Loading story…
Germany's dCERT published two advisories covering denial-of-service vulnerabilities in the Expat XML parsing library, including libexpat and expat packages. The notices identify multiple flaws in libexpat and an additional vulnerability in expat that could allow attackers to crash affected applications or otherwise disrupt service availability.
The advisories, tracked as dCERT 2026-0719 and dCERT 2026-1142, indicate that systems using vulnerable Expat components may be exposed where untrusted XML input is processed. Organizations relying on software that embeds Expat should review vendor guidance, identify affected dependencies, and prioritize updates or mitigations to reduce denial-of-service risk.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
dCERT published advisory 2026-1420 describing an expat vulnerability that allows denial of service. This is a new advisory distinct from the previously listed 2026-0719 and 2026-1142 notices.
dCERT published advisory 2026-1142 describing an expat vulnerability that allows denial of service.
dCERT published advisory 2026-0719 covering multiple vulnerabilities in libexpat that could allow denial-of-service conditions.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
dcert.de
Open sourcedcert.de
Open sourcedcert.de
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat and Debian issued fixes for two vulnerabilities in the Expat XML parsing library: **CVE-2018-20843** and **CVE-2019-15903**. `CVE-2018-20843` affects Expat versions before 2.2.7; XML names containing excessive colon characters can drive high CPU and memory consumption, potentially causing an application to be killed by the operating system’s out-of-memory handler. Fuzzing demonstrated that a small malformed XML file could consume more than 2 GB of memory in Expat-based processing. `CVE-2019-15903`, affecting versions before 2.2.8, allows crafted XML to force a premature transition from DTD to document parsing and can produce a heap-based buffer over-read when applications call `XML_GetCurrentLineNumber` or `XML_GetCurrentColumnNumber`. Red Hat released updates for affected RHEL 7 and RHEL 8 Expat packages, as well as JBoss Core Services components; administrators should install the applicable updates and restart all applications that load Expat for the remediations to take effect.
Aug 28, 2026
Maintainers of **libevent** and **libexpat (Expat)** released security updates to fix multiple high-severity vulnerabilities affecting widely used networking and XML parsing components. **libevent 2.1.13-stable** and **2.2.2-alpha** remediate memory-safety bugs across `evbuffer`, `bufferevent`, `evtag`, `evrpc`, `evdns`, and `evhttp`, including out-of-bounds reads and writes, integer overflow, and a dangling pointer, alongside HTTP parsing weaknesses that could enable request smuggling, header smuggling, parser mismatch, and access-control bypass. One libevent fix tightened chunked-transfer parsing to require strict `CRLF` handling in line with RFC 9112, while later CVE records identified issues such as signed/unsigned length conversion in `evtag_unmarshal_header()` (`CVE-2026-63384`) and HTTP header and URI parsing bugs (`CVE-2026-63385`) in versions prior to the patched releases. **libexpat 2.8.2** was published to fix 14 vulnerabilities spanning integer overflows, out-of-bounds writes, missing control-flow integrity checks, and unsafe parser API behavior in functions including `XML_ParseBuffer`, `storeAtts`, `addBinding`, `getAttributeId`, and `doProlog`, as well as several flaws in the `xmlwf` utility. A subsequent high-severity disclosure, `CVE-2026-76641`, showed that Expat versions through **2.8.3** still contained an out-of-bounds read in external entity parsing caused by a struct size mismatch introduced by an earlier fix, creating risks of memory corruption, wild-pointer dereference, and denial of service. Together, the disclosures highlight continued patching activity for foundational open-source libraries embedded in network-facing and XML-processing software.
Aug 21, 2026
The Expat XML parser project released **Expat 2.8.5**, addressing security vulnerability `CVE-2026-93990`. Organizations embedding Expat in applications, appliances, or operating-system packages should identify affected deployments and update to the fixed release through their vendor or package-maintenance process. Expat is distributed under the permissive MIT License and is commonly incorporated as a third-party dependency, which can obscure its presence in software inventories. Security teams should review software bills of materials and downstream vendor advisories, prioritize externally reachable XML-processing services, and validate that rebuilt or packaged applications contain Expat 2.8.5 or a vendor-backported fix.
Sep 22, 2026