* [wrynose][PATCH 1/3] expat: fix CVE-2026-50219
@ 2026-08-24 15:20 Jakub Szczudlo (Nokia)
2026-08-24 15:20 ` [wrynose][PATCH 2/3] expat: fix CVE-2026-56131 Jakub Szczudlo (Nokia)
` (2 more replies)
0 siblings, 3 replies; 10+ messages in thread
From: Jakub Szczudlo (Nokia) @ 2026-08-24 15:20 UTC (permalink / raw)
To: openembedded-core@lists.openembedded.org
Cc: yoann.congal@smile.fr, Jakub Szczudlo (Nokia)
Expat does not track whether its public parser APIs are called from inside
a user handler. Re-entering the parser through XML_GetBuffer(),
XML_Parse(), XML_ParseBuffer(), XML_ParserFree() or XML_ParserReset() can
therefore result in use-after-free and memory corruption.
The 32 upstream commits are divided as follows:
* 01 introduces the handler call depth counter and the helper functions
used to enter, leave and detect handler execution.
* 02-04 are preparation patches. They extract handler calls from compound
expressions so that depth tracking can be placed before and after each
invocation without changing handler return-value semantics.
* 05-26 instrument the individual handler types. Each patch covers a
distinct callback path; omitting one would leave a route around the
API guards.
* 27-31 add the actual policy enforcement to XML_GetBuffer(), XML_Parse(),
XML_ParseBuffer(), XML_ParserFree() and XML_ParserReset().
* 32 adds regression coverage for all five rejected calls.
Documentation and Changes-file commits from the upstream
series are dropped because they do not affect the fix or its test
coverage.
An explicit XML_Parser cast is added to the regression-test handler
because handlers.c is also included by handlers_cxx.cpp and compiled as
C++ in the OE build.
Upstream pull request:
https://github.com/libexpat/libexpat/pull/1246
Signed-off-by: Jakub Szczudlo <jakub.szczudlo@nokia.com>
---
.../expat/expat/CVE-2026-50219-01.patch | 61 +++++++
.../expat/expat/CVE-2026-50219-02.patch | 84 ++++++++++
.../expat/expat/CVE-2026-50219-03.patch | 92 +++++++++++
.../expat/expat/CVE-2026-50219-04.patch | 34 ++++
.../expat/expat/CVE-2026-50219-05.patch | 48 ++++++
.../expat/expat/CVE-2026-50219-06.patch | 154 ++++++++++++++++++
.../expat/expat/CVE-2026-50219-07.patch | 32 ++++
.../expat/expat/CVE-2026-50219-08.patch | 44 +++++
.../expat/expat/CVE-2026-50219-09.patch | 44 +++++
.../expat/expat/CVE-2026-50219-10.patch | 35 ++++
.../expat/expat/CVE-2026-50219-11.patch | 32 ++++
.../expat/expat/CVE-2026-50219-12.patch | 42 +++++
.../expat/expat/CVE-2026-50219-13.patch | 49 ++++++
.../expat/expat/CVE-2026-50219-14.patch | 74 +++++++++
.../expat/expat/CVE-2026-50219-15.patch | 82 ++++++++++
.../expat/expat/CVE-2026-50219-16.patch | 46 ++++++
.../expat/expat/CVE-2026-50219-17.patch | 64 ++++++++
.../expat/expat/CVE-2026-50219-18.patch | 32 ++++
.../expat/expat/CVE-2026-50219-19.patch | 87 ++++++++++
.../expat/expat/CVE-2026-50219-20.patch | 62 +++++++
.../expat/expat/CVE-2026-50219-21.patch | 46 ++++++
.../expat/expat/CVE-2026-50219-22.patch | 48 ++++++
.../expat/expat/CVE-2026-50219-23.patch | 36 ++++
.../expat/expat/CVE-2026-50219-24.patch | 33 ++++
.../expat/expat/CVE-2026-50219-25.patch | 35 ++++
.../expat/expat/CVE-2026-50219-26.patch | 33 ++++
.../expat/expat/CVE-2026-50219-27.patch | 30 ++++
.../expat/expat/CVE-2026-50219-28.patch | 30 ++++
.../expat/expat/CVE-2026-50219-29.patch | 31 ++++
.../expat/expat/CVE-2026-50219-30.patch | 31 ++++
.../expat/expat/CVE-2026-50219-31.patch | 31 ++++
.../expat/expat/CVE-2026-50219-32.patch | 100 ++++++++++++
meta/recipes-core/expat/expat_2.7.5.bb | 32 ++++
33 files changed, 1714 insertions(+)
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-01.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-02.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-03.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-04.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-05.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-06.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-07.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-08.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-09.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-10.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-11.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-12.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-13.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-14.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-15.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-16.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-17.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-18.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-19.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-20.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-21.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-22.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-23.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-24.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-25.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-26.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-27.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-28.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-29.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-30.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-31.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-50219-32.patch
diff --git a/meta/recipes-core/expat/expat/CVE-2026-50219-01.patch b/meta/recipes-core/expat/expat/CVE-2026-50219-01.patch
new file mode 100644
index 0000000000..1d3a8cbba2
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-50219-01.patch
@@ -0,0 +1,61 @@
+From 8da7b772a31155083a37796f96e622f6dce25454 Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Tue, 26 May 2026 15:15:10 +0200
+Subject: [PATCH] lib: Introduce handler call depth tracking
+
+(cherry picked from commit f69d0719bf01596f1d95c9e902f4a279e62c6305)
+
+CVE: CVE-2026-50219
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/f69d0719bf01596f1d95c9e902f4a279e62c6305]
+Signed-off-by: Jakub Szczudlo <jakub.szczudlo@nokia.com>
+---
+ lib/xmlparse.c | 19 +++++++++++++++++++
+ 1 file changed, 19 insertions(+)
+
+diff --git a/lib/xmlparse.c b/lib/xmlparse.c
+index 2a5ebb7..38617a6 100644
+--- a/lib/xmlparse.c
++++ b/lib/xmlparse.c
+@@ -793,6 +793,7 @@ struct XML_ParserStruct {
+ ENTITY_STATS m_entity_stats;
+ #endif
+ XML_Bool m_reenter;
++ unsigned m_handlerCallDepth;
+ };
+
+ #if XML_GE == 1
+@@ -1260,6 +1261,23 @@ generate_hash_secret_salt(void) {
+ #endif
+ }
+
++static void
++beforeHandler(XML_Parser parser) {
++ assert(parser->m_handlerCallDepth < UINT_MAX);
++ parser->m_handlerCallDepth++;
++}
++
++static void
++afterHandler(XML_Parser parser) {
++ assert(parser->m_handlerCallDepth > 0);
++ parser->m_handlerCallDepth--;
++}
++
++static bool
++isCalledFromInsideHandler(XML_Parser parser) {
++ return parser->m_handlerCallDepth > 0;
++}
++
+ static enum XML_Error
+ callProcessor(XML_Parser parser, const char *start, const char *end,
+ const char **endPtr) {
+@@ -1614,6 +1632,7 @@ parserInit(XML_Parser parser, const XML_Char *encodingName) {
+ parser->m_parsingStatus.parsing = XML_INITIALIZED;
+ // Reentry can only be triggered inside m_processor calls
+ parser->m_reenter = XML_FALSE;
++ parser->m_handlerCallDepth = 0;
+ #ifdef XML_DTD
+ parser->m_isParamEntity = XML_FALSE;
+ parser->m_useForeignDTD = XML_FALSE;
+--
+2.34.1
+
diff --git a/meta/recipes-core/expat/expat/CVE-2026-50219-02.patch b/meta/recipes-core/expat/expat/CVE-2026-50219-02.patch
new file mode 100644
index 0000000000..bb9335381a
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-50219-02.patch
@@ -0,0 +1,84 @@
+From 3832d4080d50d5aeeeaae32688ba3bf4af2042a2 Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Tue, 26 May 2026 21:33:26 +0200
+Subject: [PATCH] lib: Prepare `m_notStandaloneHandler` calls for upcoming
+ wrapping
+
+(cherry picked from commit cdd21e84e150cc2ca961533e157bd52e3cbb4aa4)
+
+CVE: CVE-2026-50219
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/cdd21e84e150cc2ca961533e157bd52e3cbb4aa4]
+Signed-off-by: Jakub Szczudlo <jakub.szczudlo@nokia.com>
+---
+ lib/xmlparse.c | 34 ++++++++++++++++++++++------------
+ 1 file changed, 22 insertions(+), 12 deletions(-)
+
+diff --git a/lib/xmlparse.c b/lib/xmlparse.c
+index 38617a6..65df026 100644
+--- a/lib/xmlparse.c
++++ b/lib/xmlparse.c
+@@ -5537,9 +5537,12 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end,
+ entity->systemId, entity->publicId))
+ return XML_ERROR_EXTERNAL_ENTITY_HANDLING;
+ if (dtd->paramEntityRead) {
+- if (! dtd->standalone && parser->m_notStandaloneHandler
+- && ! parser->m_notStandaloneHandler(parser->m_handlerArg))
+- return XML_ERROR_NOT_STANDALONE;
++ if (! dtd->standalone && parser->m_notStandaloneHandler) {
++ const int handlerStatus
++ = parser->m_notStandaloneHandler(parser->m_handlerArg);
++ if (! handlerStatus)
++ return XML_ERROR_NOT_STANDALONE;
++ }
+ }
+ /* if we didn't read the foreign DTD then this means that there
+ is no external subset and we must reset dtd->hasParamEntityRefs
+@@ -5577,9 +5580,12 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end,
+ entity->systemId, entity->publicId))
+ return XML_ERROR_EXTERNAL_ENTITY_HANDLING;
+ if (dtd->paramEntityRead) {
+- if (! dtd->standalone && parser->m_notStandaloneHandler
+- && ! parser->m_notStandaloneHandler(parser->m_handlerArg))
+- return XML_ERROR_NOT_STANDALONE;
++ if (! dtd->standalone && parser->m_notStandaloneHandler) {
++ const int handlerStatus
++ = parser->m_notStandaloneHandler(parser->m_handlerArg);
++ if (! handlerStatus)
++ return XML_ERROR_NOT_STANDALONE;
++ }
+ }
+ /* if we didn't read the foreign DTD then this means that there
+ is no external subset and we must reset dtd->hasParamEntityRefs
+@@ -5793,9 +5799,11 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end,
+ #ifdef XML_DTD
+ && ! parser->m_paramEntityParsing
+ #endif /* XML_DTD */
+- && parser->m_notStandaloneHandler
+- && ! parser->m_notStandaloneHandler(parser->m_handlerArg))
+- return XML_ERROR_NOT_STANDALONE;
++ && parser->m_notStandaloneHandler) {
++ const int status = parser->m_notStandaloneHandler(parser->m_handlerArg);
++ if (! status)
++ return XML_ERROR_NOT_STANDALONE;
++ }
+ #ifndef XML_DTD
+ break;
+ #else /* XML_DTD */
+@@ -6179,9 +6187,11 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end,
+ }
+ }
+ #endif /* XML_DTD */
+- if (! dtd->standalone && parser->m_notStandaloneHandler
+- && ! parser->m_notStandaloneHandler(parser->m_handlerArg))
+- return XML_ERROR_NOT_STANDALONE;
++ if (! dtd->standalone && parser->m_notStandaloneHandler) {
++ const int status = parser->m_notStandaloneHandler(parser->m_handlerArg);
++ if (! status)
++ return XML_ERROR_NOT_STANDALONE;
++ }
+ break;
+
+ /* Element declaration stuff */
+--
+2.34.1
+
diff --git a/meta/recipes-core/expat/expat/CVE-2026-50219-03.patch b/meta/recipes-core/expat/expat/CVE-2026-50219-03.patch
new file mode 100644
index 0000000000..dca99968ae
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-50219-03.patch
@@ -0,0 +1,92 @@
+From 3fd5635fac887f161ab02adf749c2bab1d2ee904 Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Sat, 30 May 2026 00:45:34 +0200
+Subject: [PATCH] lib: Prepare `m_externalEntityRefHandler` calls for upcoming
+ wrapping
+
+(cherry picked from commit 1ffe852fe1d8e1d73eb4eb5798456aefc8300299)
+
+CVE: CVE-2026-50219
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/1ffe852fe1d8e1d73eb4eb5798456aefc8300299]
+Signed-off-by: Jakub Szczudlo <jakub.szczudlo@nokia.com>
+---
+ lib/xmlparse.c | 35 ++++++++++++++++++++---------------
+ 1 file changed, 20 insertions(+), 15 deletions(-)
+
+diff --git a/lib/xmlparse.c b/lib/xmlparse.c
+index 65df026..eb8e803 100644
+--- a/lib/xmlparse.c
++++ b/lib/xmlparse.c
+@@ -3533,9 +3533,10 @@ doContent(XML_Parser parser, int startTagLevel, const ENCODING *enc,
+ entity->open = XML_FALSE;
+ if (! context)
+ return XML_ERROR_NO_MEMORY;
+- if (! parser->m_externalEntityRefHandler(
+- parser->m_externalEntityRefHandlerArg, context, entity->base,
+- entity->systemId, entity->publicId))
++ const int status = parser->m_externalEntityRefHandler(
++ parser->m_externalEntityRefHandlerArg, context, entity->base,
++ entity->systemId, entity->publicId);
++ if (! status)
+ return XML_ERROR_EXTERNAL_ENTITY_HANDLING;
+ poolDiscard(&parser->m_tempPool);
+ } else if (parser->m_defaultHandler)
+@@ -5532,9 +5533,10 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end,
+ if (parser->m_useForeignDTD)
+ entity->base = parser->m_curBase;
+ dtd->paramEntityRead = XML_FALSE;
+- if (! parser->m_externalEntityRefHandler(
+- parser->m_externalEntityRefHandlerArg, 0, entity->base,
+- entity->systemId, entity->publicId))
++ const int status = parser->m_externalEntityRefHandler(
++ parser->m_externalEntityRefHandlerArg, 0, entity->base,
++ entity->systemId, entity->publicId);
++ if (! status)
+ return XML_ERROR_EXTERNAL_ENTITY_HANDLING;
+ if (dtd->paramEntityRead) {
+ if (! dtd->standalone && parser->m_notStandaloneHandler) {
+@@ -5575,9 +5577,10 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end,
+ return XML_ERROR_NO_MEMORY;
+ entity->base = parser->m_curBase;
+ dtd->paramEntityRead = XML_FALSE;
+- if (! parser->m_externalEntityRefHandler(
+- parser->m_externalEntityRefHandlerArg, 0, entity->base,
+- entity->systemId, entity->publicId))
++ const int status = parser->m_externalEntityRefHandler(
++ parser->m_externalEntityRefHandlerArg, 0, entity->base,
++ entity->systemId, entity->publicId);
++ if (! status)
+ return XML_ERROR_EXTERNAL_ENTITY_HANDLING;
+ if (dtd->paramEntityRead) {
+ if (! dtd->standalone && parser->m_notStandaloneHandler) {
+@@ -6167,9 +6170,10 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end,
+ dtd->paramEntityRead = XML_FALSE;
+ entity->open = XML_TRUE;
+ entityTrackingOnOpen(parser, entity, __LINE__);
+- if (! parser->m_externalEntityRefHandler(
+- parser->m_externalEntityRefHandlerArg, 0, entity->base,
+- entity->systemId, entity->publicId)) {
++ const int status = parser->m_externalEntityRefHandler(
++ parser->m_externalEntityRefHandlerArg, 0, entity->base,
++ entity->systemId, entity->publicId);
++ if (! status) {
+ entityTrackingOnClose(parser, entity, __LINE__);
+ entity->open = XML_FALSE;
+ return XML_ERROR_EXTERNAL_ENTITY_HANDLING;
+@@ -6959,9 +6963,10 @@ storeEntityValue(XML_Parser parser, const ENCODING *enc,
+ dtd->paramEntityRead = XML_FALSE;
+ entity->open = XML_TRUE;
+ entityTrackingOnOpen(parser, entity, __LINE__);
+- if (! parser->m_externalEntityRefHandler(
+- parser->m_externalEntityRefHandlerArg, 0, entity->base,
+- entity->systemId, entity->publicId)) {
++ const int status = parser->m_externalEntityRefHandler(
++ parser->m_externalEntityRefHandlerArg, 0, entity->base,
++ entity->systemId, entity->publicId);
++ if (! status) {
+ entityTrackingOnClose(parser, entity, __LINE__);
+ entity->open = XML_FALSE;
+ result = XML_ERROR_EXTERNAL_ENTITY_HANDLING;
+--
+2.34.1
+
diff --git a/meta/recipes-core/expat/expat/CVE-2026-50219-04.patch b/meta/recipes-core/expat/expat/CVE-2026-50219-04.patch
new file mode 100644
index 0000000000..3f4070e6e6
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-50219-04.patch
@@ -0,0 +1,34 @@
+From 9a13084051f0dbff8f980db7aca46b02111cb6d5 Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Sat, 30 May 2026 00:46:36 +0200
+Subject: [PATCH] lib: Prepare `m_unknownEncodingHandler` calls for upcoming
+ wrapping
+
+(cherry picked from commit adcafd4316259ef48b1763e584733a7bff4a8db0)
+
+CVE: CVE-2026-50219
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/adcafd4316259ef48b1763e584733a7bff4a8db0]
+Signed-off-by: Jakub Szczudlo <jakub.szczudlo@nokia.com>
+---
+ lib/xmlparse.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/lib/xmlparse.c b/lib/xmlparse.c
+index eb8e803..dddcb47 100644
+--- a/lib/xmlparse.c
++++ b/lib/xmlparse.c
+@@ -5057,8 +5057,9 @@ handleUnknownEncoding(XML_Parser parser, const XML_Char *encodingName) {
+ info.convert = NULL;
+ info.data = NULL;
+ info.release = NULL;
+- if (parser->m_unknownEncodingHandler(parser->m_unknownEncodingHandlerData,
+- encodingName, &info)) {
++ const int status = parser->m_unknownEncodingHandler(
++ parser->m_unknownEncodingHandlerData, encodingName, &info);
++ if (status) {
+ ENCODING *enc;
+ parser->m_unknownEncodingMem = MALLOC(parser, XmlSizeOfUnknownEncoding());
+ if (! parser->m_unknownEncodingMem) {
+--
+2.34.1
+
diff --git a/meta/recipes-core/expat/expat/CVE-2026-50219-05.patch b/meta/recipes-core/expat/expat/CVE-2026-50219-05.patch
new file mode 100644
index 0000000000..29f9a0afcc
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-50219-05.patch
@@ -0,0 +1,48 @@
+From 6e755a1e9c3e4cc7c1ed60c96e9d2e1659daf5da Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Tue, 26 May 2026 21:05:19 +0200
+Subject: [PATCH] lib: Register `m_attlistDeclHandler` with handler call depth
+ tracking
+
+(cherry picked from commit 781092f189a8c8e8be6640258829a7f783864282)
+
+CVE: CVE-2026-50219
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/781092f189a8c8e8be6640258829a7f783864282]
+Signed-off-by: Jakub Szczudlo <jakub.szczudlo@nokia.com>
+---
+ lib/xmlparse.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/lib/xmlparse.c b/lib/xmlparse.c
+index dddcb47..16ab984 100644
+--- a/lib/xmlparse.c
++++ b/lib/xmlparse.c
+@@ -5682,10 +5682,12 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end,
+ poolFinish(&parser->m_tempPool);
+ }
+ *eventEndPP = s;
++ beforeHandler(parser);
+ parser->m_attlistDeclHandler(
+ parser->m_handlerArg, parser->m_declElementType->name,
+ parser->m_declAttributeId->name, parser->m_declAttributeType, 0,
+ role == XML_ROLE_REQUIRED_ATTRIBUTE_VALUE);
++ afterHandler(parser);
+ handleDefault = XML_FALSE;
+ }
+ }
+@@ -5720,10 +5722,12 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end,
+ poolFinish(&parser->m_tempPool);
+ }
+ *eventEndPP = s;
++ beforeHandler(parser);
+ parser->m_attlistDeclHandler(
+ parser->m_handlerArg, parser->m_declElementType->name,
+ parser->m_declAttributeId->name, parser->m_declAttributeType,
+ attVal, role == XML_ROLE_FIXED_ATTRIBUTE_VALUE);
++ afterHandler(parser);
+ poolClear(&parser->m_tempPool);
+ handleDefault = XML_FALSE;
+ }
+--
+2.34.1
+
diff --git a/meta/recipes-core/expat/expat/CVE-2026-50219-06.patch b/meta/recipes-core/expat/expat/CVE-2026-50219-06.patch
new file mode 100644
index 0000000000..c5ca02b37a
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-50219-06.patch
@@ -0,0 +1,154 @@
+From 80765c36bc9b272d0141fa8c3ea3da59a16c443e Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Tue, 26 May 2026 21:08:02 +0200
+Subject: [PATCH] lib: Register `m_characterDataHandler` with handler call
+ depth tracking
+
+(cherry picked from commit 5ee607587a997220a48e78b5f6c55a05e50e5b20)
+
+CVE: CVE-2026-50219
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/5ee607587a997220a48e78b5f6c55a05e50e5b20]
+Signed-off-by: Jakub Szczudlo <jakub.szczudlo@nokia.com>
+---
+ lib/xmlparse.c | 44 ++++++++++++++++++++++++++++++++++----------
+ 1 file changed, 34 insertions(+), 10 deletions(-)
+
+diff --git a/lib/xmlparse.c b/lib/xmlparse.c
+index 16ab984..4556805 100644
+--- a/lib/xmlparse.c
++++ b/lib/xmlparse.c
+@@ -3428,7 +3428,9 @@ doContent(XML_Parser parser, int startTagLevel, const ENCODING *enc,
+ *eventEndPP = end;
+ if (parser->m_characterDataHandler) {
+ XML_Char c = 0xA;
++ beforeHandler(parser);
+ parser->m_characterDataHandler(parser->m_handlerArg, &c, 1);
++ afterHandler(parser);
+ } else if (parser->m_defaultHandler)
+ reportDefault(parser, enc, s, end);
+ /* We are at the end of the final buffer, should we check for
+@@ -3481,9 +3483,11 @@ doContent(XML_Parser parser, int startTagLevel, const ENCODING *enc,
+ ((char *)&ch) + sizeof(XML_Char), __LINE__,
+ XML_ACCOUNT_ENTITY_EXPANSION);
+ #endif /* XML_GE == 1 */
+- if (parser->m_characterDataHandler)
++ if (parser->m_characterDataHandler) {
++ beforeHandler(parser);
+ parser->m_characterDataHandler(parser->m_handlerArg, &ch, 1);
+- else if (parser->m_defaultHandler)
++ afterHandler(parser);
++ } else if (parser->m_defaultHandler)
+ reportDefault(parser, enc, s, next);
+ break;
+ }
+@@ -3729,8 +3733,10 @@ doContent(XML_Parser parser, int startTagLevel, const ENCODING *enc,
+ return XML_ERROR_BAD_CHAR_REF;
+ if (parser->m_characterDataHandler) {
+ XML_Char buf[XML_ENCODE_MAX];
++ beforeHandler(parser);
+ parser->m_characterDataHandler(parser->m_handlerArg, buf,
+ XmlEncode(n, (ICHAR *)buf));
++ afterHandler(parser);
+ } else if (parser->m_defaultHandler)
+ reportDefault(parser, enc, s, next);
+ } break;
+@@ -3739,7 +3745,9 @@ doContent(XML_Parser parser, int startTagLevel, const ENCODING *enc,
+ case XML_TOK_DATA_NEWLINE:
+ if (parser->m_characterDataHandler) {
+ XML_Char c = 0xA;
++ beforeHandler(parser);
+ parser->m_characterDataHandler(parser->m_handlerArg, &c, 1);
++ afterHandler(parser);
+ } else if (parser->m_defaultHandler)
+ reportDefault(parser, enc, s, next);
+ break;
+@@ -3760,11 +3768,13 @@ doContent(XML_Parser parser, int startTagLevel, const ENCODING *enc,
+ However, now we have a start/endCdataSectionHandler, so it seems
+ easier to let the user deal with this.
+ */
+- else if ((0) && parser->m_characterDataHandler)
++ else if ((0) && parser->m_characterDataHandler) {
++ beforeHandler(parser);
+ parser->m_characterDataHandler(parser->m_handlerArg, parser->m_dataBuf,
+ 0);
+- /* END disabled code */
+- else if (parser->m_defaultHandler)
++ afterHandler(parser);
++ /* END disabled code */
++ } else if (parser->m_defaultHandler)
+ reportDefault(parser, enc, s, next);
+ result
+ = doCdataSection(parser, enc, &next, end, nextPtr, haveMore, account);
+@@ -3784,13 +3794,18 @@ doContent(XML_Parser parser, int startTagLevel, const ENCODING *enc,
+ if (MUST_CONVERT(enc, s)) {
+ ICHAR *dataPtr = (ICHAR *)parser->m_dataBuf;
+ XmlConvert(enc, &s, end, &dataPtr, (ICHAR *)parser->m_dataBufEnd);
++ beforeHandler(parser);
+ parser->m_characterDataHandler(
+ parser->m_handlerArg, parser->m_dataBuf,
+ (int)(dataPtr - (ICHAR *)parser->m_dataBuf));
+- } else
++ afterHandler(parser);
++ } else {
++ beforeHandler(parser);
+ parser->m_characterDataHandler(
+ parser->m_handlerArg, (const XML_Char *)s,
+ (int)((const XML_Char *)end - (const XML_Char *)s));
++ afterHandler(parser);
++ }
+ } else if (parser->m_defaultHandler)
+ reportDefault(parser, enc, s, end);
+ /* We are at the end of the final buffer, should we check for
+@@ -3815,16 +3830,21 @@ doContent(XML_Parser parser, int startTagLevel, const ENCODING *enc,
+ const enum XML_Convert_Result convert_res = XmlConvert(
+ enc, &s, next, &dataPtr, (ICHAR *)parser->m_dataBufEnd);
+ *eventEndPP = s;
++ beforeHandler(parser);
+ charDataHandler(parser->m_handlerArg, parser->m_dataBuf,
+ (int)(dataPtr - (ICHAR *)parser->m_dataBuf));
++ afterHandler(parser);
+ if ((convert_res == XML_CONVERT_COMPLETED)
+ || (convert_res == XML_CONVERT_INPUT_INCOMPLETE))
+ break;
+ *eventPP = s;
+ }
+- } else
++ } else {
++ beforeHandler(parser);
+ charDataHandler(parser->m_handlerArg, (const XML_Char *)s,
+ (int)((const XML_Char *)next - (const XML_Char *)s));
++ afterHandler(parser);
++ }
+ } else if (parser->m_defaultHandler)
+ reportDefault(parser, enc, s, next);
+ } break;
+@@ -4730,11 +4750,13 @@ doCdataSection(XML_Parser parser, const ENCODING *enc, const char **startPtr,
+ parser->m_endCdataSectionHandler(parser->m_handlerArg);
+ /* BEGIN disabled code */
+ /* see comment under XML_TOK_CDATA_SECT_OPEN */
+- else if ((0) && parser->m_characterDataHandler)
++ else if ((0) && parser->m_characterDataHandler) {
++ beforeHandler(parser);
+ parser->m_characterDataHandler(parser->m_handlerArg, parser->m_dataBuf,
+ 0);
+- /* END disabled code */
+- else if (parser->m_defaultHandler)
++ afterHandler(parser);
++ /* END disabled code */
++ } else if (parser->m_defaultHandler)
+ reportDefault(parser, enc, s, next);
+ *startPtr = next;
+ *nextPtr = next;
+@@ -4745,7 +4767,9 @@ doCdataSection(XML_Parser parser, const ENCODING *enc, const char **startPtr,
+ case XML_TOK_DATA_NEWLINE:
+ if (parser->m_characterDataHandler) {
+ XML_Char c = 0xA;
++ beforeHandler(parser);
+ parser->m_characterDataHandler(parser->m_handlerArg, &c, 1);
++ afterHandler(parser);
+ } else if (parser->m_defaultHandler)
+ reportDefault(parser, enc, s, next);
+ break;
+--
+2.34.1
+
diff --git a/meta/recipes-core/expat/expat/CVE-2026-50219-07.patch b/meta/recipes-core/expat/expat/CVE-2026-50219-07.patch
new file mode 100644
index 0000000000..1bf15cdd01
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-50219-07.patch
@@ -0,0 +1,32 @@
+From bba681b574c9675f331e79db0513bb9df1fec523 Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Tue, 26 May 2026 21:08:40 +0200
+Subject: [PATCH] lib: Register `m_commentHandler` with handler call depth
+ tracking
+
+(cherry picked from commit 0e7dbfee7912a8e25aace775be47e5ad570b9cc3)
+
+CVE: CVE-2026-50219
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/0e7dbfee7912a8e25aace775be47e5ad570b9cc3]
+Signed-off-by: Jakub Szczudlo <jakub.szczudlo@nokia.com>
+---
+ lib/xmlparse.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/lib/xmlparse.c b/lib/xmlparse.c
+index 4556805..98ffe5a 100644
+--- a/lib/xmlparse.c
++++ b/lib/xmlparse.c
+@@ -7269,7 +7269,9 @@ reportComment(XML_Parser parser, const ENCODING *enc, const char *start,
+ if (! data)
+ return 0;
+ normalizeLines(data);
++ beforeHandler(parser);
+ parser->m_commentHandler(parser->m_handlerArg, data);
++ afterHandler(parser);
+ poolClear(&parser->m_tempPool);
+ return 1;
+ }
+--
+2.34.1
+
diff --git a/meta/recipes-core/expat/expat/CVE-2026-50219-08.patch b/meta/recipes-core/expat/expat/CVE-2026-50219-08.patch
new file mode 100644
index 0000000000..7a21357ae7
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-50219-08.patch
@@ -0,0 +1,44 @@
+From c6e96e6a5ec4afc710f4aee2b81bda4baca71a25 Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Tue, 26 May 2026 21:14:10 +0200
+Subject: [PATCH] lib: Register `m_defaultHandler` with handler call depth
+ tracking
+
+(cherry picked from commit e5b76bd58dd9984cef46c2a66a98b03c95a3c774)
+
+CVE: CVE-2026-50219
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/e5b76bd58dd9984cef46c2a66a98b03c95a3c774]
+Signed-off-by: Jakub Szczudlo <jakub.szczudlo@nokia.com>
+---
+ lib/xmlparse.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/lib/xmlparse.c b/lib/xmlparse.c
+index 98ffe5a..ed9628f 100644
+--- a/lib/xmlparse.c
++++ b/lib/xmlparse.c
+@@ -7312,15 +7312,20 @@ reportDefault(XML_Parser parser, const ENCODING *enc, const char *s,
+ convert_res
+ = XmlConvert(enc, &s, end, &dataPtr, (ICHAR *)parser->m_dataBufEnd);
+ *eventEndPP = s;
++ beforeHandler(parser);
+ parser->m_defaultHandler(parser->m_handlerArg, parser->m_dataBuf,
+ (int)(dataPtr - (ICHAR *)parser->m_dataBuf));
++ afterHandler(parser);
+ *eventPP = s;
+ } while ((convert_res != XML_CONVERT_COMPLETED)
+ && (convert_res != XML_CONVERT_INPUT_INCOMPLETE));
+- } else
++ } else {
++ beforeHandler(parser);
+ parser->m_defaultHandler(
+ parser->m_handlerArg, (const XML_Char *)s,
+ (int)((const XML_Char *)end - (const XML_Char *)s));
++ afterHandler(parser);
++ }
+ }
+
+ static int
+--
+2.34.1
+
diff --git a/meta/recipes-core/expat/expat/CVE-2026-50219-09.patch b/meta/recipes-core/expat/expat/CVE-2026-50219-09.patch
new file mode 100644
index 0000000000..9d87b20d7c
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-50219-09.patch
@@ -0,0 +1,44 @@
+From 8f2979090e01719c7f0c005816943d93bfda2754 Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Tue, 26 May 2026 21:15:01 +0200
+Subject: [PATCH] lib: Register `m_elementDeclHandler` with handler call depth
+ tracking
+
+(cherry picked from commit b4a711a33591c0d45d6e630ed6448dcbc5534700)
+
+CVE: CVE-2026-50219
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/b4a711a33591c0d45d6e630ed6448dcbc5534700]
+Signed-off-by: Jakub Szczudlo <jakub.szczudlo@nokia.com>
+---
+ lib/xmlparse.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/lib/xmlparse.c b/lib/xmlparse.c
+index ed9628f..03bc212 100644
+--- a/lib/xmlparse.c
++++ b/lib/xmlparse.c
+@@ -6259,8 +6259,10 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end,
+ content->type = ((role == XML_ROLE_CONTENT_ANY) ? XML_CTYPE_ANY
+ : XML_CTYPE_EMPTY);
+ *eventEndPP = s;
++ beforeHandler(parser);
+ parser->m_elementDeclHandler(
+ parser->m_handlerArg, parser->m_declElementType->name, content);
++ afterHandler(parser);
+ handleDefault = XML_FALSE;
+ }
+ dtd->in_eldecl = XML_FALSE;
+@@ -6342,8 +6344,10 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end,
+ if (! model)
+ return XML_ERROR_NO_MEMORY;
+ *eventEndPP = s;
++ beforeHandler(parser);
+ parser->m_elementDeclHandler(
+ parser->m_handlerArg, parser->m_declElementType->name, model);
++ afterHandler(parser);
+ }
+ dtd->in_eldecl = XML_FALSE;
+ dtd->contentStringLen = 0;
+--
+2.34.1
+
diff --git a/meta/recipes-core/expat/expat/CVE-2026-50219-10.patch b/meta/recipes-core/expat/expat/CVE-2026-50219-10.patch
new file mode 100644
index 0000000000..97c0975217
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-50219-10.patch
@@ -0,0 +1,35 @@
+From 8849de56e9789089103114f472d68f3a37f5ab53 Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Tue, 26 May 2026 21:15:40 +0200
+Subject: [PATCH] lib: Register `m_endCdataSectionHandler` with handler call
+ depth tracking
+
+(cherry picked from commit b08e08c0558152a4180597a3e880dc70040c2b2a)
+
+CVE: CVE-2026-50219
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/b08e08c0558152a4180597a3e880dc70040c2b2a]
+Signed-off-by: Jakub Szczudlo <jakub.szczudlo@nokia.com>
+---
+ lib/xmlparse.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/lib/xmlparse.c b/lib/xmlparse.c
+index 03bc212..a894538 100644
+--- a/lib/xmlparse.c
++++ b/lib/xmlparse.c
+@@ -4746,8 +4746,11 @@ doCdataSection(XML_Parser parser, const ENCODING *enc, const char **startPtr,
+ *eventEndPP = next;
+ switch (tok) {
+ case XML_TOK_CDATA_SECT_CLOSE:
+- if (parser->m_endCdataSectionHandler)
++ if (parser->m_endCdataSectionHandler) {
++ beforeHandler(parser);
+ parser->m_endCdataSectionHandler(parser->m_handlerArg);
++ afterHandler(parser);
++ }
+ /* BEGIN disabled code */
+ /* see comment under XML_TOK_CDATA_SECT_OPEN */
+ else if ((0) && parser->m_characterDataHandler) {
+--
+2.34.1
+
diff --git a/meta/recipes-core/expat/expat/CVE-2026-50219-11.patch b/meta/recipes-core/expat/expat/CVE-2026-50219-11.patch
new file mode 100644
index 0000000000..64c95c02e8
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-50219-11.patch
@@ -0,0 +1,32 @@
+From 8114f635922a0c22ad11630aa953ca1545d23044 Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Tue, 26 May 2026 21:16:13 +0200
+Subject: [PATCH] lib: Register `m_endDoctypeDeclHandler` with handler call
+ depth tracking
+
+(cherry picked from commit bd454febe07b931e638f2186755585b67a738d31)
+
+CVE: CVE-2026-50219
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/bd454febe07b931e638f2186755585b67a738d31]
+Signed-off-by: Jakub Szczudlo <jakub.szczudlo@nokia.com>
+---
+ lib/xmlparse.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/lib/xmlparse.c b/lib/xmlparse.c
+index a894538..2fe2f71 100644
+--- a/lib/xmlparse.c
++++ b/lib/xmlparse.c
+@@ -5585,7 +5585,9 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end,
+ }
+ #endif /* XML_DTD */
+ if (parser->m_endDoctypeDeclHandler) {
++ beforeHandler(parser);
+ parser->m_endDoctypeDeclHandler(parser->m_handlerArg);
++ afterHandler(parser);
+ handleDefault = XML_FALSE;
+ }
+ break;
+--
+2.34.1
+
diff --git a/meta/recipes-core/expat/expat/CVE-2026-50219-12.patch b/meta/recipes-core/expat/expat/CVE-2026-50219-12.patch
new file mode 100644
index 0000000000..5fb7b7dcf1
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-50219-12.patch
@@ -0,0 +1,42 @@
+From 1d95acdeab736c3b4e08477b958b6f7296a75607 Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Tue, 26 May 2026 21:17:10 +0200
+Subject: [PATCH] lib: Register `m_endElementHandler` with handler call depth
+ tracking
+
+(cherry picked from commit e411d9907b8addb334d1ed5db1afd5b5bf625f24)
+
+CVE: CVE-2026-50219
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/e411d9907b8addb334d1ed5db1afd5b5bf625f24]
+Signed-off-by: Jakub Szczudlo <jakub.szczudlo@nokia.com>
+---
+ lib/xmlparse.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/lib/xmlparse.c b/lib/xmlparse.c
+index 2fe2f71..37aaabc 100644
+--- a/lib/xmlparse.c
++++ b/lib/xmlparse.c
+@@ -3645,7 +3645,9 @@ doContent(XML_Parser parser, int startTagLevel, const ENCODING *enc,
+ if (parser->m_endElementHandler) {
+ if (parser->m_startElementHandler)
+ *eventPP = *eventEndPP;
++ beforeHandler(parser);
+ parser->m_endElementHandler(parser->m_handlerArg, name.str);
++ afterHandler(parser);
+ noElmHandlers = XML_FALSE;
+ }
+ if (noElmHandlers && parser->m_defaultHandler)
+@@ -3703,7 +3705,9 @@ doContent(XML_Parser parser, int startTagLevel, const ENCODING *enc,
+ }
+ *uri = XML_T('\0');
+ }
++ beforeHandler(parser);
+ parser->m_endElementHandler(parser->m_handlerArg, tag->name.str);
++ afterHandler(parser);
+ } else if (parser->m_defaultHandler)
+ reportDefault(parser, enc, s, next);
+ while (tag->bindings) {
+--
+2.34.1
+
diff --git a/meta/recipes-core/expat/expat/CVE-2026-50219-13.patch b/meta/recipes-core/expat/expat/CVE-2026-50219-13.patch
new file mode 100644
index 0000000000..f74de674b0
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-50219-13.patch
@@ -0,0 +1,49 @@
+From 3e9e33361aeaa853f16fd85bf30a71f0ac0b2791 Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Tue, 26 May 2026 21:23:59 +0200
+Subject: [PATCH] lib: Register `m_endNamespaceDeclHandler` with handler call
+ depth tracking
+
+(cherry picked from commit 274aa82340fe1b2205e8e3ae1cd35e2168cd42e8)
+
+CVE: CVE-2026-50219
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/274aa82340fe1b2205e8e3ae1cd35e2168cd42e8]
+Signed-off-by: Jakub Szczudlo <jakub.szczudlo@nokia.com>
+---
+ lib/xmlparse.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/lib/xmlparse.c b/lib/xmlparse.c
+index 37aaabc..ad72001 100644
+--- a/lib/xmlparse.c
++++ b/lib/xmlparse.c
+@@ -3712,9 +3712,12 @@ doContent(XML_Parser parser, int startTagLevel, const ENCODING *enc,
+ reportDefault(parser, enc, s, next);
+ while (tag->bindings) {
+ BINDING *b = tag->bindings;
+- if (parser->m_endNamespaceDeclHandler)
++ if (parser->m_endNamespaceDeclHandler) {
++ beforeHandler(parser);
+ parser->m_endNamespaceDeclHandler(parser->m_handlerArg,
+ b->prefix->name);
++ afterHandler(parser);
++ }
+ tag->bindings = tag->bindings->nextTagBinding;
+ b->nextTagBinding = parser->m_freeBindingList;
+ parser->m_freeBindingList = b;
+@@ -3906,8 +3909,11 @@ freeBindings(XML_Parser parser, BINDING *bindings) {
+ /* m_startNamespaceDeclHandler will have been called for this
+ * binding in addBindings(), so call the end handler now.
+ */
+- if (parser->m_endNamespaceDeclHandler)
++ if (parser->m_endNamespaceDeclHandler) {
++ beforeHandler(parser);
+ parser->m_endNamespaceDeclHandler(parser->m_handlerArg, b->prefix->name);
++ afterHandler(parser);
++ }
+
+ bindings = bindings->nextTagBinding;
+ b->nextTagBinding = parser->m_freeBindingList;
+--
+2.34.1
+
diff --git a/meta/recipes-core/expat/expat/CVE-2026-50219-14.patch b/meta/recipes-core/expat/expat/CVE-2026-50219-14.patch
new file mode 100644
index 0000000000..4d37cd6f0c
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-50219-14.patch
@@ -0,0 +1,74 @@
+From 13084e0a4473dcea40fc0173a2c54fbf9fd3eece Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Tue, 26 May 2026 21:25:42 +0200
+Subject: [PATCH] lib: Register `m_entityDeclHandler` with handler call depth
+ tracking
+
+(cherry picked from commit 6e62649e6b25eb789166b9131dfadfe9d806f5ce)
+
+CVE: CVE-2026-50219
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/6e62649e6b25eb789166b9131dfadfe9d806f5ce]
+Signed-off-by: Jakub Szczudlo <jakub.szczudlo@nokia.com>
+---
+ lib/xmlparse.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/lib/xmlparse.c b/lib/xmlparse.c
+index ad72001..e9466d5 100644
+--- a/lib/xmlparse.c
++++ b/lib/xmlparse.c
+@@ -5791,10 +5791,12 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end,
+ poolFinish(&dtd->entityValuePool);
+ if (parser->m_entityDeclHandler) {
+ *eventEndPP = s;
++ beforeHandler(parser);
+ parser->m_entityDeclHandler(
+ parser->m_handlerArg, parser->m_declEntity->name,
+ parser->m_declEntity->is_param, parser->m_declEntity->textPtr,
+ parser->m_declEntity->textLen, parser->m_curBase, 0, 0, 0);
++ afterHandler(parser);
+ handleDefault = XML_FALSE;
+ }
+ } else
+@@ -5812,10 +5814,12 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end,
+
+ if (parser->m_entityDeclHandler) {
+ *eventEndPP = s;
++ beforeHandler(parser);
+ parser->m_entityDeclHandler(
+ parser->m_handlerArg, parser->m_declEntity->name,
+ parser->m_declEntity->is_param, parser->m_declEntity->textPtr,
+ parser->m_declEntity->textLen, parser->m_curBase, 0, 0, 0);
++ afterHandler(parser);
+ handleDefault = XML_FALSE;
+ }
+ }
+@@ -5893,10 +5897,12 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end,
+ if (dtd->keepProcessing && parser->m_declEntity
+ && parser->m_entityDeclHandler) {
+ *eventEndPP = s;
++ beforeHandler(parser);
+ parser->m_entityDeclHandler(
+ parser->m_handlerArg, parser->m_declEntity->name,
+ parser->m_declEntity->is_param, 0, 0, parser->m_declEntity->base,
+ parser->m_declEntity->systemId, parser->m_declEntity->publicId, 0);
++ afterHandler(parser);
+ handleDefault = XML_FALSE;
+ }
+ break;
+@@ -5916,10 +5922,12 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end,
+ handleDefault = XML_FALSE;
+ } else if (parser->m_entityDeclHandler) {
+ *eventEndPP = s;
++ beforeHandler(parser);
+ parser->m_entityDeclHandler(
+ parser->m_handlerArg, parser->m_declEntity->name, 0, 0, 0,
+ parser->m_declEntity->base, parser->m_declEntity->systemId,
+ parser->m_declEntity->publicId, parser->m_declEntity->notation);
++ afterHandler(parser);
+ handleDefault = XML_FALSE;
+ }
+ }
+--
+2.34.1
+
diff --git a/meta/recipes-core/expat/expat/CVE-2026-50219-15.patch b/meta/recipes-core/expat/expat/CVE-2026-50219-15.patch
new file mode 100644
index 0000000000..07e69cb772
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-50219-15.patch
@@ -0,0 +1,82 @@
+From e5035de264c3102b33891570bdff7c6313a9d2b5 Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Sat, 30 May 2026 00:45:50 +0200
+Subject: [PATCH] lib: Register `m_externalEntityRefHandler` with handler call
+ depth tracking
+
+(cherry picked from commit d4ba1c29165de39605b799223392dfb28bed85d5)
+
+CVE: CVE-2026-50219
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/d4ba1c29165de39605b799223392dfb28bed85d5]
+Signed-off-by: Jakub Szczudlo <jakub.szczudlo@nokia.com>
+---
+ lib/xmlparse.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/lib/xmlparse.c b/lib/xmlparse.c
+index e9466d5..7909490 100644
+--- a/lib/xmlparse.c
++++ b/lib/xmlparse.c
+@@ -3537,9 +3537,11 @@ doContent(XML_Parser parser, int startTagLevel, const ENCODING *enc,
+ entity->open = XML_FALSE;
+ if (! context)
+ return XML_ERROR_NO_MEMORY;
++ beforeHandler(parser);
+ const int status = parser->m_externalEntityRefHandler(
+ parser->m_externalEntityRefHandlerArg, context, entity->base,
+ entity->systemId, entity->publicId);
++ afterHandler(parser);
+ if (! status)
+ return XML_ERROR_EXTERNAL_ENTITY_HANDLING;
+ poolDiscard(&parser->m_tempPool);
+@@ -5571,9 +5573,11 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end,
+ if (parser->m_useForeignDTD)
+ entity->base = parser->m_curBase;
+ dtd->paramEntityRead = XML_FALSE;
++ beforeHandler(parser);
+ const int status = parser->m_externalEntityRefHandler(
+ parser->m_externalEntityRefHandlerArg, 0, entity->base,
+ entity->systemId, entity->publicId);
++ afterHandler(parser);
+ if (! status)
+ return XML_ERROR_EXTERNAL_ENTITY_HANDLING;
+ if (dtd->paramEntityRead) {
+@@ -5617,9 +5621,11 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end,
+ return XML_ERROR_NO_MEMORY;
+ entity->base = parser->m_curBase;
+ dtd->paramEntityRead = XML_FALSE;
++ beforeHandler(parser);
+ const int status = parser->m_externalEntityRefHandler(
+ parser->m_externalEntityRefHandlerArg, 0, entity->base,
+ entity->systemId, entity->publicId);
++ afterHandler(parser);
+ if (! status)
+ return XML_ERROR_EXTERNAL_ENTITY_HANDLING;
+ if (dtd->paramEntityRead) {
+@@ -6222,9 +6228,11 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end,
+ dtd->paramEntityRead = XML_FALSE;
+ entity->open = XML_TRUE;
+ entityTrackingOnOpen(parser, entity, __LINE__);
++ beforeHandler(parser);
+ const int status = parser->m_externalEntityRefHandler(
+ parser->m_externalEntityRefHandlerArg, 0, entity->base,
+ entity->systemId, entity->publicId);
++ afterHandler(parser);
+ if (! status) {
+ entityTrackingOnClose(parser, entity, __LINE__);
+ entity->open = XML_FALSE;
+@@ -7019,9 +7027,11 @@ storeEntityValue(XML_Parser parser, const ENCODING *enc,
+ dtd->paramEntityRead = XML_FALSE;
+ entity->open = XML_TRUE;
+ entityTrackingOnOpen(parser, entity, __LINE__);
++ beforeHandler(parser);
+ const int status = parser->m_externalEntityRefHandler(
+ parser->m_externalEntityRefHandlerArg, 0, entity->base,
+ entity->systemId, entity->publicId);
++ afterHandler(parser);
+ if (! status) {
+ entityTrackingOnClose(parser, entity, __LINE__);
+ entity->open = XML_FALSE;
+--
+2.34.1
+
diff --git a/meta/recipes-core/expat/expat/CVE-2026-50219-16.patch b/meta/recipes-core/expat/expat/CVE-2026-50219-16.patch
new file mode 100644
index 0000000000..3cc3f7faaf
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-50219-16.patch
@@ -0,0 +1,46 @@
+From 24ec73df3f099032fb66638685c296c18d914f84 Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Tue, 26 May 2026 21:27:13 +0200
+Subject: [PATCH] lib: Register `m_notationDeclHandler` with handler call depth
+ tracking
+
+(cherry picked from commit 4739ad3fda250cf458d396d9c17a0e0fef571bdd)
+
+CVE: CVE-2026-50219
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/4739ad3fda250cf458d396d9c17a0e0fef571bdd]
+Signed-off-by: Jakub Szczudlo <jakub.szczudlo@nokia.com>
+---
+ lib/xmlparse.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/lib/xmlparse.c b/lib/xmlparse.c
+index 7909490..5a0f063 100644
+--- a/lib/xmlparse.c
++++ b/lib/xmlparse.c
+@@ -6040,9 +6040,11 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end,
+ if (! systemId)
+ return XML_ERROR_NO_MEMORY;
+ *eventEndPP = s;
++ beforeHandler(parser);
+ parser->m_notationDeclHandler(
+ parser->m_handlerArg, parser->m_declNotationName, parser->m_curBase,
+ systemId, parser->m_declNotationPublicId);
++ afterHandler(parser);
+ handleDefault = XML_FALSE;
+ }
+ poolClear(&parser->m_tempPool);
+@@ -6050,9 +6052,11 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end,
+ case XML_ROLE_NOTATION_NO_SYSTEM_ID:
+ if (parser->m_declNotationPublicId && parser->m_notationDeclHandler) {
+ *eventEndPP = s;
++ beforeHandler(parser);
+ parser->m_notationDeclHandler(
+ parser->m_handlerArg, parser->m_declNotationName, parser->m_curBase,
+ 0, parser->m_declNotationPublicId);
++ afterHandler(parser);
+ handleDefault = XML_FALSE;
+ }
+ poolClear(&parser->m_tempPool);
+--
+2.34.1
+
diff --git a/meta/recipes-core/expat/expat/CVE-2026-50219-17.patch b/meta/recipes-core/expat/expat/CVE-2026-50219-17.patch
new file mode 100644
index 0000000000..992ae93d6e
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-50219-17.patch
@@ -0,0 +1,64 @@
+From 08eea37057ebc8f6dafcec601b0ff923d221e205 Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Tue, 26 May 2026 21:34:29 +0200
+Subject: [PATCH] lib: Register `m_notStandaloneHandler` with handler call
+ depth tracking
+
+(cherry picked from commit d7a9c975ceeaa24c730e50fef2bedff5f99d2172)
+
+CVE: CVE-2026-50219
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/d7a9c975ceeaa24c730e50fef2bedff5f99d2172]
+Signed-off-by: Jakub Szczudlo <jakub.szczudlo@nokia.com>
+---
+ lib/xmlparse.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/lib/xmlparse.c b/lib/xmlparse.c
+index 5a0f063..93110fe 100644
+--- a/lib/xmlparse.c
++++ b/lib/xmlparse.c
+@@ -5582,8 +5582,10 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end,
+ return XML_ERROR_EXTERNAL_ENTITY_HANDLING;
+ if (dtd->paramEntityRead) {
+ if (! dtd->standalone && parser->m_notStandaloneHandler) {
++ beforeHandler(parser);
+ const int handlerStatus
+ = parser->m_notStandaloneHandler(parser->m_handlerArg);
++ afterHandler(parser);
+ if (! handlerStatus)
+ return XML_ERROR_NOT_STANDALONE;
+ }
+@@ -5630,8 +5632,10 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end,
+ return XML_ERROR_EXTERNAL_ENTITY_HANDLING;
+ if (dtd->paramEntityRead) {
+ if (! dtd->standalone && parser->m_notStandaloneHandler) {
++ beforeHandler(parser);
+ const int handlerStatus
+ = parser->m_notStandaloneHandler(parser->m_handlerArg);
++ afterHandler(parser);
+ if (! handlerStatus)
+ return XML_ERROR_NOT_STANDALONE;
+ }
+@@ -5857,7 +5861,9 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end,
+ && ! parser->m_paramEntityParsing
+ #endif /* XML_DTD */
+ && parser->m_notStandaloneHandler) {
++ beforeHandler(parser);
+ const int status = parser->m_notStandaloneHandler(parser->m_handlerArg);
++ afterHandler(parser);
+ if (! status)
+ return XML_ERROR_NOT_STANDALONE;
+ }
+@@ -6256,7 +6262,9 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end,
+ }
+ #endif /* XML_DTD */
+ if (! dtd->standalone && parser->m_notStandaloneHandler) {
++ beforeHandler(parser);
+ const int status = parser->m_notStandaloneHandler(parser->m_handlerArg);
++ afterHandler(parser);
+ if (! status)
+ return XML_ERROR_NOT_STANDALONE;
+ }
+--
+2.34.1
+
diff --git a/meta/recipes-core/expat/expat/CVE-2026-50219-18.patch b/meta/recipes-core/expat/expat/CVE-2026-50219-18.patch
new file mode 100644
index 0000000000..4520cbd13a
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-50219-18.patch
@@ -0,0 +1,32 @@
+From d9ea54153ef454217b8a2a8255b2bd1ead460e83 Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Tue, 26 May 2026 21:35:08 +0200
+Subject: [PATCH] lib: Register `m_processingInstructionHandler` with handler
+ call depth tracking
+
+(cherry picked from commit 8bb00d345d5f92b17a06e01a926ee1dda797e0af)
+
+CVE: CVE-2026-50219
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/8bb00d345d5f92b17a06e01a926ee1dda797e0af]
+Signed-off-by: Jakub Szczudlo <jakub.szczudlo@nokia.com>
+---
+ lib/xmlparse.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/lib/xmlparse.c b/lib/xmlparse.c
+index 93110fe..b2672ae 100644
+--- a/lib/xmlparse.c
++++ b/lib/xmlparse.c
+@@ -7298,7 +7298,9 @@ reportProcessingInstruction(XML_Parser parser, const ENCODING *enc,
+ if (! data)
+ return 0;
+ normalizeLines(data);
++ beforeHandler(parser);
+ parser->m_processingInstructionHandler(parser->m_handlerArg, target, data);
++ afterHandler(parser);
+ poolClear(&parser->m_tempPool);
+ return 1;
+ }
+--
+2.34.1
+
diff --git a/meta/recipes-core/expat/expat/CVE-2026-50219-19.patch b/meta/recipes-core/expat/expat/CVE-2026-50219-19.patch
new file mode 100644
index 0000000000..6d6e2cf2d4
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-50219-19.patch
@@ -0,0 +1,87 @@
+From 1cbb5676ee24c03222923f2ce853ffe245a831ad Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Tue, 26 May 2026 21:36:39 +0200
+Subject: [PATCH] lib: Register `m_skippedEntityHandler` with handler call
+ depth tracking
+
+(cherry picked from commit 64e3adf0c9d7e1846cff784de3159f1067eb5e06)
+
+CVE: CVE-2026-50219
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/64e3adf0c9d7e1846cff784de3159f1067eb5e06]
+Signed-off-by: Jakub Szczudlo <jakub.szczudlo@nokia.com>
+---
+ lib/xmlparse.c | 24 ++++++++++++++++++------
+ 1 file changed, 18 insertions(+), 6 deletions(-)
+
+diff --git a/lib/xmlparse.c b/lib/xmlparse.c
+index b2672ae..1ee7cca 100644
+--- a/lib/xmlparse.c
++++ b/lib/xmlparse.c
+@@ -3507,9 +3507,11 @@ doContent(XML_Parser parser, int startTagLevel, const ENCODING *enc,
+ else if (! entity->is_internal)
+ return XML_ERROR_ENTITY_DECLARED_IN_PE;
+ } else if (! entity) {
+- if (parser->m_skippedEntityHandler)
++ if (parser->m_skippedEntityHandler) {
++ beforeHandler(parser);
+ parser->m_skippedEntityHandler(parser->m_handlerArg, name, 0);
+- else if (parser->m_defaultHandler)
++ afterHandler(parser);
++ } else if (parser->m_defaultHandler)
+ reportDefault(parser, enc, s, next);
+ break;
+ }
+@@ -3520,10 +3522,12 @@ doContent(XML_Parser parser, int startTagLevel, const ENCODING *enc,
+ if (entity->textPtr) {
+ enum XML_Error result;
+ if (! parser->m_defaultExpandInternalEntities) {
+- if (parser->m_skippedEntityHandler)
++ if (parser->m_skippedEntityHandler) {
++ beforeHandler(parser);
+ parser->m_skippedEntityHandler(parser->m_handlerArg, entity->name,
+ 0);
+- else if (parser->m_defaultHandler)
++ afterHandler(parser);
++ } else if (parser->m_defaultHandler)
+ reportDefault(parser, enc, s, next);
+ break;
+ }
+@@ -6217,7 +6221,9 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end,
+ /* cannot report skipped entities in declarations */
+ if ((role == XML_ROLE_PARAM_ENTITY_REF)
+ && parser->m_skippedEntityHandler) {
++ beforeHandler(parser);
+ parser->m_skippedEntityHandler(parser->m_handlerArg, name, 1);
++ afterHandler(parser);
+ handleDefault = XML_FALSE;
+ }
+ break;
+@@ -6888,8 +6894,11 @@ appendAttributeValue(XML_Parser parser, const ENCODING *enc, XML_Bool isCdata,
+ } else if (! entity) {
+ /* Cannot report skipped entity here - see comments on
+ parser->m_skippedEntityHandler.
+- if (parser->m_skippedEntityHandler)
++ if (parser->m_skippedEntityHandler) {
++ beforeHandler(parser);
+ parser->m_skippedEntityHandler(parser->m_handlerArg, name, 0);
++ afterHandler(parser);
++ }
+ */
+ /* Cannot call the default handler because this would be
+ out of sync with the call to the startElementHandler.
+@@ -7022,8 +7031,11 @@ storeEntityValue(XML_Parser parser, const ENCODING *enc,
+ /* not a well-formedness error - see XML 1.0: WFC Entity Declared */
+ /* cannot report skipped entity here - see comments on
+ parser->m_skippedEntityHandler
+- if (parser->m_skippedEntityHandler)
++ if (parser->m_skippedEntityHandler) {
++ beforeHandler(parser);
+ parser->m_skippedEntityHandler(parser->m_handlerArg, name, 0);
++ afterHandler(parser);
++ }
+ */
+ dtd->keepProcessing = dtd->standalone;
+ goto endEntityValue;
+--
+2.34.1
+
diff --git a/meta/recipes-core/expat/expat/CVE-2026-50219-20.patch b/meta/recipes-core/expat/expat/CVE-2026-50219-20.patch
new file mode 100644
index 0000000000..e36403367e
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-50219-20.patch
@@ -0,0 +1,62 @@
+From 6697406736678ac3f6738f5b171c4c128b66df7d Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Tue, 26 May 2026 21:37:49 +0200
+Subject: [PATCH] lib: Register `m_startCdataSectionHandler` with handler call
+ depth tracking
+
+(cherry picked from commit 222278ad452d27f8c35ba031be14d6e70aab5ab1)
+
+CVE: CVE-2026-50219
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/222278ad452d27f8c35ba031be14d6e70aab5ab1]
+Signed-off-by: Jakub Szczudlo <jakub.szczudlo@nokia.com>
+---
+ lib/xmlparse.c | 32 +++++++++++++++++---------------
+ 1 file changed, 17 insertions(+), 15 deletions(-)
+
+diff --git a/lib/xmlparse.c b/lib/xmlparse.c
+index 1ee7cca..ad8cc44 100644
+--- a/lib/xmlparse.c
++++ b/lib/xmlparse.c
+@@ -3766,22 +3766,24 @@ doContent(XML_Parser parser, int startTagLevel, const ENCODING *enc,
+ break;
+ case XML_TOK_CDATA_SECT_OPEN: {
+ enum XML_Error result;
+- if (parser->m_startCdataSectionHandler)
++ if (parser->m_startCdataSectionHandler) {
++ beforeHandler(parser);
+ parser->m_startCdataSectionHandler(parser->m_handlerArg);
+- /* BEGIN disabled code */
+- /* Suppose you doing a transformation on a document that involves
+- changing only the character data. You set up a defaultHandler
+- and a characterDataHandler. The defaultHandler simply copies
+- characters through. The characterDataHandler does the
+- transformation and writes the characters out escaping them as
+- necessary. This case will fail to work if we leave out the
+- following two lines (because & and < inside CDATA sections will
+- be incorrectly escaped).
+-
+- However, now we have a start/endCdataSectionHandler, so it seems
+- easier to let the user deal with this.
+- */
+- else if ((0) && parser->m_characterDataHandler) {
++ afterHandler(parser);
++ /* BEGIN disabled code */
++ /* Suppose you doing a transformation on a document that involves
++ changing only the character data. You set up a defaultHandler
++ and a characterDataHandler. The defaultHandler simply copies
++ characters through. The characterDataHandler does the
++ transformation and writes the characters out escaping them as
++ necessary. This case will fail to work if we leave out the
++ following two lines (because & and < inside CDATA sections will
++ be incorrectly escaped).
++
++ However, now we have a start/endCdataSectionHandler, so it seems
++ easier to let the user deal with this.
++ */
++ } else if ((0) && parser->m_characterDataHandler) {
+ beforeHandler(parser);
+ parser->m_characterDataHandler(parser->m_handlerArg, parser->m_dataBuf,
+ 0);
+--
+2.34.1
+
diff --git a/meta/recipes-core/expat/expat/CVE-2026-50219-21.patch b/meta/recipes-core/expat/expat/CVE-2026-50219-21.patch
new file mode 100644
index 0000000000..bbeeced76e
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-50219-21.patch
@@ -0,0 +1,46 @@
+From c7cc71e323ef0afcb115dd1567bf1bdfcbc5f8d2 Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Tue, 26 May 2026 21:38:47 +0200
+Subject: [PATCH] lib: Register `m_startDoctypeDeclHandler` with handler call
+ depth tracking
+
+(cherry picked from commit 82f1d14a033f7c5bd6f658c3cdcd2515efe86745)
+
+CVE: CVE-2026-50219
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/82f1d14a033f7c5bd6f658c3cdcd2515efe86745]
+Signed-off-by: Jakub Szczudlo <jakub.szczudlo@nokia.com>
+---
+ lib/xmlparse.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/lib/xmlparse.c b/lib/xmlparse.c
+index ad8cc44..0e101af 100644
+--- a/lib/xmlparse.c
++++ b/lib/xmlparse.c
+@@ -5481,9 +5481,11 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end,
+ break;
+ case XML_ROLE_DOCTYPE_INTERNAL_SUBSET:
+ if (parser->m_startDoctypeDeclHandler) {
++ beforeHandler(parser);
+ parser->m_startDoctypeDeclHandler(
+ parser->m_handlerArg, parser->m_doctypeName, parser->m_doctypeSysid,
+ parser->m_doctypePubid, 1);
++ afterHandler(parser);
+ parser->m_doctypeName = NULL;
+ poolClear(&parser->m_tempPool);
+ handleDefault = XML_FALSE;
+@@ -5550,9 +5552,11 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end,
+ }
+
+ if (parser->m_doctypeName) {
++ beforeHandler(parser);
+ parser->m_startDoctypeDeclHandler(
+ parser->m_handlerArg, parser->m_doctypeName, parser->m_doctypeSysid,
+ parser->m_doctypePubid, 0);
++ afterHandler(parser);
+ poolClear(&parser->m_tempPool);
+ handleDefault = XML_FALSE;
+ }
+--
+2.34.1
+
diff --git a/meta/recipes-core/expat/expat/CVE-2026-50219-22.patch b/meta/recipes-core/expat/expat/CVE-2026-50219-22.patch
new file mode 100644
index 0000000000..931bc06f1a
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-50219-22.patch
@@ -0,0 +1,48 @@
+From 355e3aaa79f1b0e6067a8ebbc6fcbac47e98542e Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Tue, 26 May 2026 21:39:38 +0200
+Subject: [PATCH] lib: Register `m_startElementHandler` with handler call depth
+ tracking
+
+(cherry picked from commit 4f9a8f1cc2ed03cd9e23d281a6abac44dc89e8ab)
+
+CVE: CVE-2026-50219
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/4f9a8f1cc2ed03cd9e23d281a6abac44dc89e8ab]
+Signed-off-by: Jakub Szczudlo <jakub.szczudlo@nokia.com>
+---
+ lib/xmlparse.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/lib/xmlparse.c b/lib/xmlparse.c
+index 0e101af..a222a3f 100644
+--- a/lib/xmlparse.c
++++ b/lib/xmlparse.c
+@@ -3615,10 +3615,12 @@ doContent(XML_Parser parser, int startTagLevel, const ENCODING *enc,
+ = storeAtts(parser, enc, s, &(tag->name), &(tag->bindings), account);
+ if (result)
+ return result;
+- if (parser->m_startElementHandler)
++ if (parser->m_startElementHandler) {
++ beforeHandler(parser);
+ parser->m_startElementHandler(parser->m_handlerArg, tag->name.str,
+ (const XML_Char **)parser->m_atts);
+- else if (parser->m_defaultHandler)
++ afterHandler(parser);
++ } else if (parser->m_defaultHandler)
+ reportDefault(parser, enc, s, next);
+ poolClear(&parser->m_tempPool);
+ break;
+@@ -3644,8 +3646,10 @@ doContent(XML_Parser parser, int startTagLevel, const ENCODING *enc,
+ }
+ poolFinish(&parser->m_tempPool);
+ if (parser->m_startElementHandler) {
++ beforeHandler(parser);
+ parser->m_startElementHandler(parser->m_handlerArg, name.str,
+ (const XML_Char **)parser->m_atts);
++ afterHandler(parser);
+ noElmHandlers = XML_FALSE;
+ }
+ if (parser->m_endElementHandler) {
+--
+2.34.1
+
diff --git a/meta/recipes-core/expat/expat/CVE-2026-50219-23.patch b/meta/recipes-core/expat/expat/CVE-2026-50219-23.patch
new file mode 100644
index 0000000000..7f883faeb1
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-50219-23.patch
@@ -0,0 +1,36 @@
+From ac747d83eb8b6d7c71da606a9cb1a65aef50d0c1 Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Tue, 26 May 2026 21:40:13 +0200
+Subject: [PATCH] lib: Register `m_startNamespaceDeclHandler` with handler call
+ depth tracking
+
+(cherry picked from commit ddd0238420113c97594083194e517e8bc742700c)
+
+CVE: CVE-2026-50219
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/ddd0238420113c97594083194e517e8bc742700c]
+Signed-off-by: Jakub Szczudlo <jakub.szczudlo@nokia.com>
+---
+ lib/xmlparse.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/lib/xmlparse.c b/lib/xmlparse.c
+index a222a3f..267a198 100644
+--- a/lib/xmlparse.c
++++ b/lib/xmlparse.c
+@@ -4704,9 +4704,12 @@ addBinding(XML_Parser parser, PREFIX *prefix, const ATTRIBUTE_ID *attId,
+ b->nextTagBinding = *bindingsPtr;
+ *bindingsPtr = b;
+ /* if attId == NULL then we are not starting a namespace scope */
+- if (attId && parser->m_startNamespaceDeclHandler)
++ if (attId && parser->m_startNamespaceDeclHandler) {
++ beforeHandler(parser);
+ parser->m_startNamespaceDeclHandler(parser->m_handlerArg, prefix->name,
+ prefix->binding ? uri : 0);
++ afterHandler(parser);
++ }
+ return XML_ERROR_NONE;
+ }
+
+--
+2.34.1
+
diff --git a/meta/recipes-core/expat/expat/CVE-2026-50219-24.patch b/meta/recipes-core/expat/expat/CVE-2026-50219-24.patch
new file mode 100644
index 0000000000..9f4e938218
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-50219-24.patch
@@ -0,0 +1,33 @@
+From 36ada7e4ef06aa18765557240fb30a1a669d438a Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Sat, 30 May 2026 00:46:47 +0200
+Subject: [PATCH] lib: Register `m_unknownEncodingHandler` with handler call
+ depth tracking
+
+(cherry picked from commit f66d83c9aecaa802174f95a1348a89f56e3b9441)
+
+CVE: CVE-2026-50219
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/f66d83c9aecaa802174f95a1348a89f56e3b9441]
+Signed-off-by: Jakub Szczudlo <jakub.szczudlo@nokia.com>
+---
+ lib/xmlparse.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/lib/xmlparse.c b/lib/xmlparse.c
+index 267a198..c76f8ea 100644
+--- a/lib/xmlparse.c
++++ b/lib/xmlparse.c
+@@ -5109,8 +5109,10 @@ handleUnknownEncoding(XML_Parser parser, const XML_Char *encodingName) {
+ info.convert = NULL;
+ info.data = NULL;
+ info.release = NULL;
++ beforeHandler(parser);
+ const int status = parser->m_unknownEncodingHandler(
+ parser->m_unknownEncodingHandlerData, encodingName, &info);
++ afterHandler(parser);
+ if (status) {
+ ENCODING *enc;
+ parser->m_unknownEncodingMem = MALLOC(parser, XmlSizeOfUnknownEncoding());
+--
+2.34.1
+
diff --git a/meta/recipes-core/expat/expat/CVE-2026-50219-25.patch b/meta/recipes-core/expat/expat/CVE-2026-50219-25.patch
new file mode 100644
index 0000000000..ab8a94c02c
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-50219-25.patch
@@ -0,0 +1,35 @@
+From 002404e9805e4e685ca4c473a9c057a93c5b50e2 Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Tue, 26 May 2026 21:41:00 +0200
+Subject: [PATCH] lib: Register `m_unparsedEntityDeclHandler` with handler call
+ depth tracking
+
+(cherry picked from commit 6e7c5af75a743c609fdb35627554cc7e940e6593)
+
+CVE: CVE-2026-50219
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/6e7c5af75a743c609fdb35627554cc7e940e6593]
+Signed-off-by: Jakub Szczudlo <jakub.szczudlo@nokia.com>
+---
+ lib/xmlparse.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/lib/xmlparse.c b/lib/xmlparse.c
+index c76f8ea..aebcda3 100644
+--- a/lib/xmlparse.c
++++ b/lib/xmlparse.c
+@@ -5946,10 +5946,12 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end,
+ poolFinish(&dtd->pool);
+ if (parser->m_unparsedEntityDeclHandler) {
+ *eventEndPP = s;
++ beforeHandler(parser);
+ parser->m_unparsedEntityDeclHandler(
+ parser->m_handlerArg, parser->m_declEntity->name,
+ parser->m_declEntity->base, parser->m_declEntity->systemId,
+ parser->m_declEntity->publicId, parser->m_declEntity->notation);
++ afterHandler(parser);
+ handleDefault = XML_FALSE;
+ } else if (parser->m_entityDeclHandler) {
+ *eventEndPP = s;
+--
+2.34.1
+
diff --git a/meta/recipes-core/expat/expat/CVE-2026-50219-26.patch b/meta/recipes-core/expat/expat/CVE-2026-50219-26.patch
new file mode 100644
index 0000000000..a40a613eba
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-50219-26.patch
@@ -0,0 +1,33 @@
+From 646eb417403a714ecd962f85a2d3c4b198f9b44b Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Tue, 26 May 2026 21:41:38 +0200
+Subject: [PATCH] lib: Register `m_xmlDeclHandler` with handler call depth
+ tracking
+
+(cherry picked from commit 91484ffb98ec138df79265e431a55823bc80c6c4)
+
+CVE: CVE-2026-50219
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/91484ffb98ec138df79265e431a55823bc80c6c4]
+Signed-off-by: Jakub Szczudlo <jakub.szczudlo@nokia.com>
+---
+ lib/xmlparse.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/lib/xmlparse.c b/lib/xmlparse.c
+index aebcda3..edaf5f8 100644
+--- a/lib/xmlparse.c
++++ b/lib/xmlparse.c
+@@ -5058,8 +5058,10 @@ processXmlDecl(XML_Parser parser, int isGeneralTextEntity, const char *s,
+ if (! storedversion)
+ return XML_ERROR_NO_MEMORY;
+ }
++ beforeHandler(parser);
+ parser->m_xmlDeclHandler(parser->m_handlerArg, storedversion, storedEncName,
+ standalone);
++ afterHandler(parser);
+ } else if (parser->m_defaultHandler)
+ reportDefault(parser, parser->m_encoding, s, next);
+ if (parser->m_protocolEncodingName == NULL) {
+--
+2.34.1
+
diff --git a/meta/recipes-core/expat/expat/CVE-2026-50219-27.patch b/meta/recipes-core/expat/expat/CVE-2026-50219-27.patch
new file mode 100644
index 0000000000..e3eff545cc
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-50219-27.patch
@@ -0,0 +1,30 @@
+From 640fa889d24387ba5ad4e44d89a6440b927f6f45 Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Tue, 26 May 2026 15:35:27 +0200
+Subject: [PATCH] lib: Protect `XML_GetBuffer` from being called from a handler
+
+(cherry picked from commit 5d90d1aebfe606af2550e92983cbe121d7eda032)
+
+CVE: CVE-2026-50219
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/5d90d1aebfe606af2550e92983cbe121d7eda032]
+Signed-off-by: Jakub Szczudlo <jakub.szczudlo@nokia.com>
+---
+ lib/xmlparse.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/lib/xmlparse.c b/lib/xmlparse.c
+index edaf5f8..d729fc7 100644
+--- a/lib/xmlparse.c
++++ b/lib/xmlparse.c
+@@ -2599,7 +2599,7 @@ XML_ParseBuffer(XML_Parser parser, int len, int isFinal) {
+
+ void *XMLCALL
+ XML_GetBuffer(XML_Parser parser, int len) {
+- if (parser == NULL)
++ if ((parser == NULL) || isCalledFromInsideHandler(parser))
+ return NULL;
+ if (len < 0) {
+ parser->m_errorCode = XML_ERROR_NO_MEMORY;
+--
+2.34.1
+
diff --git a/meta/recipes-core/expat/expat/CVE-2026-50219-28.patch b/meta/recipes-core/expat/expat/CVE-2026-50219-28.patch
new file mode 100644
index 0000000000..1a923a111c
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-50219-28.patch
@@ -0,0 +1,30 @@
+From b6281b0d445029cad63a2eeb0fda9c6aaa8ad690 Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Tue, 26 May 2026 15:32:38 +0200
+Subject: [PATCH] lib: Protect `XML_Parse` from being called from a handler
+
+(cherry picked from commit b59f1865e6c0c0ab2c1623b9dfd53aa6fb85bb96)
+
+CVE: CVE-2026-50219
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/b59f1865e6c0c0ab2c1623b9dfd53aa6fb85bb96]
+Signed-off-by: Jakub Szczudlo <jakub.szczudlo@nokia.com>
+---
+ lib/xmlparse.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/lib/xmlparse.c b/lib/xmlparse.c
+index d729fc7..f69e32c 100644
+--- a/lib/xmlparse.c
++++ b/lib/xmlparse.c
+@@ -2414,6 +2414,8 @@ XML_Parse(XML_Parser parser, const char *s, int len, int isFinal) {
+ parser->m_errorCode = XML_ERROR_INVALID_ARGUMENT;
+ return XML_STATUS_ERROR;
+ }
++ if (isCalledFromInsideHandler(parser))
++ return XML_STATUS_ERROR;
+ switch (parser->m_parsingStatus.parsing) {
+ case XML_SUSPENDED:
+ parser->m_errorCode = XML_ERROR_SUSPENDED;
+--
+2.34.1
+
diff --git a/meta/recipes-core/expat/expat/CVE-2026-50219-29.patch b/meta/recipes-core/expat/expat/CVE-2026-50219-29.patch
new file mode 100644
index 0000000000..02e172bfa9
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-50219-29.patch
@@ -0,0 +1,31 @@
+From 3ea9955feaa8db08300c83de24ab8001aef19077 Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Tue, 26 May 2026 15:33:44 +0200
+Subject: [PATCH] lib: Protect `XML_ParseBuffer` from being called from a
+ handler
+
+(cherry picked from commit ef3267d5f8157862e33d87c45c6fe82ac26e557f)
+
+CVE: CVE-2026-50219
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/ef3267d5f8157862e33d87c45c6fe82ac26e557f]
+Signed-off-by: Jakub Szczudlo <jakub.szczudlo@nokia.com>
+---
+ lib/xmlparse.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/lib/xmlparse.c b/lib/xmlparse.c
+index f69e32c..87c20bf 100644
+--- a/lib/xmlparse.c
++++ b/lib/xmlparse.c
+@@ -2525,7 +2525,7 @@ XML_ParseBuffer(XML_Parser parser, int len, int isFinal) {
+ const char *start;
+ enum XML_Status result = XML_STATUS_OK;
+
+- if (parser == NULL)
++ if ((parser == NULL) || isCalledFromInsideHandler(parser))
+ return XML_STATUS_ERROR;
+
+ if (len < 0) {
+--
+2.34.1
+
diff --git a/meta/recipes-core/expat/expat/CVE-2026-50219-30.patch b/meta/recipes-core/expat/expat/CVE-2026-50219-30.patch
new file mode 100644
index 0000000000..2b7402ae5c
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-50219-30.patch
@@ -0,0 +1,31 @@
+From 69fc1130413313ecd8728573a254bd26afebd632 Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Tue, 26 May 2026 15:21:28 +0200
+Subject: [PATCH] lib: Protect `XML_ParserFree` from being called from a
+ handler
+
+(cherry picked from commit 827fbddcaaa8ba2171ef76a3223d6f403388635c)
+
+CVE: CVE-2026-50219
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/827fbddcaaa8ba2171ef76a3223d6f403388635c]
+Signed-off-by: Jakub Szczudlo <jakub.szczudlo@nokia.com>
+---
+ lib/xmlparse.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/lib/xmlparse.c b/lib/xmlparse.c
+index 87c20bf..bfa3217 100644
+--- a/lib/xmlparse.c
++++ b/lib/xmlparse.c
+@@ -1958,7 +1958,7 @@ void XMLCALL
+ XML_ParserFree(XML_Parser parser) {
+ TAG *tagList;
+ OPEN_INTERNAL_ENTITY *entityList;
+- if (parser == NULL)
++ if ((parser == NULL) || isCalledFromInsideHandler(parser))
+ return;
+ /* free m_tagStack and m_freeTagList */
+ tagList = parser->m_tagStack;
+--
+2.34.1
+
diff --git a/meta/recipes-core/expat/expat/CVE-2026-50219-31.patch b/meta/recipes-core/expat/expat/CVE-2026-50219-31.patch
new file mode 100644
index 0000000000..1fc8877a3e
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-50219-31.patch
@@ -0,0 +1,31 @@
+From e7ea42e0111e697d2de64a94c8fd6bca9d2c99c9 Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Tue, 26 May 2026 15:22:41 +0200
+Subject: [PATCH] lib: Protect `XML_ParserReset` from being called from a
+ handler
+
+(cherry picked from commit 34bc7e080a1b432ad9d6879a6c718f2d6f12fa22)
+
+CVE: CVE-2026-50219
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/34bc7e080a1b432ad9d6879a6c718f2d6f12fa22]
+Signed-off-by: Jakub Szczudlo <jakub.szczudlo@nokia.com>
+---
+ lib/xmlparse.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/lib/xmlparse.c b/lib/xmlparse.c
+index bfa3217..cc1d550 100644
+--- a/lib/xmlparse.c
++++ b/lib/xmlparse.c
+@@ -1671,7 +1671,7 @@ XML_ParserReset(XML_Parser parser, const XML_Char *encodingName) {
+ TAG *tStk;
+ OPEN_INTERNAL_ENTITY *openEntityList;
+
+- if (parser == NULL)
++ if ((parser == NULL) || isCalledFromInsideHandler(parser))
+ return XML_FALSE;
+
+ if (parser->m_parentParser)
+--
+2.34.1
+
diff --git a/meta/recipes-core/expat/expat/CVE-2026-50219-32.patch b/meta/recipes-core/expat/expat/CVE-2026-50219-32.patch
new file mode 100644
index 0000000000..30a73f9bf5
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-50219-32.patch
@@ -0,0 +1,100 @@
+From 8683ba1631c0467f78f512b16a8dfd1ea9636538 Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Sun, 31 May 2026 13:37:01 +0200
+Subject: [PATCH] tests: Cover calls forbidden from handlers
+
+(cherry picked from commit 2e16f4c98f1f28bb9da36108b60c181d77752acb)
+
+Add an explicit cast for compatibility with Expat's C++ test build, which
+includes handlers.c from handlers_cxx.cpp.
+
+CVE: CVE-2026-50219
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1246/commits/2e16f4c98f1f28bb9da36108b60c181d77752acb]
+Signed-off-by: Jakub Szczudlo <jakub.szczudlo@nokia.com>
+---
+ tests/handlers.c | 24 ++++++++++++++++++++++++
+ tests/handlers.h | 4 ++++
+ tests/misc_tests.c | 15 +++++++++++++++
+ 3 files changed, 43 insertions(+)
+
+diff --git a/tests/handlers.c b/tests/handlers.c
+index 8cda3a8..c7d6578 100644
+--- a/tests/handlers.c
++++ b/tests/handlers.c
+@@ -1991,3 +1991,27 @@ accumulate_and_suspend_comment_handler(void *userData, const XML_Char *data) {
+ accumulate_comment(parserPlusStorage->storage, data);
+ XML_StopParser(parserPlusStorage->parser, XML_TRUE);
+ }
++
++void XMLCALL
++forbidden_calls_character_handler(void *userData, const XML_Char *s, int len) {
++ UNUSED_P(s);
++ UNUSED_P(len);
++ XML_Parser parser = (XML_Parser)userData;
++
++ assert_true(parser != NULL); // self-test
++
++ assert_true(XML_GetBuffer(parser, 123) == NULL); // i.e. rejected
++
++ assert_true(XML_Parse(parser, "", 0, /*isFinal=*/XML_FALSE)
++ == XML_STATUS_ERROR); // i.e. rejected
++
++ assert_true(XML_ParseBuffer(parser, 0, /*isFinal=*/XML_FALSE)
++ == XML_STATUS_ERROR); // i.e. rejected
++
++ XML_ParserFree(parser); // rejected
++
++ assert_true(XML_ParserReset(parser, /*encodingName=*/NULL)
++ == XML_FALSE); // i.e. rejected
++
++ assert_true(XML_GetErrorCode(parser) == XML_ERROR_NONE);
++}
+diff --git a/tests/handlers.h b/tests/handlers.h
+index 27a53f2..de28392 100644
+--- a/tests/handlers.h
++++ b/tests/handlers.h
+@@ -612,6 +612,10 @@ typedef struct {
+ extern void XMLCALL
+ accumulate_and_suspend_comment_handler(void *userData, const XML_Char *data);
+
++extern void XMLCALL forbidden_calls_character_handler(void *userData,
++ const XML_Char *s,
++ int len);
++
+ #endif /* XML_HANDLERS_H */
+
+ #ifdef __cplusplus
+diff --git a/tests/misc_tests.c b/tests/misc_tests.c
+index 1c508bd..b9053fe 100644
+--- a/tests/misc_tests.c
++++ b/tests/misc_tests.c
+@@ -801,6 +801,20 @@ START_TEST(test_misc_no_infinite_loop_issue_1161) {
+ }
+ END_TEST
+
++START_TEST(test_misc_calls_forbidden_from_handlers) {
++ const char *const doc = "<doc>Hello world!</doc>";
++
++ XML_Parser parser = XML_ParserCreate(NULL);
++ XML_UseParserAsHandlerArg(parser);
++ XML_SetCharacterDataHandler(parser, forbidden_calls_character_handler);
++
++ assert_true(XML_Parse(parser, doc, (int)strlen(doc), /*isFinal=*/XML_TRUE)
++ == XML_STATUS_OK);
++
++ XML_ParserFree(parser);
++}
++END_TEST
++
+ void
+ make_miscellaneous_test_case(Suite *s) {
+ TCase *tc_misc = tcase_create("miscellaneous tests");
+@@ -832,4 +846,5 @@ make_miscellaneous_test_case(Suite *s) {
+ tcase_add_test(tc_misc, test_misc_sync_entity_tolerated);
+ tcase_add_test(tc_misc, test_misc_async_entity_rejected);
+ tcase_add_test(tc_misc, test_misc_no_infinite_loop_issue_1161);
++ tcase_add_test(tc_misc, test_misc_calls_forbidden_from_handlers);
+ }
+--
+2.34.1
+
diff --git a/meta/recipes-core/expat/expat_2.7.5.bb b/meta/recipes-core/expat/expat_2.7.5.bb
index 890ee5b7d3..7f00c6f90b 100644
--- a/meta/recipes-core/expat/expat_2.7.5.bb
+++ b/meta/recipes-core/expat/expat_2.7.5.bb
@@ -36,6 +36,38 @@ SRC_URI = "${GITHUB_BASE_URI}/download/R_${VERSION_TAG}/expat-${PV}.tar.bz2 \
file://CVE-2026-56132_p3.patch;striplevel=2 \
file://CVE-2026-56132_p4.patch;striplevel=2 \
file://CVE-2026-56132_p5.patch;striplevel=2 \
+ file://CVE-2026-50219-01.patch \
+ file://CVE-2026-50219-02.patch \
+ file://CVE-2026-50219-03.patch \
+ file://CVE-2026-50219-04.patch \
+ file://CVE-2026-50219-05.patch \
+ file://CVE-2026-50219-06.patch \
+ file://CVE-2026-50219-07.patch \
+ file://CVE-2026-50219-08.patch \
+ file://CVE-2026-50219-09.patch \
+ file://CVE-2026-50219-10.patch \
+ file://CVE-2026-50219-11.patch \
+ file://CVE-2026-50219-12.patch \
+ file://CVE-2026-50219-13.patch \
+ file://CVE-2026-50219-14.patch \
+ file://CVE-2026-50219-15.patch \
+ file://CVE-2026-50219-16.patch \
+ file://CVE-2026-50219-17.patch \
+ file://CVE-2026-50219-18.patch \
+ file://CVE-2026-50219-19.patch \
+ file://CVE-2026-50219-20.patch \
+ file://CVE-2026-50219-21.patch \
+ file://CVE-2026-50219-22.patch \
+ file://CVE-2026-50219-23.patch \
+ file://CVE-2026-50219-24.patch \
+ file://CVE-2026-50219-25.patch \
+ file://CVE-2026-50219-26.patch \
+ file://CVE-2026-50219-27.patch \
+ file://CVE-2026-50219-28.patch \
+ file://CVE-2026-50219-29.patch \
+ file://CVE-2026-50219-30.patch \
+ file://CVE-2026-50219-31.patch \
+ file://CVE-2026-50219-32.patch \
"
GITHUB_BASE_URI = "https://github.com/libexpat/libexpat/releases/"
--
2.34.1
^ permalink raw reply related [flat|nested] 10+ messages in thread
* [wrynose][PATCH 2/3] expat: fix CVE-2026-56131
2026-08-24 15:20 [wrynose][PATCH 1/3] expat: fix CVE-2026-50219 Jakub Szczudlo (Nokia)
@ 2026-08-24 15:20 ` Jakub Szczudlo (Nokia)
2026-08-24 15:20 ` [wrynose][PATCH 3/3] expat: fix CVE-2026-56412 Jakub Szczudlo (Nokia)
2026-08-24 17:15 ` [wrynose][PATCH 1/3] expat: fix CVE-2026-50219 Paul Barker
2 siblings, 0 replies; 10+ messages in thread
From: Jakub Szczudlo (Nokia) @ 2026-08-24 15:20 UTC (permalink / raw)
To: openembedded-core@lists.openembedded.org
Cc: yoann.congal@smile.fr, Jakub Szczudlo (Nokia)
Backport patch to fix CVE-2026-56131.
References:
https://nvd.nist.gov/vuln/detail/CVE-2026-56131
Upstream fix:
https://github.com/libexpat/libexpat/commit/d5a654b4881f450827af5b3b7b72370a3bbf9a8f
Signed-off-by: Jakub Szczudlo <jakub.szczudlo@nokia.com>
---
.../expat/expat/CVE-2026-56131.patch | 124 ++++++++++++++++++
meta/recipes-core/expat/expat_2.7.5.bb | 1 +
2 files changed, 125 insertions(+)
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56131.patch
diff --git a/meta/recipes-core/expat/expat/CVE-2026-56131.patch b/meta/recipes-core/expat/expat/CVE-2026-56131.patch
new file mode 100644
index 0000000000..8691f98f89
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-56131.patch
@@ -0,0 +1,124 @@
+From 29dfca6ad4d2a9dfd5ce72efd72e1b67d598ab4c Mon Sep 17 00:00:00 2001
+From: netliomax25-code <netliomax25@gmail.com>
+Date: Sat, 6 Jun 2026 20:03:53 +0530
+Subject: [PATCH] lib: protect XML_ResumeParser from being called from a
+ handler
+
+The handler-reentrancy guards from CVE-2026-50219 cover XML_Parse, XML_ParseBuffer, XML_GetBuffer, XML_ParserFree and XML_ParserReset but not XML_ResumeParser, which drives the parser through callProcessor in the same way.
+
+(cherry picked from commit d5a654b4881f450827af5b3b7b72370a3bbf9a8f)
+
+CVE: CVE-2026-56131
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1267/commits/d5a654b4881f450827af5b3b7b72370a3bbf9a8f]
+Signed-off-by: Jakub Szczudlo <jakub.szczudlo@nokia.com>
+---
+ lib/xmlparse.c | 2 +-
+ tests/handlers.c | 24 ++++++++++++++++++++++++
+ tests/handlers.h | 9 +++++++++
+ tests/misc_tests.c | 20 ++++++++++++++++++++
+ 4 files changed, 54 insertions(+), 1 deletion(-)
+
+diff --git a/lib/xmlparse.c b/lib/xmlparse.c
+index cc1d550..a5fa256 100644
+--- a/lib/xmlparse.c
++++ b/lib/xmlparse.c
+@@ -2778,7 +2778,7 @@ enum XML_Status XMLCALL
+ XML_ResumeParser(XML_Parser parser) {
+ enum XML_Status result = XML_STATUS_OK;
+
+- if (parser == NULL)
++ if ((parser == NULL) || isCalledFromInsideHandler(parser))
+ return XML_STATUS_ERROR;
+ if (parser->m_parsingStatus.parsing != XML_SUSPENDED) {
+ parser->m_errorCode = XML_ERROR_NOT_SUSPENDED;
+diff --git a/tests/handlers.c b/tests/handlers.c
+index c7d6578..5a85f6d 100644
+--- a/tests/handlers.c
++++ b/tests/handlers.c
+@@ -2015,3 +2015,27 @@ forbidden_calls_character_handler(void *userData, const XML_Char *s, int len) {
+
+ assert_true(XML_GetErrorCode(parser) == XML_ERROR_NONE);
+ }
++
++void XMLCALL
++suspend_then_resume_character_handler(void *userData, const XML_Char *s,
++ int len) {
++ UNUSED_P(s);
++ UNUSED_P(len);
++ ResumeFromHandlerData *const data = (ResumeFromHandlerData *)userData;
++
++ data->callCount++;
++ if (data->callCount > 1) {
++ // Reached only if the guard under test is missing: XML_ResumeParser would
++ // then have driven the parser re-entrantly and called us again. Bail out
++ // so the test fails by assertion below rather than recursing without bound.
++ return;
++ }
++
++ // Put the parser into XML_SUSPENDED so that, without the guard,
++ // XML_ResumeParser would proceed into a re-entrant parse.
++ assert_true(XML_StopParser(data->parser, /*resumable=*/XML_TRUE)
++ == XML_STATUS_OK);
++
++ // Resuming the parser from inside a handler must be rejected.
++ assert_true(XML_ResumeParser(data->parser) == XML_STATUS_ERROR);
++}
+diff --git a/tests/handlers.h b/tests/handlers.h
+index de28392..507ad8b 100644
+--- a/tests/handlers.h
++++ b/tests/handlers.h
+@@ -616,6 +616,15 @@ extern void XMLCALL forbidden_calls_character_handler(void *userData,
+ const XML_Char *s,
+ int len);
+
++typedef struct {
++ XML_Parser parser;
++ int callCount;
++} ResumeFromHandlerData;
++
++extern void XMLCALL suspend_then_resume_character_handler(void *userData,
++ const XML_Char *s,
++ int len);
++
+ #endif /* XML_HANDLERS_H */
+
+ #ifdef __cplusplus
+diff --git a/tests/misc_tests.c b/tests/misc_tests.c
+index b9053fe..265e7cb 100644
+--- a/tests/misc_tests.c
++++ b/tests/misc_tests.c
+@@ -815,6 +815,25 @@ START_TEST(test_misc_calls_forbidden_from_handlers) {
+ }
+ END_TEST
+
++START_TEST(test_misc_resume_parser_forbidden_from_handler) {
++ const char *const doc = "<doc>Hello world!</doc>";
++
++ XML_Parser parser = XML_ParserCreate(NULL);
++ ResumeFromHandlerData data = {parser, 0};
++ XML_SetUserData(parser, &data);
++ XML_SetCharacterDataHandler(parser, suspend_then_resume_character_handler);
++
++ // The handler suspends the parser, so the top-level parse reports suspension
++ // rather than completion. The handler also asserts that resuming from inside
++ // itself is rejected.
++ assert_true(XML_Parse(parser, doc, (int)strlen(doc), /*isFinal=*/XML_TRUE)
++ == XML_STATUS_SUSPENDED);
++ assert_true(data.callCount == 1);
++
++ XML_ParserFree(parser);
++}
++END_TEST
++
+ void
+ make_miscellaneous_test_case(Suite *s) {
+ TCase *tc_misc = tcase_create("miscellaneous tests");
+@@ -847,4 +866,5 @@ make_miscellaneous_test_case(Suite *s) {
+ tcase_add_test(tc_misc, test_misc_async_entity_rejected);
+ tcase_add_test(tc_misc, test_misc_no_infinite_loop_issue_1161);
+ tcase_add_test(tc_misc, test_misc_calls_forbidden_from_handlers);
++ tcase_add_test(tc_misc, test_misc_resume_parser_forbidden_from_handler);
+ }
+--
+2.34.1
+
diff --git a/meta/recipes-core/expat/expat_2.7.5.bb b/meta/recipes-core/expat/expat_2.7.5.bb
index 7f00c6f90b..78e35243c5 100644
--- a/meta/recipes-core/expat/expat_2.7.5.bb
+++ b/meta/recipes-core/expat/expat_2.7.5.bb
@@ -68,6 +68,7 @@ SRC_URI = "${GITHUB_BASE_URI}/download/R_${VERSION_TAG}/expat-${PV}.tar.bz2 \
file://CVE-2026-50219-30.patch \
file://CVE-2026-50219-31.patch \
file://CVE-2026-50219-32.patch \
+ file://CVE-2026-56131.patch \
"
GITHUB_BASE_URI = "https://github.com/libexpat/libexpat/releases/"
--
2.34.1
^ permalink raw reply related [flat|nested] 10+ messages in thread
* [wrynose][PATCH 3/3] expat: fix CVE-2026-56412
2026-08-24 15:20 [wrynose][PATCH 1/3] expat: fix CVE-2026-50219 Jakub Szczudlo (Nokia)
2026-08-24 15:20 ` [wrynose][PATCH 2/3] expat: fix CVE-2026-56131 Jakub Szczudlo (Nokia)
@ 2026-08-24 15:20 ` Jakub Szczudlo (Nokia)
2026-08-24 17:15 ` [wrynose][PATCH 1/3] expat: fix CVE-2026-50219 Paul Barker
2 siblings, 0 replies; 10+ messages in thread
From: Jakub Szczudlo (Nokia) @ 2026-08-24 15:20 UTC (permalink / raw)
To: openembedded-core@lists.openembedded.org
Cc: yoann.congal@smile.fr, Jakub Szczudlo (Nokia)
Backport patch to fix CVE-2026-56412.
References:
https://nvd.nist.gov/vuln/detail/CVE-2026-56412
Upstream fix:
https://github.com/libexpat/libexpat/commit/d19e834794060d18c061d94452c35d725393ea58
Signed-off-by: Jakub Szczudlo <jakub.szczudlo@nokia.com>
---
.../expat/expat/CVE-2026-56412.patch | 45 +++++++++++++++++++
meta/recipes-core/expat/expat_2.7.5.bb | 1 +
2 files changed, 46 insertions(+)
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56412.patch
diff --git a/meta/recipes-core/expat/expat/CVE-2026-56412.patch b/meta/recipes-core/expat/expat/CVE-2026-56412.patch
new file mode 100644
index 0000000000..8959bdec5c
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-56412.patch
@@ -0,0 +1,45 @@
+From b94cd5b9a6dc7f938a50db2417e4ff60ed35c4a1 Mon Sep 17 00:00:00 2001
+From: hextheshadow <hextheshadow0x@gmail.com>
+Date: Sat, 20 Jun 2026 21:07:29 +0500
+Subject: [PATCH] lib: guard XML_TOK_DATA_CHARS handler calls in
+ doCdataSection()
+
+(cherry picked from commit d19e834794060d18c061d94452c35d725393ea58)
+
+CVE: CVE-2026-56412
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1278/commits/d19e834794060d18c061d94452c35d725393ea58]
+Signed-off-by: Jakub Szczudlo <jakub.szczudlo@nokia.com>
+---
+ lib/xmlparse.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/lib/xmlparse.c b/lib/xmlparse.c
+index a5fa256..1476c7e 100644
+--- a/lib/xmlparse.c
++++ b/lib/xmlparse.c
+@@ -4812,16 +4812,21 @@ doCdataSection(XML_Parser parser, const ENCODING *enc, const char **startPtr,
+ const enum XML_Convert_Result convert_res = XmlConvert(
+ enc, &s, next, &dataPtr, (ICHAR *)parser->m_dataBufEnd);
+ *eventEndPP = next;
++ beforeHandler(parser);
+ charDataHandler(parser->m_handlerArg, parser->m_dataBuf,
+ (int)(dataPtr - (ICHAR *)parser->m_dataBuf));
++ afterHandler(parser);
+ if ((convert_res == XML_CONVERT_COMPLETED)
+ || (convert_res == XML_CONVERT_INPUT_INCOMPLETE))
+ break;
+ *eventPP = s;
+ }
+- } else
++ } else {
++ beforeHandler(parser);
+ charDataHandler(parser->m_handlerArg, (const XML_Char *)s,
+ (int)((const XML_Char *)next - (const XML_Char *)s));
++ afterHandler(parser);
++ }
+ } else if (parser->m_defaultHandler)
+ reportDefault(parser, enc, s, next);
+ } break;
+--
+2.34.1
+
diff --git a/meta/recipes-core/expat/expat_2.7.5.bb b/meta/recipes-core/expat/expat_2.7.5.bb
index 78e35243c5..6fdae2458f 100644
--- a/meta/recipes-core/expat/expat_2.7.5.bb
+++ b/meta/recipes-core/expat/expat_2.7.5.bb
@@ -69,6 +69,7 @@ SRC_URI = "${GITHUB_BASE_URI}/download/R_${VERSION_TAG}/expat-${PV}.tar.bz2 \
file://CVE-2026-50219-31.patch \
file://CVE-2026-50219-32.patch \
file://CVE-2026-56131.patch \
+ file://CVE-2026-56412.patch \
"
GITHUB_BASE_URI = "https://github.com/libexpat/libexpat/releases/"
--
2.34.1
^ permalink raw reply related [flat|nested] 10+ messages in thread
* Re: [wrynose][PATCH 1/3] expat: fix CVE-2026-50219
2026-08-24 15:20 [wrynose][PATCH 1/3] expat: fix CVE-2026-50219 Jakub Szczudlo (Nokia)
2026-08-24 15:20 ` [wrynose][PATCH 2/3] expat: fix CVE-2026-56131 Jakub Szczudlo (Nokia)
2026-08-24 15:20 ` [wrynose][PATCH 3/3] expat: fix CVE-2026-56412 Jakub Szczudlo (Nokia)
@ 2026-08-24 17:15 ` Paul Barker
2026-08-26 8:14 ` Jakub Szczudlo (Nokia)
2 siblings, 1 reply; 10+ messages in thread
From: Paul Barker @ 2026-08-24 17:15 UTC (permalink / raw)
To: Jakub Szczudlo (Nokia), openembedded-core@lists.openembedded.org
Cc: yoann.congal@smile.fr
On Mon, 2026-08-24 at 15:20 +0000, Jakub Szczudlo (Nokia) wrote:
> Expat does not track whether its public parser APIs are called from inside
> a user handler. Re-entering the parser through XML_GetBuffer(),
> XML_Parse(), XML_ParseBuffer(), XML_ParserFree() or XML_ParserReset() can
> therefore result in use-after-free and memory corruption.
> The 32 upstream commits are divided as follows:
> * 01 introduces the handler call depth counter and the helper functions
> used to enter, leave and detect handler execution.
> * 02-04 are preparation patches. They extract handler calls from compound
> expressions so that depth tracking can be placed before and after each
> invocation without changing handler return-value semantics.
> * 05-26 instrument the individual handler types. Each patch covers a
> distinct callback path; omitting one would leave a route around the
> API guards.
> * 27-31 add the actual policy enforcement to XML_GetBuffer(), XML_Parse(),
> XML_ParseBuffer(), XML_ParserFree() and XML_ParserReset().
> * 32 adds regression coverage for all five rejected calls.
> Documentation and Changes-file commits from the upstream
> series are dropped because they do not affect the fix or its test
> coverage.
> An explicit XML_Parser cast is added to the regression-test handler
> because handlers.c is also included by handlers_cxx.cpp and compiled as
> C++ in the OE build.
> Upstream pull request:
> https://github.com/libexpat/libexpat/pull/1246
>
> Signed-off-by: Jakub Szczudlo <jakub.szczudlo@nokia.com>
Hi Jakub,
We have already rejected a previous attempt to backport this fix due to
the complexity [1].
We have updated our policy for the stable branches [2]:
Patches submitted for a stable branch need to be isolated changes that are
human readable and understandable. Fixes for CVEs or other issues which have
a high complexity, consist of a large number of commits and/or a large
numbers of changed lines are unlikely to be accepted due to the difficulty
they cause with maintainability and scalability.
[1]: https://lore.kernel.org/openembedded-core/DJJ4C13UUF69.11ICUQHKB6WN3@smile.fr/
[2]: https://lore.kernel.org/yocto-docs/20260810-stable-patch-complexity-v1-1-f192d51f6311@pbarker.dev/
We're open to discussions of other ways to handle this issue, but we
just don't have the bandwidth to review this patch as-is.
Best regards,
--
Paul Barker
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [wrynose][PATCH 1/3] expat: fix CVE-2026-50219
2026-08-24 17:15 ` [wrynose][PATCH 1/3] expat: fix CVE-2026-50219 Paul Barker
@ 2026-08-26 8:14 ` Jakub Szczudlo (Nokia)
2026-08-26 9:56 ` Paul Barker
0 siblings, 1 reply; 10+ messages in thread
From: Jakub Szczudlo (Nokia) @ 2026-08-26 8:14 UTC (permalink / raw)
To: openembedded-core
[-- Attachment #1: Type: text/plain, Size: 268 bytes --]
Hi,
I understand this CVE is bigger than I thought CVE patch can be.
Maybe we can think about updating expat beyond the fixed version?
I now it's not the best because it is stable branch but I can't think about correct solution.
Best regards,
Jakub Szczudlo
[-- Attachment #2: Type: text/html, Size: 307 bytes --]
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [wrynose][PATCH 1/3] expat: fix CVE-2026-50219
2026-08-26 8:14 ` Jakub Szczudlo (Nokia)
@ 2026-08-26 9:56 ` Paul Barker
2026-08-27 10:54 ` [OE-core] " Adarsh Jagadish Kamini
0 siblings, 1 reply; 10+ messages in thread
From: Paul Barker @ 2026-08-26 9:56 UTC (permalink / raw)
To: Jakub Szczudlo (Nokia), openembedded-core; +Cc: Yoann Congal
On Wed, 2026-08-26 at 01:14 -0700, Jakub Szczudlo (Nokia) wrote:
> Hi,
>
> I understand this CVE is bigger than I thought CVE patch can be.
> Maybe we can think about updating expat beyond the fixed version?
> I now it's not the best because it is stable branch but I can't think about correct solution.
Hi,
Upgrading expat on wrynose & scarthgap may be possible. We are carrying
a *lot* of patches for expat, especially on scarthgap, so it's worth
considering.
It would need a few things:
- Review of the delta between the current version on these branches,
including the patches we're carrying, and the latest version. Check
that there are no features removed or other backwards-incompatible
changes.
- Confirmation that the SONAME changes won't break anything.
- Testing.
- RFC patch on the mailing list with a clear subject so people can see
it's an exception to the usual stable upgrade policy, explain the
review and testing done. This gives chance for people to object if it
will cause issues for them.
- Agreement from the Yocto TSC, based on the above info.
That all needs some time investment beyond what we currently have
available, so if you have the bandwidth to look in to it then that would
be welcome.
Best regards,
--
Paul Barker
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [OE-core] [wrynose][PATCH 1/3] expat: fix CVE-2026-50219
2026-08-26 9:56 ` Paul Barker
@ 2026-08-27 10:54 ` Adarsh Jagadish Kamini
2026-08-27 11:05 ` Jakub Szczudlo (Nokia)
0 siblings, 1 reply; 10+ messages in thread
From: Adarsh Jagadish Kamini @ 2026-08-27 10:54 UTC (permalink / raw)
To: paul@pbarker.dev
Cc: openembedded-core@lists.openembedded.org, yoann.congal@smile.fr,
jakub.szczudlo, Daniel Turull, david.partain@est.tech
On 8/27/26 09:27, Daniel Turull wrote:
> On Wed, 2026-08-26 at 01:14 -0700, Jakub Szczudlo (Nokia) wrote:
>> Hi,
>>
>> I understand this CVE is bigger than I thought CVE patch can be.
>> Maybe we can think about updating expat beyond the fixed version?
>> I now it's not the best because it is stable branch but I can't think about correct solution.
>
> Hi,
>
> Upgrading expat on wrynose & scarthgap may be possible. We are carrying
> a *lot* of patches for expat, especially on scarthgap, so it's worth
> considering.
>
> It would need a few things:
>
> - Review of the delta between the current version on these branches,
> including the patches we're carrying, and the latest version. Check
> that there are no features removed or other backwards-incompatible
> changes.
>
> - Confirmation that the SONAME changes won't break anything.
>
> - Testing.
>
> - RFC patch on the mailing list with a clear subject so people can see
> it's an exception to the usual stable upgrade policy, explain the
> review and testing done. This gives chance for people to object if it
> will cause issues for them.
>
> - Agreement from the Yocto TSC, based on the above info.
>
> That all needs some time investment beyond what we currently have
> available, so if you have the bandwidth to look in to it then that would
> be welcome.
>
> Best regards,
>
Hi all,
I agree that expat should be uplifted to 2.8.3.
I have some comments/suggestions regarding this.
To verify ABI compatibility, I ran abidiff
(https://sourceware.org/libabigail/manual/abidiff.html) for expat 2.7.5
and 2.8.3, and can conclude that there is no ABI break, and can also
confirm that there has not been a major bump in the SONAME.
I want to point to our fork of
meta-binaryaudit(https://github.com/nordix/meta-binaryaudit), which
wraps abidw and abidiff into a Yocto layer, which then can be used to
compare ABI breaks in the packages.
I have also analysed the Changelog as suggested, there has not been any
feature removal, but there are some opt-in feature additions (disabled
by default), and new Autotools flags. I don't see any
backward-incompatible changes.
I will prepare a patch to uplift to expat 2.8.3, test it, and include
these results, and mark it RFC as mentioned.
Thanks!
Adarsh Jagadish Kamini
Ericsson Software Technology AB
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [wrynose][PATCH 1/3] expat: fix CVE-2026-50219
2026-08-27 10:54 ` [OE-core] " Adarsh Jagadish Kamini
@ 2026-08-27 11:05 ` Jakub Szczudlo (Nokia)
2026-08-27 11:45 ` [OE-core] " Adarsh Jagadish Kamini
0 siblings, 1 reply; 10+ messages in thread
From: Jakub Szczudlo (Nokia) @ 2026-08-27 11:05 UTC (permalink / raw)
To: openembedded-core
[-- Attachment #1: Type: text/plain, Size: 719 bytes --]
Hi,
some words also from me:
There is no deleting of functions in expat version from 2.6.4 to 2.8.3
Backwards compatibility should be intact.
There is a deprecation of one of hash function XML_SetHashSalt but it is still possible to be used
The biggest change that could potentially break some unsafe code is the fix for CVE-2026-50219 it makes parser rejecting free/reset/re-entry when it is already in used, so it is defending against possible memory corruption. As it is a fix for security vulnerability I think we can take that risk.
I have also tested it using ptest from packages that use expat it in runtime like python-xml or libxml-parser-perl and all tests passed.
Best regards,
Jakub Szczudlo
[-- Attachment #2: Type: text/html, Size: 781 bytes --]
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [OE-core] [wrynose][PATCH 1/3] expat: fix CVE-2026-50219
2026-08-27 11:05 ` Jakub Szczudlo (Nokia)
@ 2026-08-27 11:45 ` Adarsh Jagadish Kamini
2026-08-27 11:57 ` Jakub Szczudlo (Nokia)
0 siblings, 1 reply; 10+ messages in thread
From: Adarsh Jagadish Kamini @ 2026-08-27 11:45 UTC (permalink / raw)
To: jakub.szczudlo, openembedded-core
On 8/27/26 13:05, Jakub Szczudlo (Nokia) via lists.openembedded.org wrote:
> Hi,
>
> some words also from me:
> There is no deleting of functions in expat version from 2.6.4 to 2.8.3
> Backwards compatibility should be intact.
> There is a deprecation of one of hash function XML_SetHashSalt but it is
> still possible to be used
> The biggest change that could potentially break some unsafe code is the
> fix for CVE-2026-50219 it makes parser rejecting free/reset/re-entry
> when it is already in used, so it is defending against possible memory
> corruption. As it is a fix for security vulnerability I think we can
> take that risk.
>
> I have also tested it using ptest from packages that use expat it in
> runtime like python-xml or libxml-parser-perl and all tests passed.
>
> Best regards,
> Jakub Szczudlo
>
>
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#244476): https://lists.openembedded.org/g/openembedded-core/message/244476
> Mute This Topic: https://lists.openembedded.org/mt/120905189/10182374
> Group Owner: openembedded-core+owner@lists.openembedded.org
> Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [adarsh.jagadish.kamini@est.tech]
> -=-=-=-=-=-=-=-=-=-=-=-
>
Hi Jakub,
Thanks for this, since you already did some analysis for scartgap, is it
possible for you to work on the scarthgap branch, and I can work on
wrynose (So, we don't accidentally push the same patch)?
Thanks!
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [wrynose][PATCH 1/3] expat: fix CVE-2026-50219
2026-08-27 11:45 ` [OE-core] " Adarsh Jagadish Kamini
@ 2026-08-27 11:57 ` Jakub Szczudlo (Nokia)
0 siblings, 0 replies; 10+ messages in thread
From: Jakub Szczudlo (Nokia) @ 2026-08-27 11:57 UTC (permalink / raw)
To: openembedded-core
[-- Attachment #1: Type: text/plain, Size: 377 bytes --]
>
> Hi Jakub,
> Thanks for this, since you already did some analysis for scartgap, is it
> possible for you to work on the scarthgap branch, and I can work on
> wrynose (So, we don't accidentally push the same patch)?
>
> Thanks!
>
Hi Adarsh,
sure I will work on scarthgap. I will test more and If outcome will be positive I will push the patch.
Best regards
[-- Attachment #2: Type: text/html, Size: 428 bytes --]
^ permalink raw reply [flat|nested] 10+ messages in thread
end of thread, other threads:[~2026-08-27 11:57 UTC | newest]
Thread overview: 10+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-08-24 15:20 [wrynose][PATCH 1/3] expat: fix CVE-2026-50219 Jakub Szczudlo (Nokia)
2026-08-24 15:20 ` [wrynose][PATCH 2/3] expat: fix CVE-2026-56131 Jakub Szczudlo (Nokia)
2026-08-24 15:20 ` [wrynose][PATCH 3/3] expat: fix CVE-2026-56412 Jakub Szczudlo (Nokia)
2026-08-24 17:15 ` [wrynose][PATCH 1/3] expat: fix CVE-2026-50219 Paul Barker
2026-08-26 8:14 ` Jakub Szczudlo (Nokia)
2026-08-26 9:56 ` Paul Barker
2026-08-27 10:54 ` [OE-core] " Adarsh Jagadish Kamini
2026-08-27 11:05 ` Jakub Szczudlo (Nokia)
2026-08-27 11:45 ` [OE-core] " Adarsh Jagadish Kamini
2026-08-27 11:57 ` Jakub Szczudlo (Nokia)
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox