Backport fix for CVE-2026-45186 from upstream PR #1216 to
expat-2.5.0. The patch introduces O(1) attribute collision
detection using a new defaultAttsNames data structure in
xmlparse.c, preventing a denial-of-service via duplicate
attribute names. Seven test cases for duplicate attribute
name handling are included, adapted to the 2.5.0 test
layout (runtests.c).
CVE: CVE-2026-45186
Upstream patches:
- https://github.com/libexpat/libexpat/pull/1216.patch
Resolves: RHEL-177978
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
CVE-2022-25236 expat: namespace-separator characters in "xmlns[:prefix]" attribute values can lead to arbitrary code execution
CVE-2022-25235 expat: malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution
CVE-2022-25315 expat: integer overflow in storeRawNames()
Resolves: CVE-2022-25236
Resolves: CVE-2022-25235
Resolves: CVE-2022-25315
CVE-2022-22826 Integer overflow in nextScaffoldPart in xmlparse.c
CVE-2022-22825 Integer overflow in lookup in xmlparse.c
CVE-2022-22824 Integer overflow in defineAttribute in xmlparse.c
CVE-2022-22823 Integer overflow in build_model in xmlparse.c
CVE-2022-22822 Integer overflow in addBinding in xmlparse.c
Resolves: CVE-2022-22827
Resolves: CVE-2022-22826
Resolves: CVE-2022-22825
Resolves: CVE-2022-22824
Resolves: CVE-2022-22823
Resolves: CVE-2022-22822
