This page tracks the Alpine Linux fix status. The vulnerability itself is described on the main CVE page.
View CVE-2026-76957 →
ALPINE-CVE-2026-76957
libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE...
Original description
The description as published by the source.
libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Affected packages
Alpine:v3.21
expat
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.4-r0"}]}]
Alpine:v3.22
expat
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.4-r0"}]}]
Alpine:v3.23
expat
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.4-r0"}]}]
Alpine:v3.24
expat
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.4-r0"}]}]
References
- advisory security.alpinelinux.org