libexpat 2.10.0 fixes four vulnerabilities
Original title: libexpat 2.10.0 fixes two vulnerabilities
libexpat 2.10.0 releases fixes for CVE-2026-113351, CVE-2026-115506, CVE-2026-117610 and CVE-2026-118370.
The libexpat project released version 2.10.0 with fixes for four vulnerabilities. These include denial of service with use of XML_ParserReset for CVE-2026-113351 and other issues covered in the changelogs. Earlier versions are affected and should be upgraded.
- Fixes CVE-2026-113351: denial of service with XML_ParserReset
- Fixes CVE-2026-115506
- Fixes CVE-2026-117610
- Fixes CVE-2026-118370
- libexpat 2.10.0 is now available
Impact: denial of service and other issues in libexpat
- 1.Upgrade to libexpat 2.10.0
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-113351 | Denial of service in libexpat 2.7.2–2.9.0 after parser reset | 8.2 | — | ||
| CVE-2026-115506 | Billion laughs DoS in libexpat through 2.9.0 | 8.7 | — | ||
CVE-2026-117610+1 related CVE | NULL pointer dereference in libexpat through 2.9.0 | 8.2 | — |
From the original article
Posted by Sebastian Pipping on Nov 02 Hello oss-security, just a quick note that libexpat 2. 10. 0 (or "Expat 2.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.