- Packages tracked
- 38,394
- CVEs found
- 728
- Fixed in fork
- 13
- Fixed upstream
- 8
- In flight
- 6
- Pending
- 700
728 matching records
| CVE | Project | Title | Fork fix | State | Evidence | Discussion |
|---|---|---|---|---|---|---|
| DEBIAN-CVE-2022-25313 | debian/expat | In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth in the DTD element. | - | Awaiting approval | Evidence | None recorded |
| DEBIAN-CVE-2022-25314 | debian/expat | In Expat (aka libexpat) before 2.4.5, there is an integer overflow in copyString. | - | Awaiting approval | Evidence | None recorded |
| DEBIAN-CVE-2022-25315 | debian/expat | In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames. | - | Awaiting approval | Evidence | None recorded |
| DEBIAN-CVE-2022-40674 | debian/expat | libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c. | - | Awaiting approval | Evidence | None recorded |
| DEBIAN-CVE-2022-43680 | debian/expat | In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory situations. | - | Awaiting approval | Evidence | None recorded |
| DEBIAN-CVE-2023-52425 | debian/expat | libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in the case of a large token for which multiple buffer fills are needed. | - | Awaiting approval | Evidence | None recorded |
| DEBIAN-CVE-2023-52426 | debian/expat | libexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile time. | - | Awaiting approval | Evidence | None recorded |
| DEBIAN-CVE-2024-28757 | debian/expat | libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreate). | - | Awaiting approval | Evidence | None recorded |
| DEBIAN-CVE-2024-45490 | debian/expat | An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for XML_ParseBuffer. | - | Awaiting approval | Evidence | None recorded |
| DEBIAN-CVE-2024-45491 | debian/expat | An issue was discovered in libexpat before 2.6.3. dtdCopy in xmlparse.c can have an integer overflow for nDefaultAtts on 32-bit platforms (where UINT_MAX equals SIZE_MAX). | - | Awaiting approval | Evidence | None recorded |
| DEBIAN-CVE-2024-45492 | debian/expat | An issue was discovered in libexpat before 2.6.3. nextScaffoldPart in xmlparse.c can have an integer overflow for m_groupSize on 32-bit platforms (where UINT_MAX equals SIZE_MAX). | - | Awaiting approval | Evidence | None recorded |
| DEBIAN-CVE-2024-50602 | debian/expat | An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function because XML_StopParser can stop/suspend an unstarted parser. | - | Awaiting approval | Evidence | None recorded |
| DEBIAN-CVE-2024-8176 | debian/expat | A stack overflow vulnerability exists in the libexpat library due to the way it handles recursive entity expansion in XML documents. When parsing an XML document with deeply nested entity references, libexpat can be forced to recurse indefinitely, exhausting the stack space and causing a crash. This | - | Awaiting approval | Evidence | None recorded |
| DEBIAN-CVE-2025-59375 | debian/expat | libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing. | - | Awaiting approval | Evidence | None recorded |
| DEBIAN-CVE-2025-66382 | debian/expat | In libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can lead to dozens of seconds of processing time. | - | Awaiting approval | Evidence | None recorded |
| DEBIAN-CVE-2026-102633 | debian/expat | libexpat versions 2.7.2 through 2.8.5 contain an integer overflow vulnerability in expat_realloc() function on 32-bit platforms when computing allocation sizes. Attackers supplying malicious XML to applications parsing with vulnerable libexpat can cause heap buffer overflow, memory corruption, or de | - | Awaiting approval | Evidence | None recorded |
| DEBIAN-CVE-2026-113351 | debian/expat | libexpat 2.7.2 through 2.9.0 contains a denial of service vulnerability because XML_ParserReset zeroes the direct byte count but never offsets tracked heap allocations. Attackers can submit a large XML document so later documents on the same reset parser fail with XML_ERROR_NO_MEMORY until it is rec | - | Awaiting approval | Evidence | None recorded |
| DEBIAN-CVE-2026-115506 | debian/expat | libexpat through 2.9.0 contains a denial of service vulnerability because billion laughs protection in accountingDiffTolerated() in xmlparse.c detects entity amplification too late. Attackers can supply a moderately sized XML document with a large DTD and nested entity expansions to consume tens of | - | Awaiting approval | Evidence | None recorded |
| DEBIAN-CVE-2026-117610 | debian/expat | libexpat through 2.9.0 contains a NULL pointer dereference vulnerability in externalEntityInitProcessor2() in lib/xmlparse.c that mishandles the XML_TOK_NONE token from empty input. Attackers who control stream chunking can force an empty non-final first parse on an external entity subparser, causin | fix-cve-2026-117610-external-entity-null-deref (merged) | Fixed in fork | Evidence | None recorded |
| DEBIAN-CVE-2026-118370 | debian/expat | libexpat through 2.9.0 contains a signed integer overflow vulnerability in storeAtts() in lib/xmlparse.c that allows attackers to trigger out-of-bounds writes via oversized attribute counts. Attackers can supply a multi-gigabyte document with a start tag carrying over 2^30 attributes to overflow att | fix-cve-2026-118370-store-atts-overflow (merged) | Fixed in fork | Evidence | None recorded |
| DEBIAN-CVE-2026-24515 | debian/expat | In libexpat before 2.7.4, XML_ExternalEntityParserCreate does not copy unknown encoding handler user data. | - | Awaiting approval | Evidence | None recorded |
| DEBIAN-CVE-2026-25210 | debian/expat | In libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize because there is no integer overflow check for tag buffer reallocation. | - | Awaiting approval | Evidence | None recorded |
| DEBIAN-CVE-2026-32776 | debian/expat | libexpat before 2.7.5 allows a NULL pointer dereference with empty external parameter entity content. | - | Awaiting approval | Evidence | None recorded |
| DEBIAN-CVE-2026-32777 | debian/expat | libexpat before 2.7.5 allows an infinite loop while parsing DTD content. | - | Awaiting approval | Evidence | None recorded |
| DEBIAN-CVE-2026-32778 | debian/expat | libexpat before 2.7.5 allows a NULL pointer dereference in the function setContext on retry after an earlier ouf-of-memory condition. | - | Awaiting approval | Evidence | None recorded |
| DEBIAN-CVE-2026-41080 | debian/expat | libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document. | - | Awaiting approval | Evidence | None recorded |
| DEBIAN-CVE-2026-45186 | debian/expat | In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input. | - | Awaiting approval | Evidence | None recorded |
| DEBIAN-CVE-2026-50219 | debian/expat | libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_GetBuffer, XML_Parse, XML_ParseBuffer, XML_ParserFree, or XML_ParserReset from within handlers in cases of a policy violation. Thus, a use-after-free can occur, | - | Awaiting approval | Evidence | None recorded |
| DEBIAN-CVE-2026-56131 | debian/expat | libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation. Thus, a use-after-free can occur (similar to the CVE-2026-50219 situation). | - | Awaiting approval | Evidence | None recorded |
| DEBIAN-CVE-2026-56132 | debian/expat | In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold backing array reallocation is mishandled when there is data-structure sharing across parsers. | - | Awaiting approval | Evidence | None recorded |
| DEBIAN-CVE-2026-56403 | debian/expat | libexpat before 2.8.2 has an integer overflow in storeAtts. | - | Awaiting approval | Evidence | None recorded |
| DEBIAN-CVE-2026-56404 | debian/expat | libexpat before 2.8.2 has an integer overflow in addBinding. | - | Awaiting approval | Evidence | None recorded |
| DEBIAN-CVE-2026-56405 | debian/expat | libexpat before 2.8.2 has an integer overflow in getAttributeId. | - | Awaiting approval | Evidence | None recorded |
| DEBIAN-CVE-2026-56406 | debian/expat | libexpat before 2.8.2 has an integer overflow in XML_ParseBuffer because it lacked a check that was present in XML_Parse. | - | Awaiting approval | Evidence | None recorded |
| DEBIAN-CVE-2026-56407 | debian/expat | libexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity textLen. | - | Awaiting approval | Evidence | None recorded |
| DEBIAN-CVE-2026-56408 | debian/expat | libexpat before 2.8.2 has an integer overflow in copyString. | - | Awaiting approval | Evidence | None recorded |
| DEBIAN-CVE-2026-56409 | debian/expat | xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used. | - | Awaiting approval | Evidence | None recorded |
| DEBIAN-CVE-2026-56410 | debian/expat | xmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId. | - | Awaiting approval | Evidence | None recorded |
| DEBIAN-CVE-2026-56411 | debian/expat | xmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations. | - | Awaiting approval | Evidence | None recorded |
| DEBIAN-CVE-2026-56412 | debian/expat | libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call depth tracking for various calls from within handlers in cases of a policy violation. Thus, a use-after-free can occur. NOTE: this issue exists because of an incomplete fix for CVE-2026-50219. | - | Awaiting approval | Evidence | None recorded |
| DEBIAN-CVE-2026-66046 | debian/expat | Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an O(N^2) linear scan of elementType->defaultAtts to determine CDATA status | - | Awaiting approval | Evidence | None recorded |
| DEBIAN-CVE-2026-72522 | debian/expat | libexpat before 2.8.3 has an out-of-bounds read and resultant infinite loop because low surrogates are treated the same as high surrogates during Unicode processing in the *_toUtf16 functions. | - | Awaiting approval | Evidence | None recorded |
| DEBIAN-CVE-2026-76956 | debian/expat | In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to insufficient entropy, which results in being vulnerable to hash flooding attacks, causing a denial of service via crafted XML content. | - | Awaiting approval | Evidence | None recorded |
| DEBIAN-CVE-2026-76957 | debian/expat | libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412. | - | Awaiting approval | Evidence | None recorded |
| DEBIAN-CVE-2026-77214 | debian/expat | libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XML_ParseBuffer advances the parse buffer end with parser->m_bufferEnd += len using a caller-supplied length that is not validated against the allocated buffer size, so repeated XML_ParseBuffer calls move m_ | - | Awaiting approval | Evidence | None recorded |
| DEBIAN-CVE-2026-93990 | debian/expat | Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16 sequences to be accepted. Attackers can supply UTF-16 encoded XML containing lone high surrogates that consume the following code unit, causing Expat to pass unpaired | - | Awaiting approval | Evidence | None recorded |
| DLA-1839-1 | debian/expat | expat - security update | - | Awaiting approval | Evidence | None recorded |
| DLA-1912-1 | debian/expat | expat - security update | - | Awaiting approval | Evidence | None recorded |
| DLA-281-1 | debian/expat | expat - security update | - | Awaiting approval | Evidence | None recorded |
| DLA-2904-1 | debian/expat | expat - security update | - | Awaiting approval | Evidence | None recorded |