# CVE-2022-43680: expat: This update for expat fixes the following issues: - CVE-2025-59375: denial of service (resource consumption) cause... CVE-2022-43680 is fixed in 7 products on 1 platform, first by expat 2.2.5-3ubuntu0.8, released October 24, 2022. It is not reported as exploited. Patch Radar priority: High. - Web page: https://patchblox.com/security/cve/CVE-2022-43680 - Priority: High - CVSS: 7.5 (Medium) - EPSS: 0.0318 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Oct 24, 2022 ## Description This update for expat fixes the following issues: - CVE-2025-59375: denial of service (resource consumption) caused by processing malformed small documents (bsc#1249584). - CVE-2026-24515: NULL dereference (CWE-476) due to function XML_ExternalEntityParserCreate() failing to copy the encoding handler data passed to XML_SetUnknownEncodingHandler() from the parent to the subparser (bsc#1257144). - CVE-2026-25210: lack of buffer size check can lead to an integer overflow (bsc#1257496). - CVE-2026-32776: NULL pointer dereference when processing empty external parameter entities inside an entity declaration value (bsc#1259726). - CVE-2026-32777: denial of service due to infinite loop in DTD content parsing (bsc#1259711). - CVE-2026-32778: NULL pointer dereference in `setContext` on retry after an out-of-memory condition (bsc#1259729). - CVE-2026-41080: crafted XML document can cause a denial of service (bsc#1262263). - CVE-2026-45186: denial of service via moderately sized crafted XML input (bsc#1264713). - CVE-2026-50219: lack of handler call depth tracking for calls to XML_* functions from within handlers in cases of a policy violation (bsc#1267631). - CVE-2026-56131: lack of handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation (bsc#1268572). - CVE-2026-56132: heap-based buffer overflow in doProlog in xmlparse.c (bsc#1268573). - CVE-2026-56403,CVE-2026-56404,CVE-2026-56405,CVE-2026-56406, CVE-2026-56407,CVE-2026-56408,CVE-2026-56409,CVE-2026-56410, CVE-2026-56411,CVE-2026-56412: multiple integer overflow vulnerabilities (bsc#1275115). - CVE-2026-66046: denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function (bsc#1275732). - CVE-2026-72522: out-of-bounds read and resultant infinite loop due to low surrogates being treated the same as high surrogates during Unicode processing (bsc#1275594). - CVE-2026-76641: out-of-bounds read vulnerability that allows attackers to trigger memory corruption (bsc#1275915). - CVE-2026-76956: denial of service via hash flooding attacks (bsc#1275860). - CVE-2026-76957: lack of handler call depth tracking with custom encoding callbacks. Thus, a use- after-free can occur (bsc#1275859). - CVE-2026-77214: out-of-bounds read due to insufficient checks in `XML_ParseBuffer()` (bsc#1284334). - CVE-2026-93990: fails to validate low surrogates following high surrogates in UTF-16 input (bsc#1282347). - CVE-2026-102633: Denial of Service via integer overflow in expat_realloc (bsc#1283493). Update to 2.8.5 (jsc#PED-16154): * Bug fixes: * Fix an OOM-related memory leak on a failed overflow check * Fix memory alignment for architectures with 128bit pointers * Mark XML_SetHashSalt deprecated * CMake: only add /source-charset:utf-8 when /utf-8 is not present * lib: resolve undefined behavior from overshifting a signed int * lib: support read-only hash table lookup with non-zero-terminated keys * lib: use a C99 bool for ENTITY.open * version info bumped from 13:3:12 to 13:4:12 * fix support for 2+ GiB documents (regression from 2.8.2) * reject empty version in the XML declaration * fix printf format for AIX * CMake|AIX: enable EXPAT_DEV_URANDOM by default * version info bumped from 13:2:12 to 13:3:12 * Existing API function XML_SetHashSalt is now deprecated * because of its limitations, and its use should be * considered a vulnerability. Please either use the new API * function XML_SetHashSalt16Bytes (with known-high-quality * entropy input only!) instead, or leave the derivation of * a 16-bytes hash salt from high quality entropy to Expat's * internal machinery (by *not* calling either of the two * XML_SetHashSalt* functions). * xmlwf: Fix a memory leak * WASI: Fix format specifiers for 32bit WASI SDK * Fix alignment of internal allocations for some non-amd64 architectures (e.g. sparc32); fixes up on the fix to CVE-2025-59375 (of Expat 2.7.2) * Fix a class of false positives where input should have been rejected with error XML_ERROR_ASYNC_ENTITY; regression from CVE-2024-8176 (of Expat 2.7.0) * Prove and regression-proof absence of integer overflow from function expat_realloc * Remove 'harmless' cast that truncated a size_t to unsigned * xmlwf: Resolve use of functions XML_GetErrorLineNumber and XML_GetErrorColumnNumber * CVE-2025-59375 -- Disallow use of disproportional amounts of dynamic memory from within an Expat parser * xmlwf: Fix (internal) help generator * xmlwf: Mention supported environment variables in ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | expat Debian 11.6 (bullseye) | 2.2.10-2+deb11u5 | [DSA-5266-1](https://patchblox.com/security/data/fix/linux/dsa-5266-1.md) | Oct 30, 2022 | | Linux | expat Debian 12.15 (bookworm) | 2.5.0-1 | [DEBIAN-CVE-2022-43680](https://patchblox.com/security/data/fix/linux/debian-cve-2022-43680.md) | Oct 24, 2022 | | Linux | expat Debian 13.5 (trixie) | 2.5.0-1 | [DEBIAN-CVE-2022-43680](https://patchblox.com/security/data/fix/linux/debian-cve-2022-43680.md) | Oct 24, 2022 | | Linux | expat Debian 14 | 2.5.0-1 | [DEBIAN-CVE-2022-43680](https://patchblox.com/security/data/fix/linux/debian-cve-2022-43680.md) | Oct 24, 2022 | | Linux | expat RHEL 8 | 0:2.2.5-10.el8_7.1 | [RHSA-2023:0103](https://patchblox.com/security/data/fix/linux/rhsa-2023-0103.md) | Jan 12, 2023 | | Linux | expat RHEL 9 | 0:2.4.9-1.el9_1.1 | [RHSA-2023:0337](https://patchblox.com/security/data/fix/linux/rhsa-2023-0337.md) | Jan 23, 2023 | | Linux | expat Ubuntu 18.04.6 LTS (bionic) | 2.2.5-3ubuntu0.8 | [expat 2.2.5-3ubuntu0.8](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-expat-2.2.5-3ubuntu0.8.md) | Oct 24, 2022 | | Linux | expat Ubuntu 20.04 LTS (focal) | 2.2.9-1ubuntu0.6 | [expat 2.2.9-1ubuntu0.6](https://patchblox.com/security/data/fix/linux/ubuntu-focal-expat-2.2.9-1ubuntu0.6.md) | Oct 24, 2022 | | Linux | expat Ubuntu 22.04.1 LTS (jammy) | 2.4.7-1ubuntu0.2 | [expat 2.4.7-1ubuntu0.2](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-expat-2.4.7-1ubuntu0.2.md) | Oct 24, 2022 | | Linux | expat Ubuntu 24.10 (oracular) | 2.5.0-1 | [expat 2.5.0-1](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-expat-2.5.0-1.md) | Jan 16, 2026 | | Linux | expat Ubuntu 25.04 (plucky) | 2.5.0-1 | [expat 2.5.0-1](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-expat-2.5.0-1.md) | Jan 16, 2026 | | Linux | expat almalinux 8 | 2.2.5-10.el8_7.1 | [ALSA-2023:0103](https://patchblox.com/security/data/fix/linux/alsa-2023-0103.md) | Jan 12, 2023 | | Linux | expat almalinux 9 | 2.4.9-1.el9_1.1 | [ALSA-2023:0337](https://patchblox.com/security/data/fix/linux/alsa-2023-0337.md) | Jan 23, 2023 | | Linux | expat amzn 2023 | 2.5.0-1.amzn2023.0.2 | [ALAS2023-2023-058](https://patchblox.com/security/data/fix/linux/alas2023-2023-058.md) | Feb 17, 2023 | | Linux | expat ol 8 | 0:2.2.5-10.0.1.el8_7.1 | [ELSA-2023-0103](https://patchblox.com/security/data/fix/linux/elsa-2023-0103.md) | Jan 12, 2023 | | Linux | expat ol 9 | 0:2.4.9-1.el9_1.1 | [ELSA-2023-0337](https://patchblox.com/security/data/fix/linux/elsa-2023-0337.md) | Jan 24, 2023 | | Linux | expat rocky 8 | 0:2.2.5-10.el8_7.1 | [RLSA-2023:0103](https://patchblox.com/security/data/fix/linux/rlsa-2023-0103.md) | Jan 12, 2023 | | Linux | expat rocky 9 | 0:2.4.9-1.el9_1.1 | [RLSA-2023:0337](https://patchblox.com/security/data/fix/linux/rlsa-2023-0337.md) | Jan 23, 2023 | | Linux | expat sles 15.6 | 2.8.5-150400.3.40.1 | [SUSE-SU-2026:4623-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4623-1.md) | Nov 7, 2026 | | Linux | expat-debuginfo amzn 2023 | 2.5.0-1.amzn2023.0.2 | [ALAS2023-2023-058](https://patchblox.com/security/data/fix/linux/alas2023-2023-058.md) | Feb 17, 2023 | | Linux | expat-debugsource amzn 2023 | 2.5.0-1.amzn2023.0.2 | [ALAS2023-2023-058](https://patchblox.com/security/data/fix/linux/alas2023-2023-058.md) | Feb 17, 2023 | | Linux | expat-devel RHEL 8 | 0:2.2.5-10.el8_7.1 | [RHSA-2023:0103](https://patchblox.com/security/data/fix/linux/rhsa-2023-0103.md) | Jan 12, 2023 | | Linux | expat-devel RHEL 9 | 0:2.4.9-1.el9_1.1 | [RHSA-2023:0337](https://patchblox.com/security/data/fix/linux/rhsa-2023-0337.md) | Jan 23, 2023 | | Linux | expat-devel almalinux 8 | 2.2.5-10.el8_7.1 | [ALSA-2023:0103](https://patchblox.com/security/data/fix/linux/alsa-2023-0103.md) | Jan 12, 2023 | | Linux | expat-devel almalinux 9 | 2.4.9-1.el9_1.1 | [ALSA-2023:0337](https://patchblox.com/security/data/fix/linux/alsa-2023-0337.md) | Jan 23, 2023 | | Linux | expat-devel amzn 2023 | 2.5.0-1.amzn2023.0.2 | [ALAS2023-2023-058](https://patchblox.com/security/data/fix/linux/alas2023-2023-058.md) | Feb 17, 2023 | | Linux | expat-devel ol 8 | 0:2.2.5-10.0.1.el8_7.1 | [ELSA-2023-0103](https://patchblox.com/security/data/fix/linux/elsa-2023-0103.md) | Jan 12, 2023 | | Linux | expat-devel ol 9 | 0:2.4.9-1.el9_1.1 | [ELSA-2023-0337](https://patchblox.com/security/data/fix/linux/elsa-2023-0337.md) | Jan 24, 2023 | | Linux | expat-static amzn 2023 | 2.5.0-1.amzn2023.0.2 | [ALAS2023-2023-058](https://patchblox.com/security/data/fix/linux/alas2023-2023-058.md) | Feb 17, 2023 | | Linux | firefox RHEL 8 | 0:102.5.0-1.el8_7 | [RHSA-2022:8554](https://patchblox.com/security/data/fix/linux/rhsa-2022-8554.md) | Nov 21, 2022 | | Linux | libexpat1 Ubuntu 18.04.6 LTS (bionic) | 2.2.5-3ubuntu0.8 | [libexpat1 2.2.5-3ubuntu0.8](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libexpat1-2.2.5-3ubuntu0.8.md) | Oct 24, 2022 | | Linux | libexpat1 Ubuntu 20.04 LTS (focal) | 2.2.9-1ubuntu0.6 | [libexpat1 2.2.9-1ubuntu0.6](https://patchblox.com/security/data/fix/linux/ubuntu-focal-libexpat1-2.2.9-1ubuntu0.6.md) | Oct 24, 2022 | | Linux | libexpat1 Ubuntu 22.04.1 LTS (jammy) | 2.4.7-1ubuntu0.2 | [libexpat1 2.4.7-1ubuntu0.2](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libexpat1-2.4.7-1ubuntu0.2.md) | Oct 24, 2022 | | Linux | libexpat1 Ubuntu 24.10 (oracular) | 2.5.0-1 | [libexpat1 2.5.0-1](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-libexpat1-2.5.0-1.md) | Jan 16, 2026 | | Linux | libexpat1 Ubuntu 25.04 (plucky) | 2.5.0-1 | [libexpat1 2.5.0-1](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-libexpat1-2.5.0-1.md) | Jan 16, 2026 | --- Data as of 2026-11-08T06:59:42Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.