suse.com/1282347"},{"type":"REPORT","url":"https://bugzilla.suse.com/1283493"},{"type":"REPORT","url":"https://bugzilla.suse.com/1284334"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-102633"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-32776"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-32777"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-32778"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-56403"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-56404"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-56405"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-77214"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-93990"}],"affected":[{"package":{"name":"expat","ecosystem":"openSUSE:Leap 16.0","purl":"pkg:rpm/opensuse/expat&distro=openSUSE%20Leap%2016.0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-160000.1.1"}]}],"ecosystem_specific":{"binaries":[{"libexpat1":"2.8.5-160000.1.1","expat":"2.8.5-160000.1.1","libexpat-devel":"2.8.5-160000.1.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:22177-1.json"}}],"schema_version":"1.9.2"}