Skip to content

CVE-2025-66382 on CTRL-OS 26.05

Aliases: CVE-2025-66382

Packages: expat

Status: Blocked: No known fix

Advisory Information

In libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can lead to dozens of seconds of processing time.

Updates

2026-07-18 00:21 CEST

Metadata changes:

  • Status for package expat: “Blocked: No known fix”

Comment:

See upstream issue: https://github.com/libexpat/libexpat/issues/1076

This CVE seems to be, at worst, a DoS.

(Amended on: 2026-07-18 00:22 CEST)

2026-07-16 22:42 CEST

Metadata changes:

  • Status for package expat: “Plausible”

2026-05-29 20:41 CEST

Metadata changes:

  • Status for package expat: “New”

(Amended on: 2026-05-29 20:44 CEST)