Backport upstream PR #1272 (5 commits) to fix CVE-2026-56132,
an out-of-bound scaffolding index store in doProlog. The fix
introduces independent tracking of scaffIndex allocation size
and adds bounds checking at use sites, preventing out-of-bounds
writes during XML DTD parsing.
CVE: CVE-2026-56132
Upstream patches:
- https://github.com/libexpat/libexpat/pull/1272.patch
Resolves: RHEL-221012
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Add backport patch for CVE-2026-50219. The patch introduces
handler call depth tracking in the expat XML parser library.
It includes an explicit C++ compatible cast in the test suite
to ensure the patch builds correctly in both C and C++ modes.
CVE: CVE-2026-50219
Upstream patches:
- https://github.com/libexpat/libexpat/pull/1246.patch
Resolves: RHEL-220979
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Backport upstream PR #1216 to fix CVE-2026-45186, which
resolves a quadratic runtime issue in attribute collision
detection. The patch introduces ELEMENT_TYPE.defaultAttsNames
in xmlparse.c and adds 7 new regression test cases for
duplicate attribute name handling. Test changes were adapted
from upstream's split test files to the 2.5.0 runtests.c
layout.
CVE: CVE-2026-45186
Upstream patches:
- https://github.com/libexpat/libexpat/pull/1216.patch
Resolves: RHEL-177979
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
