Release date:
2026-10-07 00:32:10 UTC
Description:
- CVE-2026-66046: fix quadratic runtime in storeAtts() by resolving an
attribute's declared type through the default-attribute hash table instead
of a linear scan of the element's default attributes
- CVE-2026-93990: reject a UTF-16 high surrogate that is not followed by a
low surrogate, so malformed UTF-16 can no longer hide markup characters
from the tokenizer
Updated packages:
-
expat-2.0.1-13.el6_8.tuxcare.els14.i686.rpm
sha:dad76eab51d577dd9c97cb22bc8e8a1c335cbaf884b1ba1708bd5ebf430a15e9
-
expat-2.0.1-13.el6_8.tuxcare.els14.x86_64.rpm
sha:73536948279fff300cf201802485e6d73603b23ee6c806e178b50d962b120f13
-
expat-devel-2.0.1-13.el6_8.tuxcare.els14.i686.rpm
sha:887419c7be6902df986cff4f61111ed79e8a6c808b2d28b1829d98ecf300b459
-
expat-devel-2.0.1-13.el6_8.tuxcare.els14.x86_64.rpm
sha:3fb4e24e5639ee736e2d5dbc06a74286dbc6668c0ef8d5f74588dbb0b9d7f4f8
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
