Description

hartwork

opened on Aug 31, 2026

Issue body actions

Please see blog post https://blog.hartwork.org/posts/expat-2-8-4-released/ for an overview and the change log at https://github.com/libexpat/libexpat/blob/R_2_8_4/expat/Changes for details. Affects all alive branches of Python. Thank you!

Related: #155558 (predecessor for Expat 2.8.3)

CC @StanFromIreland

---

• CVE-2026-66046
• CVE-2026-76641
• CVE-2026-76956
• CVE-2026-76957

• gh-156723: Update bundled libexpat to version 2.8.4 #156724
• [3.15] gh-156723: Update bundled libexpat to version 2.8.4 (GH-156724) #156731
• [3.14] gh-156723: Update bundled libexpat to version 2.8.4 (GH-156724) #156732
• [3.13] gh-156723: Update bundled libexpat to version 2.8.4 (GH-156724) #156733
• [3.12] gh-156723: Update bundled libexpat to version 2.8.4 (GH-156724) #156785
• [3.11] gh-156723: Update bundled libexpat to version 2.8.4 (GH-156724) #156786
• [3.10] gh-156723: Update bundled libexpat to version 2.8.4 (GH-156724) #156787

Activity

1. StanFromIreland

   self-assigned this

   on Aug 31, 2026
2. StanFromIreland

   added

   type-securityA security issueA security issue

   extension-modulesC modules in the Modules dirC modules in the Modules dir

   topic-XML

   dependenciesPull requests that update a dependency filePull requests that update a dependency file

   3.11only security fixesonly security fixes

   3.10 (EOL)end of lifeend of life

   3.12only security fixesonly security fixes

   3.13only security fixesonly security fixes

   3.14bugs and security fixesbugs and security fixes

   3.15bugs and security fixesbugs and security fixes

   3.16new features, bugs and security fixesnew features, bugs and security fixes

   on Aug 31, 2026
3. StanFromIreland

   added 2 commits that reference this issue on Aug 31, 2026

   gh-156723: Update bundled libexpat to version 2.8.4 (#156724)

   287b7cf

   [3.13] gh-156723: Update bundled libexpat to version 2.8.4 (GH-156724) (

   a371ba8
4. hugovk

   added a commit that references this issue on Aug 31, 2026

   [3.15] gh-156723: Update bundled libexpat to version 2.8.4 (GH-156724) (

   3122687
5. StanFromIreland

   added a commit that references this issue on Aug 31, 2026

   [3.14] gh-156723: Update bundled libexpat to version 2.8.4 (GH-156724) (

   97aaaf9
6. Yhg1s

   added a commit that references this issue on Sep 8, 2026

   [3.12] gh-156723: Update bundled libexpat to version 2.8.4 (GH-156724) (

   278c3c2
7. clin1234

   added a commit that references this issue on Sep 12, 2026

   pythongh-156723: Update bundled libexpat to version 2.8.4 (python#156724

   3526229
8. StanFromIreland

   marked this as blocking on Sep 22, 2026

   • Upgrade bundled Expat to 2.8.5 (e.g. for fix to vulnerability CVE-2026-93990) #157953
9. hugovk

   removed

   3.12only security fixesonly security fixes

   3.13only security fixesonly security fixes

   3.14bugs and security fixesbugs and security fixes

   3.15bugs and security fixesbugs and security fixes

   3.16new features, bugs and security fixesnew features, bugs and security fixes

   on Sep 22, 2026
10. pablogsal

    added 2 commits that reference this issue on Sep 27, 2026

    [3.10] gh-156723: Update bundled libexpat to version 2.8.4 (GH-156724) (

    1ab1aa8

    [3.11] gh-156723: Update bundled libexpat to version 2.8.4 (GH-156724) (

    d98834e
11. StanFromIreland

    closed this as completedon Sep 28, 2026
12. icanhasmath

    added a commit that references this issue on Oct 28, 2026

    [3.10] pythongh-156723: Update bundled libexpat to version 2.8.4 (pyt…

    fb6133d

Issue actions