← All notices | Source (USN-8790-1) | Text version

QSN-8790-1: Expat vulnerabilities

September 21, 2026

Summary

Several security issues were fixed in Expat.

Details

It was discovered that Expat could be made to allocate large amounts of memory when parsing a small crafted document. An attacker could possibly use this issue to cause Expat to consume resources, leading to a denial of service. This issue was only addressed in Ubuntu 24.04 LTS. (CVE-2025-59375)

It was discovered that Expat incorrectly handled empty external parameter entity content. An attacker could possibly use this issue to cause Expat to crash, resulting in a denial of service. (CVE-2026-32776)

It was discovered that Expat incorrectly handled certain DTD content. An attacker could possibly use this issue to cause Expat to enter an infinite loop, resulting in a denial of service. (CVE-2026-32777)

It was discovered that Expat incorrectly handled memory when retrying after an earlier out-of-memory condition. An attacker could possibly use this issue to cause Expat to crash, resulting in a denial of service. (CVE-2026-32778)

It was discovered that Expat performed attribute name collision checks inefficiently. An attacker could possibly use this issue to cause Expat to consume resources when processing a moderately sized crafted XML document, resulting in a denial of service. This issue was only addressed in Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-45186)

It was discovered that Expat used insufficient entropy, allowing hash flooding through a crafted XML document. An attacker could possibly use this issue to cause Expat to consume resources, leading to a denial of service. This issue was only addressed in Ubuntu 14.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-41080)

It was discovered that Expat did not track handler call depth for certain functions called from within handlers, leading to a use-after-free. An attacker could possibly use this issue to cause Expat to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2026-50219, CVE-2026-56412)

It was discovered that Expat incorrectly handled certain values, leading to integer overflows. An attacker could possibly use this issue to cause Expat to crash, resulting in a denial of service. (CVE-2026-56403, CVE-2026-56404, CVE-2026-56405)

It was discovered that Expat incorrectly handled certain values, leading to an integer overflow. An attacker could possibly use this issue to cause Expat to crash, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-56408)

Affected QuantaStor releases

ReleasePlatformPackageExposureShipped versionFixed versionStatus
6.9.1.001Ubuntu 22.04 LTSlibexpat1Internally-facing2.4.7-1ubuntu0.92.4.7-1ubuntu0.8Fixed in this release
6.9.1.001Ubuntu 22.04 LTSlibexpat1-devInternally-facing2.4.7-1ubuntu0.92.4.7-1ubuntu0.8Fixed in this release
6.9.0.464Ubuntu 22.04 LTSlibexpat1Internally-facing2.4.7-1ubuntu0.92.4.7-1ubuntu0.8Fixed in this release
6.9.0.464Ubuntu 22.04 LTSlibexpat1-devInternally-facing2.4.7-1ubuntu0.92.4.7-1ubuntu0.8Fixed in this release
6.8.6.015Ubuntu 22.04 LTSlibexpat1Internally-facing2.4.7-1ubuntu0.72.4.7-1ubuntu0.8Fixed by QuantaStor security update
6.8.6.015Ubuntu 22.04 LTSlibexpat1-devInternally-facing2.4.7-1ubuntu0.72.4.7-1ubuntu0.8Fixed by QuantaStor security update
6.8.5.018Ubuntu 22.04 LTSlibexpat1Internally-facing2.4.7-1ubuntu0.72.4.7-1ubuntu0.8Fixed by QuantaStor security update
6.8.5.018Ubuntu 22.04 LTSlibexpat1-devInternally-facing2.4.7-1ubuntu0.72.4.7-1ubuntu0.8Fixed by QuantaStor security update
6.8.4.038Ubuntu 22.04 LTSlibexpat1Internally-facing2.4.7-1ubuntu0.72.4.7-1ubuntu0.8Fixed by QuantaStor security update
6.8.4.038Ubuntu 22.04 LTSlibexpat1-devInternally-facing2.4.7-1ubuntu0.72.4.7-1ubuntu0.8Fixed by QuantaStor security update
6.8.3.018Ubuntu 22.04 LTSlibexpat1Internally-facing2.4.7-1ubuntu0.72.4.7-1ubuntu0.8Fixed by QuantaStor security update
6.8.3.018Ubuntu 22.04 LTSlibexpat1-devInternally-facing2.4.7-1ubuntu0.72.4.7-1ubuntu0.8Fixed by QuantaStor security update
6.8.2.002Ubuntu 22.04 LTSlibexpat1Internally-facing2.4.7-1ubuntu0.72.4.7-1ubuntu0.8Fixed by QuantaStor security update
6.8.2.002Ubuntu 22.04 LTSlibexpat1-devInternally-facing2.4.7-1ubuntu0.72.4.7-1ubuntu0.8Fixed by QuantaStor security update
6.8.1.007Ubuntu 22.04 LTSlibexpat1Internally-facing2.4.7-1ubuntu0.72.4.7-1ubuntu0.8Fixed by QuantaStor security update
6.8.1.007Ubuntu 22.04 LTSlibexpat1-devInternally-facing2.4.7-1ubuntu0.72.4.7-1ubuntu0.8Fixed by QuantaStor security update
6.8.0.205Ubuntu 22.04 LTSlibexpat1Internally-facing2.4.7-1ubuntu0.72.4.7-1ubuntu0.8Fixed by QuantaStor security update
6.8.0.205Ubuntu 22.04 LTSlibexpat1-devInternally-facing2.4.7-1ubuntu0.72.4.7-1ubuntu0.8Fixed by QuantaStor security update

Internally-facing: only accessible when logged into the QuantaStor console/ssh as the qadmin administrative sudo user; generally lower priority. Externally-facing: part of a service the storage platform presents on the network (or the kernel), so potentially reachable over the network.

CVEs

CVE-2026-50219, CVE-2025-59375, CVE-2026-56408, CVE-2026-56412, CVE-2026-41080, CVE-2026-56404, CVE-2026-32777, CVE-2026-56405, CVE-2026-32776, CVE-2026-56403, CVE-2026-32778, CVE-2026-45186

References

https://ubuntu.com/security/notices/USN-8790-1

https://nvd.nist.gov/vuln/detail/CVE-2026-50219

https://nvd.nist.gov/vuln/detail/CVE-2025-59375

https://nvd.nist.gov/vuln/detail/CVE-2026-56408

https://nvd.nist.gov/vuln/detail/CVE-2026-56412

https://nvd.nist.gov/vuln/detail/CVE-2026-41080

https://nvd.nist.gov/vuln/detail/CVE-2026-56404

https://nvd.nist.gov/vuln/detail/CVE-2026-32777

https://nvd.nist.gov/vuln/detail/CVE-2026-56405

https://nvd.nist.gov/vuln/detail/CVE-2026-32776

https://nvd.nist.gov/vuln/detail/CVE-2026-56403

https://nvd.nist.gov/vuln/detail/CVE-2026-32778

https://nvd.nist.gov/vuln/detail/CVE-2026-45186

Update

Fixes marked Fixed by QuantaStor security update are applied by upgrading QuantaStor with security patches included (Upgrade Manager). Fixed package versions:

PlatformPackageVersion
bionicexpat2.2.5-3ubuntu0.9+esm4
Ubuntu 20.04 LTSexpat2.2.9-1ubuntu0.8+esm2
Ubuntu 22.04 LTSexpat2.4.7-1ubuntu0.8
Ubuntu 24.04 LTSexpat2.6.1-2ubuntu0.5
resoluteexpat2.7.4-1ubuntu0.1
trustyexpat2.1.0-4ubuntu1.4+esm12
xenialexpat2.1.0-7ubuntu0.16.04.5+esm13