The mission of this ticket is to and list existence of unfixed non-public security issues with libexpat. Issue #1076 already did some of that, but it's no longer a single issue but multiple. In order of reporting, the current list is this:
2025-09-25 Unfixed non-public vulnerability "one" — pull request [CVE-2026-45186] Prevent attribute collision check DoS #1216
2025-09-25 Unfixed non-public vulnerability "two" (i.e. [CVE-2025-66382] Another unfixed non-public denial-of-service vulnerability (that affects all releases of Expat) #1076 ) — validated
2025-11-27 Unfixed non-public vulnerability "three" — pull request [CVE-2026-115506] Precompute entity expanded sizes to detect amplification attacks early #1433
2026-02-24 Unfixed non-public vulnerability — pull request [CVE-2026-32777] lib: Reject XML_TOK_INSTANCE_START infinite loop in entityValueProcessor (fixes #1161) #1162
2026-02-24 Unfixed non-public vulnerability — pull request [CVE-2026-32776] Fix NULL function-pointer dereference for empty external parameter entities #1158
2026-03-04 Unfixed non-public vulnerability — pull request [CVE-2026-32778] Fix NULL deref in setContext on retry after OOM #1163
2026-04-24 Unfixed non-public vulnerability — pull request [CVE-2026-50219] Introduce handler call depth tracking #1246
2026-05-21 Unfixed non-public vulnerability — pull request [CVE-2026-56132] lib: doProlog : Fix out-of-bound scaffolding index store #1272
2026-06-20 Unfixed non-public vulnerability — pull request [CVE-2026-56412] lib: Guard XML_TOK_DATA_CHARS handler calls in doCdataSection #1278
2026-06-23 Unfixed public vulnerability — pull request [CVE-2026-93990] lib: Reject UTF-16 high surrogate not followed by a low surrogate #1282
2026-07-24 Unfixed non-public vulnerability — pull request [CVE-2026-66046] lib: Migrate .isCdata lookup from a linear loop to a hash table lookup #1321
2026-07-28 Unfixed non-public vulnerability (date where I got CC'ed) — pull request [CVE-2026-72522] Fix an OOB read and the resulting infinite loop in *_toUtf16 functions #1296
2026-08-12 Unfixed non-public vulnerability — pull request [CVE-2026-76957] Protect custom encoding callbacks from parser re-entry #1322
2026-08-14 Unfixed non-public vulnerability — pull request [CVE-2026-76956] lib: Fix inverted getentropy() return in writeRandomBytes_getentropy #1326
2026-08-17 Unfixed non-public vulnerability — pull request [CVE-2026-77214] lib: Validate len against buffer capacity in XML_ParseBuffer #1393
2026-08-17 Unfixed non-public vulnerability — CVE-2026-77215 reserved, rejected, works as documented
2026-08-17 Unfixed non-public vulnerability — CVE-2026-77216 reserved, rejected, not considered a vulnerability
2026-08-18 Unfixed non-public vulnerability — TBA, yet to be validated
2026-09-11 Unfixed non-public vulnerability — not a vulnerability, works as documented
2026-09-11 Unfixed non-public vulnerability — not a vulnerability, works as expected
2026-09-22 Unfixed non-public vulnerability — not considered a vulnerability
2026-09-24 Unfixed non-public vulnerability — TBA, yet to be validated
2026-09-24 Unfixed non-public vulnerability — TBA, yet to be validated
2026-09-24 Unfixed non-public vulnerability — TBA, yet to be validated
2026-09-24 Unfixed non-public vulnerability — rejected, runtime claimed to be quadratic but is not
2026-09-24 Unfixed non-public vulnerability — TBA, confirmed
2026-09-24 Unfixed non-public vulnerability — not a vulnerability, hardening maybe, pull request lib: Add missing NULL check for parser->m_startDoctypeDeclHandler #1437
2026-09-24 Unfixed non-public vulnerability — TBA, yet to be validated
2026-09-24 Unfixed non-public vulnerability — TBA, yet to be validated
2026-10-12 Unfixed non-public vulnerability — TBA, yet to be validated
2026-10-12 Unfixed non-public vulnerability — TBA, yet to be validated
2026-10-13 Unfixed non-public vulnerability — TBA, yet to be validated
2026-10-26 Unfixed non-public vulnerability — pull request [CVE-2026-113351] Fix parser reset #1431
you want to help finding true fixes to these and
you are okay with signing a freeform NDA (to keep the vulnerability details confidential until a true fix has made its way into Git master ).
PS: are intentionally closed, please reach out via the e-mail in my profile, instead.
hartwork added bug help wanted security on Mar 6, 2026
libexpat locked as too heated and limited conversation to collaborators on Mar 6, 2026
hartwork pinned this issue on Mar 6, 2026
hartwork changed the title [-] Known unfixed non-public security issues [/-] [+] Unfixed non-public security issues [/+] on Mar 6, 2026
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
