Hi,

The following vulnerability was published for expat.

CVE-2026-113351[0]:
| libexpat 2.7.2 through 2.9.0 contains a denial of service
| vulnerability because XML_ParserReset zeroes the direct byte count
| but never offsets tracked heap allocations. Attackers can submit a
| large XML document so later documents on the same reset parser fail
| with XML_ERROR_NO_MEMORY until it is recreated.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-113351
https://www.cve.org/CVERecord?id=CVE-2026-113351
[1] https://github.com/libexpat/libexpat/pull/1431

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore