The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1790177624 advisory.

  - Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory     corruption by processing XML with external entity parsers created via XML_ExternalEntityParserCreate. A     struct size mismatch between ELEMENT_TYPE members causes storeAtts to read the attIndex member past     allocated memory boundaries, resulting in failure to normalize whitespace in non-CDATA attributes or a     wild pointer dereference causing a segfault. This vulnerability was introduced by the fix for     CVE-2026-66046. (CVE-2026-76641)

  - Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate,     allowing malformed UTF-16 sequences to be accepted. Attackers can supply UTF-16 encoded XML containing     lone high surrogates that consume the following code unit, causing Expat to pass unpaired surrogates to     applications built with XML_UNICODE and to silently replace input characters in other builds.
    (CVE-2026-93990)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Rocky Linux 9.6 [TuxCare] Security Update: expat / expat-devel / expat-static Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1790177624)

high Nessus Plugin ID 351564

Version 1.3