Cyber ·
libexpat 2.10.0 fixes four vulnerabilities, including a denial-of-service issue with XML_ParserReset
On 2 November 2026, Sebastian Pipping announced on the oss-security list that libexpat 2.10.0 fixes four vulnerabilities, identified as CVE-2026-113351, CVE-2026-115506, CVE-2026-117610 and CVE-2026-118370.
On 2 November 2026, Sebastian Pipping posted a note on the oss-security list stating that libexpat 2.10.0, also called Expat 2.10.0 and released that day, fixes four vulnerabilities. The identifiers cited are CVE-2026-113351, CVE-2026-115506, CVE-2026-117610 and CVE-2026-118370. According to the changelog excerpt reproduced in the notice, CVE-2026-113351 is a denial-of-service issue related to the use of XML_ParserReset, fixed in the project's entry #1431. The same changelog links other entries to CVE-2026-115506, whose description is cut off in the source.
The original text is an automatic translation of the oss-security list feed and gives no further details on impact, earlier affected versions or exploitation. To confirm these points, consult the original notice in the oss-security list archive, dated 2 November 2026, and the changelog of the libexpat project itself. This is a security item, so it is not treated as a usage guide.