This page tracks the Alpine Linux fix status. The vulnerability itself is described on the main CVE page.
View CVE-2026-93990 →
ALPINE-CVE-2026-93990
Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16 sequences to be a...
Original description
The description as published by the source.
Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16 sequences to be accepted. Attackers can supply UTF-16 encoded XML containing lone high surrogates that consume the following code unit, causing Expat to pass unpaired surrogates to applications built with XML_UNICODE and to silently replace input characters in other builds.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Affected packages
Alpine:v3.22
expat
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-r0"}]}]
Alpine:v3.23
expat
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-r0"}]}]
Alpine:v3.24
expat
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-r0"}]}]
References
- advisory security.alpinelinux.org