textproc/expat 2.8.5 NetBSD

Release 2.9.0 Mon October 5 2026 Security fixes: #1392 CVE-2026-102633 -- Integer overflow in function expat_realloc on 32bit platforms #1393 CVE-2026-77214 -- Validate parameter `len` against available buffer capacity in XML_ParseBuffer Bug fixes: #1387 lib: Handle OOM when copying encodingName in XML_ParserReset New features: #1327 lib: Introduce new "Properties API" to get and set scalar properties for a single parser instance. There are six new functions: - XML_GetPropertyBool - XML_GetPropertyDouble - XML_GetPropertyUInt64 - XML_SetPropertyBool …

Release 2.8.5 Tue September 22 2026 Security fixes: CVE-2026-93990 -- Reject high surrogates not followed by a low surrogate during UTF-16 decoding; previously, malformed UTF-16 could be smuggled into the application using Expat and could cause arbitrary damage there, depending on how malformed UTF-16 was handled inside the application; validation was not their job but Expat's. This is similar to past vulnerability CVE-2022-25235. Upstream CVSS 3.1 vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (CVSS score: 9.8) Bug fixes: lib: Fix OOM-related memory leak on a failed overflow check lib: Fix memory alignment for architectures with 128bit pointers like CHERI-RISC-V …

Release 2.8.4 Mon August 31 2026 Security fixes: #1321 #1331 CVE-2026-66046, CVE-2026-76641 -- Fix quadratic runtime from "attribute isCdata lookups" that allowed denial of service attacks through moderately sized crafted XML input (CWE-407). The vulnerability is closely related to past CVE-2026-45186 that was fixed with Expat 2.8.1. Please note that a layer of compression around XML can significantly reduce the minimum attack payload size. Upstream CVSS 3.1 vector: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (CVSS score: 7.5) (Note the "AV:N" for network/remote.) …

Release 2.8.3 Mon August 10 2026 Security fixes: #1296 CVE-2026-72522 -- Fix an out-of-bounds read and the resulting infinite loop caused by treating low surrogates (Unicode) the same as high surrogates in functions *_toUtf16. Needs Expat compiled with 16bit character support (e.g. with Firefox and/or on Windows) to be affected. Upstream CVSS 3.1 vector: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (CVSS score: 7.5) (Note the "AV:N" for network/remote, the "AV:L" in NVD by Mitre is mistaken.) Original bug report from Mozilla at: https://bugzilla.mozilla.org/show_bug.cgi?id=2053153 …