Bug 2556110 (CVE-2026-113351)

Summary:	CVE-2026-113351 expat: expat: Denial of Service via improper memory tracking in XML_ParserReset
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	akhatavk, aos-team-art-private, asdas, dpaolell, gotiwari, jdelft, jhorak, jupierce, lgarciaa, mbiarnes, mvyas, ppalepu, ppostler, prdhamdh, rhel-process-autobot, sghai, sidsharm, suppawar, vlaad, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in expat. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by submitting a large XML document to an application that reuses parser instances. When the XML parser is reset using XML_ParserReset, it clears the direct byte count but fails to offset tracked heap allocations. Consequently, subsequent parsing operations on the reused parser fail with out-of-memory errors until the parser is completely recreated.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2566857, 2566858
Bug Blocks:

Description OSIDB Bzimport 2026-10-20 10:51:22 UTC

libexpat 2.7.2 through 2.9.0 contains a denial of service vulnerability because XML_ParserReset zeroes the direct byte count but never offsets tracked heap allocations. Attackers can submit a large XML document so later documents on the same reset parser fail with XML_ERROR_NO_MEMORY until it is recreated.

Comment 1 Srikanth Balasubramanian 2026-11-04 10:37:42 UTC

Internal — CVSS v3.1 / rating rationale (CVE-2026-113351)

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H = 5.9 → Moderate
NVD: 7.5 (AC:L). CNA/RH prior: 5.9 (AC:H).

Metric notes:
- AV:N — untrusted XML may arrive over the network.
- AC:H — requires libexpat ≥2.7.2 allocation tracker AND XML_ParserReset reuse after a large prior document; absent before 2.7.2; uncommon app pattern on RHEL.
- PR:N / UI:N / S:U — no privileges/interaction; scope unchanged.
- C:N / I:N / A:H — DoS only (subsequent parses fail until parser recreated); not memory corruption.

Safeguards: FORTIFY/ASLR/NX/SELinux/glibc safe-linking do not remove A:H for this logical DoS.

Despite RH score <7, NVD ≥7 → affected streams use AFFECTED+DELEGATED (RHEL 6 would be OOSS if affected; here RHEL 6 is NOTAFFECTED due to version).

Comment 2 Srikanth Balasubramanian 2026-11-04 10:38:04 UTC

Internal — affect disposition for CVE-2026-113351

LEAVE  hummingbird-1/expat/hummingbird-1 (hummingbird)
SKIP fedora-all/expat/fedora-all -> AFFECTED/DELEGATED | shipped libexpat 2.8.5 (allocation tracker / XML_ParserReset bug present)
SKIP fedora-all/mingw-expat/fedora-all -> AFFECTED/DELEGATED | shipped libexpat 2.8.4 (allocation tracker / XML_ParserReset bug present)
OK   rhel-6/compat-expat1/rhel-6-els -> NOTAFFECTED/- | libexpat 1.95.8 outside upstream affected range 2.7.2–2.9.0 (tracker introduced in 2.7.2)
OK   rhel-6/expat/rhel-6-els -> NOTAFFECTED/- | libexpat 2.0.1 outside upstream affected range 2.7.2–2.9.0 (tracker introduced in 2.7.2)
OK   rhel-7/expat/rhel-7-els -> NOTAFFECTED/- | libexpat 2.1.0 outside upstream affected range 2.7.2–2.9.0 (tracker introduced in 2.7.2)
FAIL rhel-8/expat/rhel-8.10.z: {"non_field_errors":["Affect (d89c5ad2-217d-4946-9255-a18f9bf9a0f7) for rhel-8.10.z/expat is marked as NOTAFFECTED but has open tracker(s)."],"dt":"2026-11-04T10:19:46.634392Z","revision":"cdfc73e98fe
OK   rhel-8/mingw-expat/rhel-8.10.z -> NOTAFFECTED/- | libexpat 2.5.0 outside upstream affected range 2.7.2–2.9.0 (tracker introduced in 2.7.2)
OK   rhel-8/expat/rhel-8.4.0.z -> NOTAFFECTED/- | libexpat 2.2.10 outside upstream affected range 2.7.2–2.9.0 (tracker introduced in 2.7.2)
OK   rhel-8/expat/rhel-8.6.0.z -> NOTAFFECTED/- | libexpat 2.2.10 outside upstream affected range 2.7.2–2.9.0 (tracker introduced in 2.7.2)
OK   rhel-8/expat/rhel-8.8.0.z -> NOTAFFECTED/- | libexpat 2.2.10 outside upstream affected range 2.7.2–2.9.0 (tracker introduced in 2.7.2)
OK   rhel-10/expat/rhel-10.0.z -> NOTAFFECTED/- | libexpat 2.7.1 outside upstream affected range 2.7.2–2.9.0 (tracker introduced in 2.7.2)
OK   rhel-10/expat/rhel-10.2.z -> AFFECTED/DELEGATED | shipped libexpat 2.7.3 (allocation tracker / XML_ParserReset bug present)
SKIP rhel-10/expat/rhel-10.3.z -> AFFECTED/DELEGATED | shipped libexpat 2.7.3 (allocation tracker / XML_ParserReset bug present)
SKIP rhel-10/expat/rhel-10.4 -> AFFECTED/DELEGATED | shipped libexpat 2.7.3 (allocation tracker / XML_ParserReset bug present)
FAIL rhel-9/expat/rhel-9.10: {"non_field_errors":["Affect (5061e648-cf0e-4416-9575-1668239e6c0a) for rhel-9.10/expat is marked as NOTAFFECTED but has open tracker(s)."],"dt":"2026-11-04T10:21:36.524749Z","revision":"cdfc73e98fe80
OK   rhel-9/expat/rhel-9.2.0.z -> NOTAFFECTED/- | libexpat 2.5.0 outside upstream affected range 2.7.2–2.9.0 (tracker introduced in 2.7.2)
OK   rhel-9/expat/rhel-9.4.z -> NOTAFFECTED/- | libexpat 2.5.0 outside upstream affected range 2.7.2–2.9.0 (tracker introduced in 2.7.2)
OK   rhel-9/expat/rhel-9.6.z -> NOTAFFECTED/- | libexpat 2.5.0 outside upstream affected range 2.7.2–2.9.0 (tracker introduced in 2.7.2)
OK   rhel-9/expat/rhel-9.8.z -> NOTAFFECTED/- | libexpat 2.5.0 outside upstream affected range 2.7.2–2.9.0 (tracker introduced in 2.7.2)
FAIL rhel-9/expat/rhel-9.9.z: {"non_field_errors":["Affect (41540f31-a66e-421f-99fa-281aa49dd79f) for rhel-9.9.z/expat is marked as NOTAFFECTED but has open tracker(s)."],"dt":"2026-11-04T10:22:43.680573Z","revision":"cdfc73e98fe8
SKIP rhivos-2/expat/rhivos-2.0.z -> AFFECTED/OOSS | 2.7.3 in affected range; stream OOSS
SKIP rhivos-core-2/expat/rhivos-2.0.z-core -> AFFECTED/OOSS | 2.7.3 in affected range; stream OOSS
OK   rhivos-2/expat/rhivos-2.1 -> AFFECTED/DELEGATED | shipped libexpat 2.7.3 (allocation tracker / XML_ParserReset bug present)
OK   rhivos-core-2/expat/rhivos-2.1-core -> AFFECTED/DELEGATED | shipped libexpat 2.7.3 (allocation tracker / XML_ParserReset bug present)
OK   rhel-7/firefox/rhel-7-els -> NOTAFFECTED/- | Firefox/Thunderbird 140.x vendors Expat ~2.6.4; allocation tracker (2.7.2+) absent
OK   rhel-8/firefox/rhel-8.10.z -> NOTAFFECTED/- | Firefox/Thunderbird 140.x vendors Expat ~2.6.4; allocation tracker (2.7.2+) absent
OK   rhel-8/thunderbird/rhel-8.10.z -> NOTAFFECTED/- | Firefox/Thunderbird 140.x vendors Expat ~2.6.4; allocation tracker (2.7.2+) absent
OK   rhel-8/xmlrpc-c/rhel-8.10.z -> NOTAFFECTED/- | CoreOS/xmlrpc-c use platform libexpat <2.7.2 (RHEL 8/9 ship 2.2.x/2.5.x)
OK   rhel-8/firefox/rhel-8.4.0.z -> NOTAFFECTED/- | Firefox/Thunderbird 140.x vendors Expat ~2.6.4; allocation tracker (2.7.2+) absent
OK   rhel-8/thunderbird/rhel-8.4.0.z -> NOTAFFECTED/- | Firefox/Thunderbird 140.x vendors Expat ~2.6.4; allocation tracker (2.7.2+) absent
OK   rhel-8/xmlrpc-c/rhel-8.4.0.z -> NOTAFFECTED/- | CoreOS/xmlrpc-c use platform libexpat <2.7.2 (RHEL 8/9 ship 2.2.x/2.5.x)
OK   rhel-8/firefox/rhel-8.6.0.z -> NOTAFFECTED/- | Firefox/Thunderbird 140.x vendors Expat ~2.6.4; allocation tracker (2.7.2+) absent
OK   rhel-8/thunderbird/rhel-8.6.0.z -> NOTAFFECTED/- | Firefox/Thunderbird 140.x vendors Expat ~2.6.4; allocation tracker (2.7.2+) absent
OK   rhel-8/xmlrpc-c/rhel-8.6.0.z -> NOTAFFECTED/- | CoreOS/xmlrpc-c use platform libexpat <2.7.2 (RHEL 8/9 ship 2.2.x/2.5.x)
OK   rhel-8/firefox/rhel-8.8.0.z -> NOTAFFECTED/- | Firefox/Thunderbird 140.x vendors Expat ~2.6.4; allocation tracker (2.7.2+) absent
OK   rhel-8/thunderbird/rhel-8.8.0.z -> NOTAFFECTED/- | Firefox/Thunderbird 140.x vendors Expat ~2.6.4; allocation tracker (2.7.2+) absent
OK   rhel-8/xmlrpc-c/rhel-8.8.0.z -> NOTAFFECTED/- | CoreOS/xmlrpc-c use platform libexpat <2.7.2 (RHEL 8/9 ship 2.2.x/2.5.x)
OK   rhel-10/firefox/rhel-10.0.z -> NOTAFFECTED/- | Firefox/Thunderbird 140.x vendors Expat ~2.6.4; allocation tracker (2.7.2+) absent
OK   rhel-10/thunderbird/rhel-10.0.z -> NOTAFFECTED/- | Firefox/Thunderbird 140.x vendors Expat ~2.6.4; allocation tracker (2.7.2+) absent
OK   rhel-10/firefox/rhel-10.2.z -> NOTAFFECTED/- | Firefox/Thunderbird 140.x vendors Expat ~2.6.4; allocation tracker (2.7.2+) absent
OK   rhel-10/thunderbird/rhel-10.2.z -> NOTAFFECTED/- | Firefox/Thunderbird 140.x vendors Expat ~2.6.4; allocation tracker (2.7.2+) absent
OK   rhel-10/firefox/rhel-10.3.z -> NOTAFFECTED/- | Firefox/Thunderbird 140.x vendors Expat ~2.6.4; allocation tracker (2.7.2+) absent
OK   rhel-10/thunderbird/rhel-10.3.z -> NOTAFFECTED/- | Firefox/Thunderbird 140.x vendors Expat ~2.6.4; allocation tracker (2.7.2+) absent
OK   rhel-10/firefox/rhel-10.4 -> NOTAFFECTED/- | Firefox/Thunderbird 140.x vendors Expat ~2.6.4; allocation tracker (2.7.2+) absent
OK   rhel-10/thunderbird/rhel-10.4 -> NOTAFFECTED/- | Firefox/Thunderbird 140.x vendors Expat ~2.6.4; allocation tracker (2.7.2+) absent
OK   rhel-9/firefox/rhel-9.10 -> NOTAFFECTED/- | Firefox/Thunderbird 140.x vendors Expat ~2.6.4; allocation tracker (2.7.2+) absent
OK   rhel-9/thunderbird/rhel-9.10 -> NOTAFFECTED/- | Firefox/Thunderbird 140.x vendors Expat ~2.6.4; allocation tracker (2.7.2+) absent
OK   rhel-9/firefox/rhel-9.2.0.z -> NOTAFFECTED/- | Firefox/Thunderbird 140.x vendors Expat ~2.6.4; allocation tracker (2.7.2+) absent
OK   rhel-9/thunderbird/rhel-9.2.0.z -> NOTAFFECTED/- | Firefox/Thunderbird 140.x vendors Expat ~2.6.4; allocation tracker (2.7.2+) absent
OK   rhel-9/firefox/rhel-9.4.z -> NOTAFFECTED/- | Firefox/Thunderbird 140.x vendors Expat ~2.6.4; allocation tracker (2.7.2+) absent
OK   rhel-9/thunderbird/rhel-9.4.z -> NOTAFFECTED/- | Firefox/Thunderbird 140.x vendors Expat ~2.6.4; allocation tracker (2.7.2+) absent
OK   rhel-9/firefox/rhel-9.6.z -> NOTAFFECTED/- | Firefox/Thunderbird 140.x vendors Expat ~2.6.4; allocation tracker (2.7.2+) absent
OK   rhel-9/thunderbird/rhel-9.6.z -> NOTAFFECTED/- | Firefox/Thunderbird 140.x vendors Expat ~2.6.4; allocation tracker (2.7.2+) absent
OK   rhel-9/firefox/rhel-9.8.z -> NOTAFFECTED/- | Firefox/Thunderbird 140.x vendors Expat ~2.6.4; allocation tracker (2.7.2+) absent
OK   rhel-9/thunderbird/rhel-9.8.z -> NOTAFFECTED/- | Firefox/Thunderbird 140.x vendors Expat ~2.6.4; allocation tracker (2.7.2+) absent
OK   rhel-9/firefox/rhel-9.9.z -> NOTAFFECTED/- | Firefox/Thunderbird 140.x vendors Expat ~2.6.4; allocation tracker (2.7.2+) absent
OK   rhel-9/thunderbird/rhel-9.9.z -> NOTAFFECTED/- | Firefox/Thunderbird 140.x vendors Expat ~2.6.4; allocation tracker (2.7.2+) absent
OK   rhivos-2/firefox/rhivos-2.0.z -> NOTAFFECTED/- | Firefox/Thunderbird 140.x vendors Expat ~2.6.4; allocation tracker (2.7.2+) absent
OK   rhivos-2/thunderbird/rhivos-2.0.z -> NOTAFFECTED/- | Firefox/Thunderbird 140.x vendors Expat ~2.6.4; allocation tracker (2.7.2+) absent
OK   rhivos-core-2/firefox/rhivos-2.0.z-core -> NOTAFFECTED/- | Firefox/Thunderbird 140.x vendors Expat ~2.6.4; allocation tracker (2.7.2+) absent
OK   rhivos-core-2/thunderbird/rhivos-2.0.z-core -> NOTAFFECTED/- | Firefox/Thunderbird 140.x vendors Expat ~2.6.4; allocation tracker (2.7.2+) absent
OK   rhivos-2/firefox/rhivos-2.1 -> NOTAFFECTED/- | Firefox/Thunderbird 140.x vendors Expat ~2.6.4; allocation tracker (2.7.2+) absent
OK   rhivos-2/thunderbird/rhivos-2.1 -> NOTAFFECTED/- | Firefox/Thunderbird 140.x vendors Expat ~2.6.4; allocation tracker (2.7.2+) absent
OK   rhivos-core-2/firefox/rhivos-2.1-core -> NOTAFFECTED/- | Firefox/Thunderbird 140.x vendors Expat ~2.6.4; allocation tracker (2.7.2+) absent
OK   rhivos-core-2/thunderbird/rhivos-2.1-core -> NOTAFFECTED/- | Firefox/Thunderbird 140.x vendors Expat ~2.6.4; allocation tracker (2.7.2+) absent
OK   openshift-4/openshift/ose-rhel-coreos-8/openshift-4.12.z -> NOTAFFECTED/- | CoreOS/xmlrpc-c use platform libexpat <2.7.2 (RHEL 8/9 ship 2.2.x/2.5.x)
OK   openshift-4/openshift/ose-rhel-coreos-9/openshift-4.13.z -> NOTAFFECTED/- | CoreOS/xmlrpc-c use platform libexpat <2.7.2 (RHEL 8/9 ship 2.2.x/2.5.x)
OK   openshift-4/openshift/ose-rhel-coreos-9/openshift-4.14.z -> NOTAFFECTED/- | CoreOS/xmlrpc-c use platform libexpat <2.7.2 (RHEL 8/9 ship 2.2.x/2.5.x)
OK   openshift-4/openshift/ose-rhel-coreos-9/openshift-4.15.z -> NOTAFFECTED/- | CoreOS/xmlrpc-c use platform libexpat <2.7.2 (RHEL 8/9 ship 2.2.x/2.5.x)
OK   openshift-4/openshift/ose-rhel-coreos-9/openshift-4.16.z -> NOTAFFECTED/- | CoreOS/xmlrpc-c use platform libexpat <2.7.2 (RHEL 8/9 ship 2.2.x/2.5.x)
OK   openshift-4/openshift/ose-rhel-coreos-9/openshift-4.17 -> NOTAFFECTED/- | CoreOS/xmlrpc-c use platform libexpat <2.7.2 (RHEL 8/9 ship 2.2.x/2.5.x)
OK   openshift-4/openshift/ose-rhel-coreos-9/openshift-4.18 -> NOTAFFECTED/- | CoreOS/xmlrpc-c use platform libexpat <2.7.2 (RHEL 8/9 ship 2.2.x/2.5.x)
OK   openshift-4/openshift/ose-rhel-coreos-9/openshift-4.19 -> NOTAFFECTED/- | CoreOS/xmlrpc-c use platform libexpat <2.7.2 (RHEL 8/9 ship 2.2.x/2.5.x)
OK   openshift-4/openshift/ose-rhel-coreos-9/openshift-4.20 -> NOTAFFECTED/- | CoreOS/xmlrpc-c use platform libexpat <2.7.2 (RHEL 8/9 ship 2.2.x/2.5.x)
OK   openshift-4/openshift/ose-rhel-coreos-9/openshift-4.21 -> NOTAFFECTED/- | CoreOS/xmlrpc-c use platform libexpat <2.7.2 (RHEL 8/9 ship 2.2.x/2.5.x)
OK   openshift-4/openshift/ose-rhel-coreos-9/openshift-4.22 -> NOTAFFECTED/- | CoreOS/xmlrpc-c use platform libexpat <2.7.2 (RHEL 8/9 ship 2.2.x/2.5.x)
OK   openshift-5/openshift/ose-rhel-coreos-9/openshift-5.0 -> NOTAFFECTED/- | CoreOS/xmlrpc-c use platform libexpat <2.7.2 (RHEL 8/9 ship 2.2.x/2.5.x)
OK   openshift-5/openshift/ose-rhel-coreos-9/openshift-5.1 -> NOTAFFECTED/- | CoreOS/xmlrpc-c use platform libexpat <2.7.2 (RHEL 8/9 ship 2.2.x/2.5.x)
OK   openshift-4/openshift/ose-rhel-coreos-9/openshift-4.23 -> NOTAFFECTED/- | CoreOS/xmlrpc-c use platform libexpat <2.7.2 (RHEL 8/9 ship 2.2.x/2.5.x)
OK   fedora-all/nodejs-electron/fedora-all -> AFFECTED/DELEGATED | Bundled XML stack may include libexpat ≥2.7.2; track for 2.10.0 uplift
OK   fedora-all/cef/fedora-all -> AFFECTED/DELEGATED | Bundled XML stack may include libexpat ≥2.7.2; track for 2.10.0 uplift
OK   epel-all/chromium/epel-all -> AFFECTED/DELEGATED | Bundled XML stack may include libexpat ≥2.7.2; track for 2.10.0 uplift
OK   fedora-all/chromium/fedora-all -> AFFECTED/DELEGATED | Bundled XML stack may include libexpat ≥2.7.2; track for 2.10.0 uplift

Comment 3 Srikanth Balasubramanian 2026-11-04 11:24:05 UTC

Internal — affect disposition follow-up for CVE-2026-113351

Closed open trackers RHEL-287359 (rhel-8.10.z), RHEL-287360 (rhel-9.10), RHEL-287361 (rhel-9.9.z) and set those expat affects to NOTAFFECTED / Vulnerable Code not Present.

Rationale: CVE-2026-113351 is limited to libexpat 2.7.2–2.9.0 (allocation tracker + XML_ParserReset). RHEL 8/9 ship expat 2.2.x/2.5.0, which lack the tracker introduced in 2.7.2.

Remaining AFFECTED/DELEGATED rows are streams shipping 2.7.2–2.9.0 (e.g. RHEL 10.2+/rhivos-2.1 expat 2.7.3, Fedora 2.8.x/2.9.0, and selected bundled stacks that may include ≥2.7.2). hummingbird left unchanged.