Amazon Linux 2 (EOS) Security Advisory: ALAS2-2026-3965
Advisory Released Date: 2026-10-12
Advisory Updated Date: 2026-10-12
Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an O(N^2) linear scan of elementType->defaultAtts to determine CDATA status. A remote unauthenticated attacker can supply a single well-formed XML document of a few megabytes to an application parsing untrusted XML to cause excessive CPU consumption, resulting in denial of service without requiring authentication, external entity resolution, or non-default parser options. (CVE-2026-66046)
Affected Packages:
expat
Note:
This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.
Issue Correction:
Run yum update expat or yum update --advisory ALAS2-2026-3965 to update your system.
aarch64:
expat-2.1.0-15.amzn2.0.9.aarch64
expat-devel-2.1.0-15.amzn2.0.9.aarch64
expat-static-2.1.0-15.amzn2.0.9.aarch64
expat-debuginfo-2.1.0-15.amzn2.0.9.aarch64
i686:
expat-2.1.0-15.amzn2.0.9.i686
expat-devel-2.1.0-15.amzn2.0.9.i686
expat-static-2.1.0-15.amzn2.0.9.i686
expat-debuginfo-2.1.0-15.amzn2.0.9.i686
src:
expat-2.1.0-15.amzn2.0.9.src
x86_64:
expat-2.1.0-15.amzn2.0.9.x86_64
expat-devel-2.1.0-15.amzn2.0.9.x86_64
expat-static-2.1.0-15.amzn2.0.9.x86_64
expat-debuginfo-2.1.0-15.amzn2.0.9.x86_64