Expat 2.8.2 released, fixes 13 vulnerabilities
Expat 2.8.2 has been released, addressing 13 vulnerabilities including high-severity issues like CVE-2025-27113 (heap use-after-free) and CVE-2025-27786 (infinite loop). The update patches flaws in XML processing functions such as XML_ParseBuffer, dtdCopy, and nextScaffoldPart, affecting both standalone and embedded library usage. Users are advised to upgrade to the latest version.
Background
- Expat is an open-source XML parser library written in C, used by countless software projects (including web servers, programming languages, and desktop applications) to process XML data. It is one of the oldest and most widely deployed XML parsers.
- The project just released version 2.8.2, which patches 13 security vulnerabilities, most of them denial-of-service (DoS) bugs that could crash applications when fed crafted XML input. Several are tagged as "high severity."
- The vulnerabilities were discovered and reported by researchers from Intel, Cisco, Code Intelligence, Mozilla, and others — reflecting how critical this library is across the tech stack.
- This matters because Expat runs inside many products (e.g. Python, Perl, PHP, Apache HTTP Server, Git) that users don't think of as "using an XML parser." A single fix here cascades to hundreds of downstream projects once they update their bundled copy.