Alpine: libexpat, multiple expat packages: security update to 2.8.4-r0

high Tenable Self-Hosted Container Security Plugin ID 447379

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

- Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity
in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized
values triggers an O(N^2) linear scan of elementType->defaultAtts to determine CDATA status. A remote
unauthenticated attacker can supply a single well-formed XML document of a few megabytes to an application
parsing untrusted XML to cause excessive CPU consumption, resulting in denial of service without requiring
authentication, external entity resolution, or non-default parser options. (CVE-2026-66046)

- Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory
corruption by processing XML with external entity parsers created via XML_ExternalEntityParserCreate. A
struct size mismatch between ELEMENT_TYPE members causes storeAtts to read the attIndex member past
allocated memory boundaries, resulting in failure to normalize whitespace in non-CDATA attributes or a
wild pointer dereference causing a segfault. This vulnerability was introduced by the fix for
CVE-2026-66046. (CVE-2026-76641)

- In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to
insufficient entropy, which results in being vulnerable to hash flooding attacks, causing a denial of
service via crafted XML content. (CVE-2026-76956)

- libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-
free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412.
(CVE-2026-76957)

Solution

Update the expat library and its related packages to version 2.8.4-r0 or later.

Plugin Details

Severity: High

ID: 447379

Version: Revision 1.1

Type: Local

Family: Alpine Linux Local Security Checks

Published: 9/1/2026

Updated: 9/1/2026

Supported Sensors: Agentless Assessment

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.61

CVSS v2

Risk Factor: Low

Base Score: 3.7

Temporal Score: 2.7

Vector: CVSS2#AV:L/AC:H/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2026-76957

CVSS v3

Risk Factor: Medium

Base Score: 4.9

Temporal Score: 4.3

Vector: CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 8.7

Threat Score: 6.6

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

CVSS Score Source: CVE-2026-76641

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 8/18/2026

Reference Information

CVE: CVE-2026-66046, CVE-2026-76641, CVE-2026-76956, CVE-2026-76957

Detections

Analytics