Fluid Attacks Database

Description

In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold backing array reallocation is mishandled when there is data-structure sharing across parsers.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 12	expat	=2.5.0-1 \|\| =2.5.0-1+deb12u1 \|\| =2.5.0-1+deb12u2 \|\| =2.5.0-2 \|\| =2.6.0-1 \|\| =2.6.1-1 \|\| =2.6.1-2 \|\| =2.6.2-1 \|\| =2.6.2-2 \|\| =2.6.3-1 \|\| =2.6.3-2 \|\| =2.6.4-1 \|\| =2.7.0-1 \|\| =2.7.1-1 \|\| =2.7.1-2 \|\| =2.7.2-1 \|\| =2.7.3-1 \|\| =2.7.3-2 \|\| =2.7.4-1 \|\| =2.7.5-1 \|\| =2.8.0-1 \|\| =2.8.0-2 \|\| =2.8.1-1 \|\| =2.8.2-1 \|\| =2.8.2-1~deb13u1 \|\| =2.8.3-1 \|\| =2.8.3-1~deb13u1	-
debian 13	expat	=2.7.1-2 \|\| =2.7.2-1 \|\| =2.7.3-1 \|\| =2.7.3-2 \|\| =2.7.4-1 \|\| =2.7.5-1 \|\| =2.8.0-1 \|\| =2.8.0-2 \|\| =2.8.1-1 \|\| >=0 <2.8.2-1~deb13u1	2.8.2-1~deb13u1
alpine v3.21	expat	>=0 <2.8.2-r0	2.8.2-r0
alpine v3.22	expat	>=0 <2.8.2-r0	2.8.2-r0
alpine v3.23	expat	>=0 <2.8.2-r0	2.8.2-r0
alpine v3.24	expat	>=0 <2.8.2-r0	2.8.2-r0
rpm rhel6	compat-expat1	-	-
rpm rhel10	expat	-	-
rpm rhel6	expat	-	-
rpm rhel7	expat	-	-

1-10 of 15

Aliases

1. CVE-2026-561322. NVD-2026-561323. OSV-DEBIAN-2026-561324. OSV-2026-561325. OSV-ALPINE-2026-561326. SECURITY-TRACKER-CVE-2026-561327. SECURITY-CVE-2026-56132

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.