ALPINE-CVE-2026-93990

ALPINE-CVE-2026-93990

Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.

Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16 sequences to be accepted. Attackers can supply UTF-16 encoded XML containing lone high surrogates that consume the following code unit, causing Expat to pass unpaired surrogates to applications built with XML_UNICODE and to silently replace input characters in other builds.

CVSS 8.7 · Alta · Corrección disponible

Publicación

2026-09-19T23:17:10.203Z

Actualización

2026-10-18T10:30:02.727361388Z

Pila tecnológica: system

Comprueba tu servidor →