There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity
    in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized
    values triggers an O(N^2) linear scan of elementType->defaultAtts to determine CDATA status. A remote
    unauthenticated attacker can supply a single well-formed XML document of a few megabytes to an application
    parsing untrusted XML to cause excessive CPU consumption, resulting in denial of service without requiring
    authentication, external entity resolution, or non-default parser options. (CVE-2026-66046)

  - Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory
    corruption by processing XML with external entity parsers created via XML_ExternalEntityParserCreate. A
    struct size mismatch between ELEMENT_TYPE members causes storeAtts to read the attIndex member past
    allocated memory boundaries, resulting in failure to normalize whitespace in non-CDATA attributes or a
    wild pointer dereference causing a segfault. This vulnerability was introduced by the fix for
    CVE-2026-66046. (CVE-2026-76641)

  - In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to
    insufficient entropy, which results in being vulnerable to hash flooding attacks, causing a denial of
    service via crafted XML content. (CVE-2026-76956)

  - libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-
    free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412.
    (CVE-2026-76957)

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - 在 libexpat 2.8.2 和 2.8.3 以前 2.8.4版本中，对 getentropy 返回代码的错误解释会导致熵不足，从而导致容易遭受哈希泛洪攻击，从而通过构建的 XML 内容造成拒绝服务。（CVE-2026-76956）

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且廠商未提供可用的修補程式。

  - 在 libexpat 2.8.2 及 2.8.3 之前 2.8.4，誤解 getentropy 的傳回碼會導致熵不足，進而容易受到雜湊溢流攻擊，透過特製的 XML 內容造成拒絕服務。（CVE-2026-76956）

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - libexpat 2.8.2および2.8.4以前の2.8.3では、getentropyのリターンコードの誤解によりエントロピーが不十分になり、結果としてハッシュフラッディング攻撃に対して脆弱になり、細工されたXMLコンテンツを介してサービス拒否が引き起こされます。(CVE-2026-76956)

Nessus は、ベンダーから報告されたパッケージの存在に依存していることに注意してください。

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to     insufficient entropy, which results in being vulnerable to hash flooding attacks, causing a denial of     service via crafted XML content. (CVE-2026-76956)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
447379	Alpine: libexpat, multiple expat packages: security update to 2.8.4-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	2026/9/1	2026/9/9	high
447379	Alpine: libexpat, multiple expat packages: security update to 2.8.4-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	2026/9/1	2026/9/9	high
338289	Linux Distros 未修补的漏洞：CVE-2026-76956	Nessus	Misc.	2026/8/20	2026/9/10	high
338289	Linux Distros 未修補弱點：CVE-2026-76956	Nessus	Misc.	2026/8/20	2026/9/10	high
338289	Linux Distros のパッチ未適用の脆弱性: CVE-2026-76956	Nessus	Misc.	2026/8/20	2026/9/10	high
338289	Linux Distros Unpatched Vulnerability : CVE-2026-76956	Nessus	Misc.	2026/8/20	2026/9/10	high

检测

插件搜索

high

high

high

high

high

high