Alpine: libexpat, multiple expat packages: security update to 2.8.2-r0

medium Tenable Cloud Security Plugin ID 444103

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

- libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call
depth tracking for various calls from within handlers in cases of a policy violation. Thus, a use-after-
free can occur. NOTE: this issue exists because of an incomplete fix for CVE-2026-50219. (CVE-2026-56412)

- libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_GetBuffer, XML_Parse,
XML_ParseBuffer, XML_ParserFree, or XML_ParserReset from within handlers in cases of a policy violation.
Thus, a use-after-free can occur, (CVE-2026-50219)

- libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers
in cases of a policy violation. Thus, a use-after-free can occur (similar to the CVE-2026-50219
situation). (CVE-2026-56131)

- In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold
backing array reallocation is mishandled when there is data-structure sharing across parsers.
(CVE-2026-56132)

- libexpat before 2.8.2 has an integer overflow in storeAtts. (CVE-2026-56403)

Solution

Update the expat library and its related packages to version 2.8.2-r0 or later.

Plugin Details

Severity: Medium

ID: 444103

Version: Revision 1.1

Type: Local

Family: Alpine Linux Local Security Checks

Published: 6/29/2026

Updated: 6/29/2026

Supported Sensors: Agentless Assessment

Risk Information

VPR

Risk Factor: High

Score: 7.0

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.4

Vector: CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2026-56412

CVSS v3

Risk Factor: Medium

Base Score: 6.9

Temporal Score: 6

Vector: CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS Score Source: CVE-2026-56405

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 6/4/2026

Reference Information

CVE: CVE-2026-50219, CVE-2026-56131, CVE-2026-56132, CVE-2026-56403, CVE-2026-56404, CVE-2026-56405, CVE-2026-56406, CVE-2026-56407, CVE-2026-56408, CVE-2026-56409, CVE-2026-56410, CVE-2026-56411, CVE-2026-56412

Detections

Analytics