Hi,

The following vulnerability was published for expat.

CVE-2026-66046[0]:
| Expat through 2.8.3 contains a denial of service vulnerability
| caused by quadratic algorithmic complexity in the storeAtts()
| function in xmlparse.c, where processing N specified attributes with
| non-normalized values triggers an O(N^2) linear scan of
| elementType->defaultAtts to determine CDATA status. A remote
| unauthenticated attacker can supply a single well-formed XML
| document of a few megabytes to an application parsing untrusted XML
| to cause excessive CPU consumption, resulting in denial of service
| without requiring authentication, external entity resolution, or
| non-default parser options.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-66046
https://www.cve.org/CVERecord?id=CVE-2026-66046
[1] https://github.com/libexpat/libexpat/pull/1321

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore