Description

hartwork

opened on May 11, 2026

Issue body actions

Please see blog post https://blog.hartwork.org/posts/expat-2-8-1-released/ for an overview and the change log at https://github.com/libexpat/libexpat/blob/R_2_8_1/expat/Changes for details. Affects all alive branches of Python. Thank you!

Related: #149017 (predecessor for Expat 2.8.0)

CC @StanFromIreland

CVE-2026-45186

Linked PRs

• gh-149698: Update bundled expat to 2.8.1 #149699
• [3.15] gh-149698: Update bundled expat to 2.8.1 (GH-149699) #149812
• [3.14] gh-149698: Update bundled expat to 2.8.1 (GH-149699) #149813
• [3.13] gh-149698: Update bundled expat to 2.8.1 (GH-149699) #149827
• [3.12] gh-149698: Update bundled expat to 2.8.1 (GH-149699) #150020
• [3.11] gh-149698: Update bundled expat to 2.8.1 (GH-149699) (GH-150020) #155550
• [3.10] gh-149698: Update bundled expat to 2.8.1 (GH-149699) #155551

Activity

1. StanFromIreland

   marked this as blocked on May 11, 2026

   • Upgrade bundled Expat to 2.8.0 (e.g. for the fix to CVE-2026-41080) #149017
2. StanFromIreland

   added

   type-securityA security issueA security issue

   extension-modulesC modules in the Modules dirC modules in the Modules dir

   topic-XML

   3.11only security fixesonly security fixes

   3.10 (EOL)end of lifeend of life

   3.12only security fixesonly security fixes

   3.13only security fixesonly security fixes

   3.14bugs and security fixesbugs and security fixes

   3.15bugs and security fixesbugs and security fixes

   3.16new features, bugs and security fixesnew features, bugs and security fixes

   on May 11, 2026
3. StanFromIreland

   self-assigned this

   on May 11, 2026
4. hugovk

   changed the title [-][security] Please upgrade bundled Expat to 2.8.1 (e.g. for the fix to CVE-2026-45186)[/-] [+][security] Upgrade bundled Expat to 2.8.1 (e.g. for the fix to CVE-2026-45186)[/+] on May 11, 2026
5. hugovk

   changed the title [-][security] Upgrade bundled Expat to 2.8.1 (e.g. for the fix to CVE-2026-45186)[/-] [+]Upgrade bundled Expat to 2.8.1 (e.g. for the fix to CVE-2026-45186)[/+] on May 11, 2026
6. encukou

   added a commit that references this issue on May 13, 2026

   gh-149698: Update bundled expat to 2.8.1 (GH-149699)

   f1a47e7
7. 5 remaining items
8. Yhg1s

   removed

   needs backport to 3.12only security fixesonly security fixes

   on May 18, 2026
9. StanFromIreland

   removed

   3.13only security fixesonly security fixes

   3.14bugs and security fixesbugs and security fixes

   3.15bugs and security fixesbugs and security fixes

   3.16new features, bugs and security fixesnew features, bugs and security fixes

   on May 20, 2026
10. StanFromIreland

    marked this as blocking on Jun 25, 2026

    • Upgrade bundled Expat to 2.8.2 (e.g. for the fix to CVE-2026-56132 and 12 others) #152216
11. chris-eibl commented on Jul 18, 2026

    

    chris-eibl

    on Jul 18, 2026

    Member

    More actions

    #146605 (2.7.5) and #150007 (3.12 backport of 2.8.0, #149017) are done, so I think this is no longer blocked :)
12. StanFromIreland commented on Jul 18, 2026

    

    StanFromIreland

    on Jul 18, 2026

    Member

    More actions

    #146605 (2.7.5) and #150007 (3.12 backport of 2.8.0, #149017) are done, so I think this is no longer blocked :)

    The issue is still open as the backport PRs #149074 and #149075 haven't been merged yet, so I haven't been able to open the backports. This could be a good place to test that new stacked PRs feature I think we've enabled.
13. chris-eibl commented on Jul 18, 2026

    

    chris-eibl

    on Jul 18, 2026

    Member

    More actions

    Ups, was replying to

    3.12 backport is waiting on #146605 & #149017.

    without quoting (since that was the immediate post before).

    IOW, the 3.12 backport should no longer be blocked?

    Reacted by Stan Ulbrych
14. StanFromIreland commented on Jul 18, 2026

    

    StanFromIreland

    on Jul 18, 2026

    Member

    More actions

    Oh right, sorry! Yes, 3.12 backport isn't blocked, just 3.11 and 3.10 now.
15. Yhg1s

    added a commit that references this issue on Aug 4, 2026

    [3.12] gh-149698: Update bundled expat to 2.8.1 (GH-149699) (#150020)

    2dd5ce8
16. pablogsal

    added 2 commits that reference this issue on Aug 11, 2026

    [3.10] gh-149698: Update bundled expat to 2.8.1 (GH-149699) (#155551)

    f1b3df5

    [3.11] gh-149698: Update bundled expat to 2.8.1 (GH-149699) (GH-150020)…

    74179b9
17. StanFromIreland

    closed this as completedon Aug 11, 2026
18. icanhasmath

    added a commit that references this issue on Oct 28, 2026

    [3.10] pythongh-149698: Update bundled expat to 2.8.1 (pythonGH-149699)…

    108922e

Issue actions