Skip to content

Upgrade bundled Expat to 2.8.5 (e.g. for fix to vulnerability CVE-2026-93990) #157953

Open
Open
Upgrade bundled Expat to 2.8.5 (e.g. for fix to vulnerability CVE-2026-93990)#157953
Assignees
StanFromIreland
Labels
3.10only security fixes3.11only security fixes3.12only security fixes3.13bugs and security fixes3.14bugs and security fixes3.15pre-release feature fixes, bugs and security fixes3.16new features, bugs and security fixesextension-modulesC modules in the Modules dirrelease-blockertopic-XMLtype-securityA security issue

Description

@hartwork
hartwork
opened on Sep 22, 2026

Please see blog post https://blog.hartwork.org/posts/expat-2-8-5-released/ for an overview and the change log at https://github.com/libexpat/libexpat/blob/R_2_8_5/expat/Changes for details. Affects all alive branches of Python. Thank you!

Related: #156723 (predecessor for Expat 2.8.4)

CC @StanFromIreland

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

3.10only security fixes3.11only security fixes3.12only security fixes3.13bugs and security fixes3.14bugs and security fixes3.15pre-release feature fixes, bugs and security fixes3.16new features, bugs and security fixesextension-modulesC modules in the Modules dirrelease-blockertopic-XMLtype-securityA security issue

Projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions