According to the versions of the expat package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for     XML_ParseBuffer.(CVE-2024-45490)

    An issue was discovered in libexpat before 2.6.3. dtdCopy in xmlparse.c can have an integer overflow for     nDefaultAtts on 32-bit platforms (where UINT_MAX equals SIZE_MAX).(CVE-2024-45491)

    An issue was discovered in libexpat before 2.6.3. nextScaffoldPart in xmlparse.c can have an integer     overflow for m_groupSize on 32-bit platforms (where UINT_MAX equals SIZE_MAX).(CVE-2024-45492)

    An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function     because XML_StopParser can stop/suspend an unstarted parser.(CVE-2024-50602)

    A stack overflow vulnerability exists in the libexpat library due to the way it handles recursive entity     expansion in XML documents. When parsing an XML document with deeply nested entity references, libexpat     can be forced to recurse indefinitely, exhausting the stack space and causing a crash. This issue could     lead to denial of service (DoS) or, in some cases, exploitable memory corruption, depending on the     environment and library usage.(CVE-2024-8176)

    libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small     document that is submitted for parsing.(CVE-2025-59375)

    In libexpat before 2.7.4, XML_ExternalEntityParserCreate does not copy unknown encoding handler user     data.(CVE-2026-24515)

    In libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize     because there is no integer overflow check for tag buffer reallocation.(CVE-2026-25210)

    libexpat before 2.7.5 allows an infinite loop while parsing DTD content.(CVE-2026-32777)

    libexpat before 2.7.5 allows a NULL pointer dereference with empty external parameter entity     content.(CVE-2026-32776)

    libexpat before 2.7.5 allows a NULL pointer dereference in the function setContext on retry after an     earlier ouf-of-memory condition.(CVE-2026-32778)

    libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML     document.(CVE-2026-41080)

    In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial     of service via moderately sized crafted XML input.(CVE-2026-45186)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization expat security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1706 advisory.

    libexpat before 2.7.6 uses insufficient entropy, and thus hash flooding can occur via a crafted XML     document. (CVE-2026-41080)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-163d1fe6c0 advisory.

    Update to expat-2.8.1.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the expat packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial     of service via moderately sized crafted XML input.(CVE-2026-45186)

    libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML     document.(CVE-2026-41080)

Tenable has extracted the preceding description block directly from the EulerOS expat security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1780707176 advisory.

  - libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML     document. (CVE-2026-41080)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6404 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6404-1                   security@debian.org     https://www.debian.org/security/                                  Aron Xu     July 30, 2026                         https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : expat     CVE ID         : CVE-2025-59375 CVE-2026-24515 CVE-2026-25210 CVE-2026-32776                      CVE-2026-32777 CVE-2026-32778 CVE-2026-41080 CVE-2026-45186                      CVE-2026-50219 CVE-2026-56131 CVE-2026-56132 CVE-2026-56403                      CVE-2026-56404 CVE-2026-56405 CVE-2026-56406 CVE-2026-56407                      CVE-2026-56408 CVE-2026-56409 CVE-2026-56410 CVE-2026-56411                      CVE-2026-56412

    Multiple security issues were discovered in expat, an XML parsing C library,     including integer overflows, out-of-bounds write, NULL pointer dereferences,     excessive resource consumption, and memory corruption through re-entrant     parser API calls, which may result in denial of service or potentially the     execution of arbitrary code.

    For the stable distribution (trixie), this problem has been fixed in     version 2.8.2-1~deb13u1.

    We recommend that you upgrade your expat packages.

    For the detailed security status of expat please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/expat

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
347293	EulerOS Virtualization 2.11.0 : expat (EulerOS-SA-2026-3500)	Nessus	Huawei Local Security Checks	2026/9/18	2026/9/18	critical
315017	Amazon Linux 2023 : firefox (ALAS2023-2026-1706)	Nessus	Amazon Linux Local Security Checks	2026/5/16	2026/5/16	high
315969	Fedora 44 : mingw-expat (2026-163d1fe6c0)	Nessus	Fedora Local Security Checks	2026/5/20	2026/5/20	high
332839	EulerOS 2.0 SP13 : expat (EulerOS-SA-2026-3014)	Nessus	Huawei Local Security Checks	2026/8/6	2026/8/6	high
362375	AlmaLinux 9.2 [TuxCare] Security Update: expat / expat-devel / expat-static (ALMALINUX9.2:CLSA-2026:1780707176)	Nessus	Alma Linux Local Security Checks	2026/10/1	2026/10/2	high
330837	Debian dsa-6404 : expat - security update	Nessus	Debian Local Security Checks	2026/7/30	2026/7/30	high

检测

插件搜索

critical

high

high

high

high

high