← All notices | Source (USN-8813-1) | Text version

QSN-8813-1: Expat vulnerabilities

September 24, 2026

Summary

Expat could be made to crash or run programs if it received specially crafted input.

Details

It was discovered that Expat did not correctly handle certain integer arithmetic. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-56406, CVE-2026-56407, CVE-2026-56409, CVE-2026-56410, CVE-2026-56411)

It was discovered that Expat did not correctly track handler call depth. An attacker could possibly use this issue to cause Expat to crash or execute arbitrary code. (CVE-2026-56131)

It was discovered that Expat did not correctly handle certain memory operations. An attacker could possibly use this issue to cause Expat to crash or execute arbitrary code. (CVE-2026-56132)

It was discovered that Expat did not correctly handle certain Unicode characters. An attacker could possibly use this issue to cause Expat to use excessive resources, leading to a denial of service. (CVE-2026-72522)

It was discovered that Expat did not correctly process certain XML attributes. A remote attacker could possibly use this issue to cause Expat to use excessive resources, leading to a denial of service. (CVE-2026-66046)

It was discovered that Expat did not correctly handle certain external entities. An attacker could possibly use this issue to cause Expat to crash or execute arbitrary code. (CVE-2026-76641)

It was discovered that Expat did not correctly track handler call depth with custom encodings. An attacker could possibly use this issue to cause Expat to crash or execute arbitrary code. (CVE-2026-76957)

Affected QuantaStor releases

ReleasePlatformPackageExposureShipped versionFixed versionStatus
6.9.1.001Ubuntu 22.04 LTSlibexpat1Internally-facing2.4.7-1ubuntu0.92.4.7-1ubuntu0.9Fixed in this release
6.9.1.001Ubuntu 22.04 LTSlibexpat1-devInternally-facing2.4.7-1ubuntu0.92.4.7-1ubuntu0.9Fixed in this release
6.9.0.464Ubuntu 22.04 LTSlibexpat1Internally-facing2.4.7-1ubuntu0.92.4.7-1ubuntu0.9Fixed in this release
6.9.0.464Ubuntu 22.04 LTSlibexpat1-devInternally-facing2.4.7-1ubuntu0.92.4.7-1ubuntu0.9Fixed in this release
6.8.6.015Ubuntu 22.04 LTSlibexpat1Internally-facing2.4.7-1ubuntu0.72.4.7-1ubuntu0.9Fixed by QuantaStor security update
6.8.6.015Ubuntu 22.04 LTSlibexpat1-devInternally-facing2.4.7-1ubuntu0.72.4.7-1ubuntu0.9Fixed by QuantaStor security update
6.8.5.018Ubuntu 22.04 LTSlibexpat1Internally-facing2.4.7-1ubuntu0.72.4.7-1ubuntu0.9Fixed by QuantaStor security update
6.8.5.018Ubuntu 22.04 LTSlibexpat1-devInternally-facing2.4.7-1ubuntu0.72.4.7-1ubuntu0.9Fixed by QuantaStor security update
6.8.4.038Ubuntu 22.04 LTSlibexpat1Internally-facing2.4.7-1ubuntu0.72.4.7-1ubuntu0.9Fixed by QuantaStor security update
6.8.4.038Ubuntu 22.04 LTSlibexpat1-devInternally-facing2.4.7-1ubuntu0.72.4.7-1ubuntu0.9Fixed by QuantaStor security update
6.8.3.018Ubuntu 22.04 LTSlibexpat1Internally-facing2.4.7-1ubuntu0.72.4.7-1ubuntu0.9Fixed by QuantaStor security update
6.8.3.018Ubuntu 22.04 LTSlibexpat1-devInternally-facing2.4.7-1ubuntu0.72.4.7-1ubuntu0.9Fixed by QuantaStor security update
6.8.2.002Ubuntu 22.04 LTSlibexpat1Internally-facing2.4.7-1ubuntu0.72.4.7-1ubuntu0.9Fixed by QuantaStor security update
6.8.2.002Ubuntu 22.04 LTSlibexpat1-devInternally-facing2.4.7-1ubuntu0.72.4.7-1ubuntu0.9Fixed by QuantaStor security update
6.8.1.007Ubuntu 22.04 LTSlibexpat1Internally-facing2.4.7-1ubuntu0.72.4.7-1ubuntu0.9Fixed by QuantaStor security update
6.8.1.007Ubuntu 22.04 LTSlibexpat1-devInternally-facing2.4.7-1ubuntu0.72.4.7-1ubuntu0.9Fixed by QuantaStor security update
6.8.0.205Ubuntu 22.04 LTSlibexpat1Internally-facing2.4.7-1ubuntu0.72.4.7-1ubuntu0.9Fixed by QuantaStor security update
6.8.0.205Ubuntu 22.04 LTSlibexpat1-devInternally-facing2.4.7-1ubuntu0.72.4.7-1ubuntu0.9Fixed by QuantaStor security update

Internally-facing: only accessible when logged into the QuantaStor console/ssh as the qadmin administrative sudo user; generally lower priority. Externally-facing: part of a service the storage platform presents on the network (or the kernel), so potentially reachable over the network.

CVEs

CVE-2026-56410, CVE-2026-66046, CVE-2026-56406, CVE-2026-56132, CVE-2026-56407, CVE-2026-56411, CVE-2026-72522, CVE-2026-76957, CVE-2026-76641, CVE-2026-56131, CVE-2026-56409

References

https://ubuntu.com/security/notices/USN-8813-1

https://nvd.nist.gov/vuln/detail/CVE-2026-56410

https://nvd.nist.gov/vuln/detail/CVE-2026-66046

https://nvd.nist.gov/vuln/detail/CVE-2026-56406

https://nvd.nist.gov/vuln/detail/CVE-2026-56132

https://nvd.nist.gov/vuln/detail/CVE-2026-56407

https://nvd.nist.gov/vuln/detail/CVE-2026-56411

https://nvd.nist.gov/vuln/detail/CVE-2026-72522

https://nvd.nist.gov/vuln/detail/CVE-2026-76957

https://nvd.nist.gov/vuln/detail/CVE-2026-76641

https://nvd.nist.gov/vuln/detail/CVE-2026-56131

https://nvd.nist.gov/vuln/detail/CVE-2026-56409

Update

Fixes marked Fixed by QuantaStor security update are applied by upgrading QuantaStor with security patches included (Upgrade Manager). Fixed package versions:

PlatformPackageVersion
bionicexpat2.2.5-3ubuntu0.9+esm5
Ubuntu 20.04 LTSexpat2.2.9-1ubuntu0.8+esm3
Ubuntu 22.04 LTSexpat2.4.7-1ubuntu0.9
Ubuntu 24.04 LTSexpat2.6.1-2ubuntu0.6
resoluteexpat2.7.4-1ubuntu0.2
trustyexpat2.1.0-4ubuntu1.4+esm13
xenialexpat2.1.0-7ubuntu0.16.04.5+esm14