Cette page suit l'état du correctif pour Alpine Linux. La vulnérabilité elle-même est décrite sur la page CVE principale.
Voir CVE-2026-93990 →
ALPINE-CVE-2026-93990
Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16 sequences to be a...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16 sequences to be accepted. Attackers can supply UTF-16 encoded XML containing lone high surrogates that consume the following code unit, causing Expat to pass unpaired surrogates to applications built with XML_UNICODE and to silently replace input characters in other builds.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Paquets affectés
Alpine:v3.22
expat
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-r0"}]}]
Alpine:v3.23
expat
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-r0"}]}]
Alpine:v3.24
expat
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-r0"}]}]
Références
- advisory security.alpinelinux.org