{
    "summary": {
        "snap": {
            "added": [],
            "removed": [],
            "diff": []
        },
        "deb": {
            "added": [],
            "removed": [],
            "diff": [
                "curl",
                "libcurl4t64",
                "libexpat1"
            ]
        }
    },
    "diff": {
        "deb": [
            {
                "name": "curl",
                "from_version": {
                    "source_package_name": "curl",
                    "source_package_version": "8.5.0-2ubuntu10.13",
                    "version": "8.5.0-2ubuntu10.13"
                },
                "to_version": {
                    "source_package_name": "curl",
                    "source_package_version": "8.5.0-2ubuntu10.15",
                    "version": "8.5.0-2ubuntu10.15"
                },
                "cves": [
                    {
                        "cve": "CVE-2026-13608",
                        "url": "https://ubuntu.com/security/CVE-2026-13608",
                        "cve_description": "A flaw in the libcurl SASL negotiation for LDAP authentication allows an incomplete handshake sequence to be misinterpreted as a successful cryptographic verification. An attacker executing a Man-in-the-Middle (MITM) attack can inject a premature or shortcut response that bypasses complete peer validation.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-09-06 18:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-18924",
                        "url": "https://ubuntu.com/security/CVE-2026-18924",
                        "cve_description": "A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-09-06 18:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-80230",
                        "url": "https://ubuntu.com/security/CVE-2026-80230",
                        "cve_description": "When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable standard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and `CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on connections established without a presented server certificate. Bypassing the pinning check under these disabled-verification conditions allows unauthenticated connections to succeed when they should be rejected.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-09-06 18:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-82209",
                        "url": "https://ubuntu.com/security/CVE-2026-82209",
                        "cve_description": "When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when processing a `Set-Cookie` header where the `Domain` attribute explicitly matches an origin host that is itself a public suffix (e.g., `Domain=co.uk` set by `co.uk`).  Instead of coercing it into a strict host-only cookie, libcurl saves the cookie with wildcard domain scope (`.co.uk`). Consequently, the cookie is inappropriately included in subsequent outbound requests or HTTP redirects to arbitrary sibling subdomains under the same public suffix (e.g., `attacker.co.uk`).",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-09-06 18:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-8927",
                        "url": "https://ubuntu.com/security/CVE-2026-8927",
                        "cve_description": "When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial transfer authenticates against `proxyA` using Digest auth, a subsequent transfer routed through `proxyB` erroneously leaks the `Proxy-Authorization:` header intended solely for `proxyA`.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-07-03 07:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-6429",
                        "url": "https://ubuntu.com/security/CVE-2026-6429",
                        "cve_description": "When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, libcurl could leak the password used for the first host to the followed-to host under certain circumstances.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-05-13 13:01:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-8286",
                        "url": "https://ubuntu.com/security/CVE-2026-8286",
                        "cve_description": "A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though the TLS configuration mismatches so it should not.",
                        "cve_priority": "low",
                        "cve_public_date": "2026-07-03 07:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-8458",
                        "url": "https://ubuntu.com/security/CVE-2026-8458",
                        "cve_description": "libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated ones, even when they are set to use different \"services\".  libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead.  When reusing a connection a range of criteria must be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different services.",
                        "cve_priority": "low",
                        "cve_public_date": "2026-07-03 07:16:00 UTC"
                    }
                ],
                "launchpad_bugs_fixed": [],
                "changes": [
                    {
                        "cves": [
                            {
                                "cve": "CVE-2026-13608",
                                "url": "https://ubuntu.com/security/CVE-2026-13608",
                                "cve_description": "A flaw in the libcurl SASL negotiation for LDAP authentication allows an incomplete handshake sequence to be misinterpreted as a successful cryptographic verification. An attacker executing a Man-in-the-Middle (MITM) attack can inject a premature or shortcut response that bypasses complete peer validation.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-09-06 18:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-18924",
                                "url": "https://ubuntu.com/security/CVE-2026-18924",
                                "cve_description": "A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-09-06 18:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-80230",
                                "url": "https://ubuntu.com/security/CVE-2026-80230",
                                "cve_description": "When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable standard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and `CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on connections established without a presented server certificate. Bypassing the pinning check under these disabled-verification conditions allows unauthenticated connections to succeed when they should be rejected.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-09-06 18:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-82209",
                                "url": "https://ubuntu.com/security/CVE-2026-82209",
                                "cve_description": "When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when processing a `Set-Cookie` header where the `Domain` attribute explicitly matches an origin host that is itself a public suffix (e.g., `Domain=co.uk` set by `co.uk`).  Instead of coercing it into a strict host-only cookie, libcurl saves the cookie with wildcard domain scope (`.co.uk`). Consequently, the cookie is inappropriately included in subsequent outbound requests or HTTP redirects to arbitrary sibling subdomains under the same public suffix (e.g., `attacker.co.uk`).",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-09-06 18:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-8927",
                                "url": "https://ubuntu.com/security/CVE-2026-8927",
                                "cve_description": "When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial transfer authenticates against `proxyA` using Digest auth, a subsequent transfer routed through `proxyB` erroneously leaks the `Proxy-Authorization:` header intended solely for `proxyA`.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-07-03 07:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-6429",
                                "url": "https://ubuntu.com/security/CVE-2026-6429",
                                "cve_description": "When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, libcurl could leak the password used for the first host to the followed-to host under certain circumstances.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-05-13 13:01:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-8286",
                                "url": "https://ubuntu.com/security/CVE-2026-8286",
                                "cve_description": "A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though the TLS configuration mismatches so it should not.",
                                "cve_priority": "low",
                                "cve_public_date": "2026-07-03 07:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-8458",
                                "url": "https://ubuntu.com/security/CVE-2026-8458",
                                "cve_description": "libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated ones, even when they are set to use different \"services\".  libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead.  When reusing a connection a range of criteria must be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different services.",
                                "cve_priority": "low",
                                "cve_public_date": "2026-07-03 07:16:00 UTC"
                            }
                        ],
                        "log": [
                            "",
                            "  [ Charles Cochran ]",
                            "  * SECURITY UPDATE: Authentication bypass in LDAP SASL negotiation.",
                            "    - debian/patches/CVE-2026-13608.patch: openldap: handle",
                            "      Curl_sasl_continue() returns better in lib/openldap.c.",
                            "    - CVE-2026-13608",
                            "  * SECURITY UPDATE: Use after free in HTTP/2 server push.",
                            "    - debian/patches/CVE-2026-18924.patch: make server push transfers",
                            "      inherit share from parent in lib/http2.c.",
                            "    - CVE-2026-18924",
                            "  * SECURITY UPDATE: Public key pinning bypass.",
                            "    - debian/patches/CVE-2026-80230.patch: require server cert if public",
                            "      key pinned in lib/vtls/openssl.c.",
                            "    - CVE-2026-80230",
                            "  * SECURITY UPDATE: Cookie injection for public suffix domains.",
                            "    - debian/patches/CVE-2026-82209.patch: ensure cookies set for an exact",
                            "      PSL domain are host-only in lib/cookie.c, tests/data/Makefile.inc,",
                            "      tests/data/test1136, tests/data/test2318.",
                            "    - CVE-2026-82209",
                            "",
                            "  [ Kyle Kernick]",
                            "  * SECURITY REGRESSION: checksrc errors and failing test case for",
                            "    CVE-2026-8927 (LP #2167779)",
                            "    - debian/patches/CVE-2026-6429.patch: Fix indentation to fix",
                            "      autopkgtests in lib/transfer.c.",
                            "    - debian/patches/CVE-2026-8286.patch: Wrap long line to fix",
                            "      autopkgtests in lib/url.c.",
                            "    - debian/patches/CVE-2026-8458.patch: Wrap long lines and fix",
                            "      indentation to fix autopkgtests in lib/curl_sasl.c.",
                            "    - debian/patches/CVE-2026-8927.patch: Fix failing test",
                            ""
                        ],
                        "package": "curl",
                        "version": "8.5.0-2ubuntu10.15",
                        "urgency": "medium",
                        "distributions": "noble-security",
                        "launchpad_bugs_fixed": [],
                        "author": "Charles Cochran <charles.cochran@canonical.com>",
                        "date": "Fri, 18 Sep 2026 11:45:57 -0400"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "libcurl4t64",
                "from_version": {
                    "source_package_name": "curl",
                    "source_package_version": "8.5.0-2ubuntu10.13",
                    "version": "8.5.0-2ubuntu10.13"
                },
                "to_version": {
                    "source_package_name": "curl",
                    "source_package_version": "8.5.0-2ubuntu10.15",
                    "version": "8.5.0-2ubuntu10.15"
                },
                "cves": [
                    {
                        "cve": "CVE-2026-13608",
                        "url": "https://ubuntu.com/security/CVE-2026-13608",
                        "cve_description": "A flaw in the libcurl SASL negotiation for LDAP authentication allows an incomplete handshake sequence to be misinterpreted as a successful cryptographic verification. An attacker executing a Man-in-the-Middle (MITM) attack can inject a premature or shortcut response that bypasses complete peer validation.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-09-06 18:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-18924",
                        "url": "https://ubuntu.com/security/CVE-2026-18924",
                        "cve_description": "A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-09-06 18:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-80230",
                        "url": "https://ubuntu.com/security/CVE-2026-80230",
                        "cve_description": "When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable standard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and `CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on connections established without a presented server certificate. Bypassing the pinning check under these disabled-verification conditions allows unauthenticated connections to succeed when they should be rejected.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-09-06 18:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-82209",
                        "url": "https://ubuntu.com/security/CVE-2026-82209",
                        "cve_description": "When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when processing a `Set-Cookie` header where the `Domain` attribute explicitly matches an origin host that is itself a public suffix (e.g., `Domain=co.uk` set by `co.uk`).  Instead of coercing it into a strict host-only cookie, libcurl saves the cookie with wildcard domain scope (`.co.uk`). Consequently, the cookie is inappropriately included in subsequent outbound requests or HTTP redirects to arbitrary sibling subdomains under the same public suffix (e.g., `attacker.co.uk`).",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-09-06 18:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-8927",
                        "url": "https://ubuntu.com/security/CVE-2026-8927",
                        "cve_description": "When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial transfer authenticates against `proxyA` using Digest auth, a subsequent transfer routed through `proxyB` erroneously leaks the `Proxy-Authorization:` header intended solely for `proxyA`.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-07-03 07:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-6429",
                        "url": "https://ubuntu.com/security/CVE-2026-6429",
                        "cve_description": "When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, libcurl could leak the password used for the first host to the followed-to host under certain circumstances.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-05-13 13:01:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-8286",
                        "url": "https://ubuntu.com/security/CVE-2026-8286",
                        "cve_description": "A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though the TLS configuration mismatches so it should not.",
                        "cve_priority": "low",
                        "cve_public_date": "2026-07-03 07:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-8458",
                        "url": "https://ubuntu.com/security/CVE-2026-8458",
                        "cve_description": "libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated ones, even when they are set to use different \"services\".  libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead.  When reusing a connection a range of criteria must be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different services.",
                        "cve_priority": "low",
                        "cve_public_date": "2026-07-03 07:16:00 UTC"
                    }
                ],
                "launchpad_bugs_fixed": [],
                "changes": [
                    {
                        "cves": [
                            {
                                "cve": "CVE-2026-13608",
                                "url": "https://ubuntu.com/security/CVE-2026-13608",
                                "cve_description": "A flaw in the libcurl SASL negotiation for LDAP authentication allows an incomplete handshake sequence to be misinterpreted as a successful cryptographic verification. An attacker executing a Man-in-the-Middle (MITM) attack can inject a premature or shortcut response that bypasses complete peer validation.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-09-06 18:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-18924",
                                "url": "https://ubuntu.com/security/CVE-2026-18924",
                                "cve_description": "A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-09-06 18:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-80230",
                                "url": "https://ubuntu.com/security/CVE-2026-80230",
                                "cve_description": "When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable standard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and `CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on connections established without a presented server certificate. Bypassing the pinning check under these disabled-verification conditions allows unauthenticated connections to succeed when they should be rejected.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-09-06 18:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-82209",
                                "url": "https://ubuntu.com/security/CVE-2026-82209",
                                "cve_description": "When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when processing a `Set-Cookie` header where the `Domain` attribute explicitly matches an origin host that is itself a public suffix (e.g., `Domain=co.uk` set by `co.uk`).  Instead of coercing it into a strict host-only cookie, libcurl saves the cookie with wildcard domain scope (`.co.uk`). Consequently, the cookie is inappropriately included in subsequent outbound requests or HTTP redirects to arbitrary sibling subdomains under the same public suffix (e.g., `attacker.co.uk`).",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-09-06 18:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-8927",
                                "url": "https://ubuntu.com/security/CVE-2026-8927",
                                "cve_description": "When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial transfer authenticates against `proxyA` using Digest auth, a subsequent transfer routed through `proxyB` erroneously leaks the `Proxy-Authorization:` header intended solely for `proxyA`.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-07-03 07:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-6429",
                                "url": "https://ubuntu.com/security/CVE-2026-6429",
                                "cve_description": "When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, libcurl could leak the password used for the first host to the followed-to host under certain circumstances.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-05-13 13:01:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-8286",
                                "url": "https://ubuntu.com/security/CVE-2026-8286",
                                "cve_description": "A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though the TLS configuration mismatches so it should not.",
                                "cve_priority": "low",
                                "cve_public_date": "2026-07-03 07:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-8458",
                                "url": "https://ubuntu.com/security/CVE-2026-8458",
                                "cve_description": "libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated ones, even when they are set to use different \"services\".  libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead.  When reusing a connection a range of criteria must be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different services.",
                                "cve_priority": "low",
                                "cve_public_date": "2026-07-03 07:16:00 UTC"
                            }
                        ],
                        "log": [
                            "",
                            "  [ Charles Cochran ]",
                            "  * SECURITY UPDATE: Authentication bypass in LDAP SASL negotiation.",
                            "    - debian/patches/CVE-2026-13608.patch: openldap: handle",
                            "      Curl_sasl_continue() returns better in lib/openldap.c.",
                            "    - CVE-2026-13608",
                            "  * SECURITY UPDATE: Use after free in HTTP/2 server push.",
                            "    - debian/patches/CVE-2026-18924.patch: make server push transfers",
                            "      inherit share from parent in lib/http2.c.",
                            "    - CVE-2026-18924",
                            "  * SECURITY UPDATE: Public key pinning bypass.",
                            "    - debian/patches/CVE-2026-80230.patch: require server cert if public",
                            "      key pinned in lib/vtls/openssl.c.",
                            "    - CVE-2026-80230",
                            "  * SECURITY UPDATE: Cookie injection for public suffix domains.",
                            "    - debian/patches/CVE-2026-82209.patch: ensure cookies set for an exact",
                            "      PSL domain are host-only in lib/cookie.c, tests/data/Makefile.inc,",
                            "      tests/data/test1136, tests/data/test2318.",
                            "    - CVE-2026-82209",
                            "",
                            "  [ Kyle Kernick]",
                            "  * SECURITY REGRESSION: checksrc errors and failing test case for",
                            "    CVE-2026-8927 (LP #2167779)",
                            "    - debian/patches/CVE-2026-6429.patch: Fix indentation to fix",
                            "      autopkgtests in lib/transfer.c.",
                            "    - debian/patches/CVE-2026-8286.patch: Wrap long line to fix",
                            "      autopkgtests in lib/url.c.",
                            "    - debian/patches/CVE-2026-8458.patch: Wrap long lines and fix",
                            "      indentation to fix autopkgtests in lib/curl_sasl.c.",
                            "    - debian/patches/CVE-2026-8927.patch: Fix failing test",
                            ""
                        ],
                        "package": "curl",
                        "version": "8.5.0-2ubuntu10.15",
                        "urgency": "medium",
                        "distributions": "noble-security",
                        "launchpad_bugs_fixed": [],
                        "author": "Charles Cochran <charles.cochran@canonical.com>",
                        "date": "Fri, 18 Sep 2026 11:45:57 -0400"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "libexpat1",
                "from_version": {
                    "source_package_name": "expat",
                    "source_package_version": "2.6.1-2ubuntu0.5",
                    "version": "2.6.1-2ubuntu0.5"
                },
                "to_version": {
                    "source_package_name": "expat",
                    "source_package_version": "2.6.1-2ubuntu0.6",
                    "version": "2.6.1-2ubuntu0.6"
                },
                "cves": [
                    {
                        "cve": "CVE-2026-56410",
                        "url": "https://ubuntu.com/security/CVE-2026-56410",
                        "cve_description": "xmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-06-21 16:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-56406",
                        "url": "https://ubuntu.com/security/CVE-2026-56406",
                        "cve_description": "libexpat before 2.8.2 has an integer overflow in XML_ParseBuffer because it lacked a check that was present in XML_Parse.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-06-21 16:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-56409",
                        "url": "https://ubuntu.com/security/CVE-2026-56409",
                        "cve_description": "xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-06-21 16:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-56407",
                        "url": "https://ubuntu.com/security/CVE-2026-56407",
                        "cve_description": "libexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity textLen.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-06-21 16:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-56411",
                        "url": "https://ubuntu.com/security/CVE-2026-56411",
                        "cve_description": "xmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-06-21 17:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-56131",
                        "url": "https://ubuntu.com/security/CVE-2026-56131",
                        "cve_description": "libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation. Thus, a use-after-free can occur (similar to the CVE-2026-50219 situation).",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-06-19 06:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-56132",
                        "url": "https://ubuntu.com/security/CVE-2026-56132",
                        "cve_description": "In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold backing array reallocation is mishandled when there is data-structure sharing across parsers.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-06-19 06:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-72522",
                        "url": "https://ubuntu.com/security/CVE-2026-72522",
                        "cve_description": "libexpat before 2.8.3 has an out-of-bounds read and resultant infinite loop because low surrogates are treated the same as high surrogates during Unicode processing in the *_toUtf16 functions.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-08-10 04:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-66046",
                        "url": "https://ubuntu.com/security/CVE-2026-66046",
                        "cve_description": "Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an O(N^2) linear scan of elementType->defaultAtts to determine CDATA status. A remote unauthenticated attacker can supply a single well-formed XML document of a few megabytes to an application parsing untrusted XML to cause excessive CPU consumption, resulting in denial of service without requiring authentication, external entity resolution, or non-default parser options.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-08-18 15:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-76641",
                        "url": "https://ubuntu.com/security/CVE-2026-76641",
                        "cve_description": "Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory corruption by processing XML with external entity parsers created via XML_ExternalEntityParserCreate. A struct size mismatch between ELEMENT_TYPE members causes storeAtts to read the attIndex member past allocated memory boundaries, resulting in failure to normalize whitespace in non-CDATA attributes or a wild pointer dereference causing a segfault. This vulnerability was introduced by the fix for CVE-2026-66046.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-08-20 18:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-76957",
                        "url": "https://ubuntu.com/security/CVE-2026-76957",
                        "cve_description": "libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-08-20 05:16:00 UTC"
                    }
                ],
                "launchpad_bugs_fixed": [],
                "changes": [
                    {
                        "cves": [
                            {
                                "cve": "CVE-2026-56410",
                                "url": "https://ubuntu.com/security/CVE-2026-56410",
                                "cve_description": "xmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-06-21 16:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-56406",
                                "url": "https://ubuntu.com/security/CVE-2026-56406",
                                "cve_description": "libexpat before 2.8.2 has an integer overflow in XML_ParseBuffer because it lacked a check that was present in XML_Parse.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-06-21 16:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-56409",
                                "url": "https://ubuntu.com/security/CVE-2026-56409",
                                "cve_description": "xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-06-21 16:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-56407",
                                "url": "https://ubuntu.com/security/CVE-2026-56407",
                                "cve_description": "libexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity textLen.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-06-21 16:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-56411",
                                "url": "https://ubuntu.com/security/CVE-2026-56411",
                                "cve_description": "xmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-06-21 17:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-56131",
                                "url": "https://ubuntu.com/security/CVE-2026-56131",
                                "cve_description": "libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation. Thus, a use-after-free can occur (similar to the CVE-2026-50219 situation).",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-06-19 06:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-56132",
                                "url": "https://ubuntu.com/security/CVE-2026-56132",
                                "cve_description": "In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold backing array reallocation is mishandled when there is data-structure sharing across parsers.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-06-19 06:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-72522",
                                "url": "https://ubuntu.com/security/CVE-2026-72522",
                                "cve_description": "libexpat before 2.8.3 has an out-of-bounds read and resultant infinite loop because low surrogates are treated the same as high surrogates during Unicode processing in the *_toUtf16 functions.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-08-10 04:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-66046",
                                "url": "https://ubuntu.com/security/CVE-2026-66046",
                                "cve_description": "Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an O(N^2) linear scan of elementType->defaultAtts to determine CDATA status. A remote unauthenticated attacker can supply a single well-formed XML document of a few megabytes to an application parsing untrusted XML to cause excessive CPU consumption, resulting in denial of service without requiring authentication, external entity resolution, or non-default parser options.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-08-18 15:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-76641",
                                "url": "https://ubuntu.com/security/CVE-2026-76641",
                                "cve_description": "Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory corruption by processing XML with external entity parsers created via XML_ExternalEntityParserCreate. A struct size mismatch between ELEMENT_TYPE members causes storeAtts to read the attIndex member past allocated memory boundaries, resulting in failure to normalize whitespace in non-CDATA attributes or a wild pointer dereference causing a segfault. This vulnerability was introduced by the fix for CVE-2026-66046.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-08-20 18:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-76957",
                                "url": "https://ubuntu.com/security/CVE-2026-76957",
                                "cve_description": "libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-08-20 05:16:00 UTC"
                            }
                        ],
                        "log": [
                            "",
                            "  * SECURITY UPDATE: integer overflow",
                            "    - debian/patches/CVE-2026-56410-1.patch: xmlwf: protect resolveSystemId from",
                            "      integer overflow in expat/xmlwf/xmlfile.c.",
                            "    - debian/patches/CVE-2026-56410-2.patch: xmlwf: guard each operator in",
                            "      resolveSystemId length sum in expat/xmlwf/xmlfile.c.",
                            "    - CVE-2026-56410",
                            "  * SECURITY UPDATE: integer overflow",
                            "    - debian/patches/CVE-2026-56406.patch: lib: Copy overflow check from",
                            "      `XML_Parse` to `XML_ParseBuffer` in expat/lib/xmlparse.c.",
                            "    - CVE-2026-56406",
                            "  * SECURITY UPDATE: integer overflow",
                            "    - debian/patches/CVE-2026-56409.patch: xmlwf: protect output path join from",
                            "      integer overflow in expat/xmlwf/xmlwf.c.",
                            "    - CVE-2026-56409",
                            "  * SECURITY UPDATE: integer overflow",
                            "    - debian/patches/CVE-2026-56407.patch: cap entity textLen against signed",
                            "      integer overflow in expat/lib/xmlparse.c.",
                            "    - CVE-2026-56407",
                            "  * SECURITY UPDATE: integer overflow",
                            "    - debian/patches/CVE-2026-56411.patch: xmlwf: protect notation list",
                            "      allocation from integer overflow in expat/xmlwf/xmlwf.c.",
                            "    - CVE-2026-56411",
                            "  * SECURITY UPDATE: use after free",
                            "    - debian/patches/CVE-2026-56131.patch: lib: protect XML_ResumeParser from",
                            "      being called from a handler in expat/lib/xmlparse.c,",
                            "      expat/tests/handlers.c, expat/tests/handlers.h, expat/tests/misc_tests.c.",
                            "    - CVE-2026-56131",
                            "  * SECURITY UPDATE: heap-based buffer overflow",
                            "    - debian/patches/CVE-2026-56132-pre1.patch: lib: swap '(size_t)(-1)' for C99",
                            "      equivalent, 'SIZE_MAX' in expat/lib/xmlparse.c.",
                            "    - debian/patches/CVE-2026-56132-pre2.patch: lib: use a `size_t` for group",
                            "      sizes in expat/lib/xmlparse.c.",
                            "    - debian/patches/CVE-2026-56132-1.patch: lib: Remove reuse of `m_groupSize`",
                            "      to count `m_scaffIndex` allocation in expat/lib/xmlparse.c.",
                            "    - debian/patches/CVE-2026-56132-2.patch: lib: doProlog: Fix out-of-bound",
                            "      scaffolding index store in expat/lib/xmlparse.c.",
                            "    - debian/patches/CVE-2026-56132-3.patch: tests: Add a test case for",
                            "      scaffolding array limits in shared DTDs in expat/tests/basic_tests.c.",
                            "    - debian/patches/CVE-2026-56132-4.patch: lib: Remove unnecessary",
                            "      `scaffIndex` expansion in expat/lib/xmlparse.c.",
                            "    - debian/patches/CVE-2026-56132-5.patch: lib: Remove indented scoping of",
                            "      `new_connector` local in expat/lib/xmlparse.c.",
                            "    - CVE-2026-56132",
                            "  * SECURITY UPDATE: out-of-bounds read",
                            "    - debian/patches/CVE-2026-72522-1.patch: lib: Improve in-code comment for",
                            "      functions *toUtf16 in expat/lib/xmltok.c.",
                            "    - debian/patches/CVE-2026-72522-2.patch: lib: Stop functions *_toUtf16 from",
                            "      mis-classifying low surrogates as high surrogates in expat/lib/xmltok.c.",
                            "    - debian/patches/CVE-2026-72522-3.patch: tests/misc_tests.c: Cover Unicode",
                            "      surrogate mix-up in expat/tests/misc_tests.c.",
                            "    - debian/patches/CVE-2026-72522-4.patch: lib: Make an exit condition in",
                            "      `storeAttributeValue` more defensive in expat/lib/xmlparse.c.",
                            "    - CVE-2026-72522",
                            "  * SECURITY UPDATE: denial of service (algorithmic complexity of storeAtts())",
                            "    - debian/patches/CVE-2026-66046.patch: lib: Rename hash table",
                            "      `defaultAttsNames` to `defaultAttForName` in expat/lib/xmlparse.c.",
                            "    - CVE-2026-66046",
                            "  * SECURITY UPDATE: out-of-bounds read",
                            "    - debian/patches/CVE-2026-76641.patch: lib: Fix out-of-bounds read from hash",
                            "      table entries created by dtdCopy in expat/lib/xmlparse.c,",
                            "      expat/tests/basic_tests.c.",
                            "    - CVE-2026-76641",
                            "  * SECURITY UPDATE: use after free",
                            "    - debian/patches/CVE-2026-76957-1.patch: Protect custom encoding callbacks",
                            "      from parser reentry in expat/lib/xmlparse.c.",
                            "    - debian/patches/CVE-2026-76957-2.patch: Test custom encoding callback",
                            "      reentry protection in expat/tests/misc_tests.c.",
                            "    - CVE-2026-76957",
                            ""
                        ],
                        "package": "expat",
                        "version": "2.6.1-2ubuntu0.6",
                        "urgency": "medium",
                        "distributions": "noble-security",
                        "launchpad_bugs_fixed": [],
                        "author": "Isabel Garcia Contreras <isabel.garcia@canonical.com>",
                        "date": "Mon, 21 Sep 2026 16:05:43 -0400"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            }
        ],
        "snap": []
    },
    "added": {
        "deb": [],
        "snap": []
    },
    "removed": {
        "deb": [],
        "snap": []
    },
    "notes": "Changelog diff for Ubuntu 24.04 noble image from daily image serial 20260924 to 20260925",
    "from_series": "noble",
    "to_series": "noble",
    "from_serial": "20260924",
    "to_serial": "20260925",
    "from_manifest_filename": "daily_manifest.previous",
    "to_manifest_filename": "manifest.current"
}