Expat 2.10.0 released with four security fixes
Original title: Expat 2.10.0 released, fixes four vulnerabilities
Fixes DoS vulnerabilities including billion laughs attacks and integer overflow issues
Expat 2.10.0 released to address four security issues. Fixes include CVE-2026-113351 for DoS with XML_ParserReset, CVE-2026-115506 and CVE-2026-117610 for billion laughs and parameter laughs attacks, and CVE-2026-118370 for signed integer overflow. The release includes faster detection of malicious XML content.
- Four vulnerabilities fixed: CVE-2026-113351, CVE-2026-115506, CVE-2026-117610, CVE-2026-118370
- Billion laughs and parameter laughs attacks addressed
- Allocation tracker fix for parser reset
- Pre-computing entity expansion for faster detection
- Vendors
- libexpat
- Products
- Expat
- Organizations
- Sebastian Pipping
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-113351 | Denial of service in libexpat 2.7.2–2.9.0 after parser reset | 8.2 | — | ||
| CVE-2026-115506 | Billion laughs DoS in libexpat through 2.9.0 | 8.7 | — | ||
CVE-2026-117610+1 related CVE | NULL pointer dereference in libexpat through 2.9.0 | 8.2 | — |
From the original article
4 min read at blog.hartwork.orgDenial of service or more from issues with initial non-final empty subparser parse calls Back in November 2025, about a year ago, my friend Hanno Böck Hanno's question was: Is there a chance that some other combination of parameters
By blog.hartwork.org via fanf · blog.hartwork.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.