Description

hartwork

opened on Oct 5, 2026

Issue body actions

Please see blog post https://blog.hartwork.org/posts/expat-2-9-0-released/ for an overview and the change log at https://github.com/libexpat/libexpat/blob/R_2_9_0/expat/Changes for details. Affects all alive branches of Python. Thank you!

Related: #157953 (predecessor for Expat 2.8.5)

CC @StanFromIreland

---

• CVE-2026-77214
• CVE-2026-102633

---

• gh-158876: Update bundled Expat to 2.9.0 #158881
• [3.14] gh-158876: Update bundled Expat to 2.9.0 (GH-158881) #159920
• [3.15] gh-158876: Update bundled Expat to 2.9.0 (GH-158881) #159921
• [3.13] gh-158876: Update bundled Expat to 2.9.0 (GH-158881) #160257
• [3.12] gh-158876: Update bundled Expat to 2.9.0 (GH-158881) #160258
• [3.11] gh-158876: Update bundled Expat to 2.9.0 (GH-158881) #160261

Activity

1. StanFromIreland

   self-assigned this

   on Oct 5, 2026
2. StanFromIreland

   added

   3.11only security fixesonly security fixes

   3.12only security fixesonly security fixes

   3.13only security fixesonly security fixes

   3.14bugs and security fixesbugs and security fixes

   3.15bugs and security fixesbugs and security fixes

   3.16new features, bugs and security fixesnew features, bugs and security fixes

   topic-XML

   extension-modulesC modules in the Modules dirC modules in the Modules dir

   type-securityA security issueA security issue

   on Oct 5, 2026
3. hugovk

   changed the title [-]Please upgrade bundled Expat to 2.9.0 (e.g. for fixes to two vulnerabilities)[/-] [+]Upgrade bundled Expat to 2.9.0 (e.g. for fixes to two vulnerabilities)[/+] on Oct 5, 2026
4. kevinprimeraquecreo-stack

   added this to Project_VKon Oct 18, 2026
5. github-project-automation

   moved this to Todo in Project_VKon Oct 18, 2026
6. kevinprimeraquecreo-stack

   added this to Project_VKon Oct 18, 2026
7. encukou

   added a commit that references this issue on Oct 20, 2026

   gh-158876: Update bundled Expat to 2.9.0 (GH-158881)

   0071fb5
8. StanFromIreland

   added 2 commits that reference this issue on Oct 20, 2026

   [3.14] gh-158876: Update bundled Expat to 2.9.0 (GH-158881) (#159920)

   db34557

   [3.15] gh-158876: Update bundled Expat to 2.9.0 (GH-158881) (#159921)

   1f70745
9. hugovk

   removed

   3.14bugs and security fixesbugs and security fixes

   3.15bugs and security fixesbugs and security fixes

   3.16new features, bugs and security fixesnew features, bugs and security fixes

   on Oct 22, 2026
10. Yhg1s

    added 2 commits that reference this issue on Oct 25, 2026

    [3.12] gh-158876: Update bundled Expat to 2.9.0 (GH-158881) (#160258)

    5cf3260

    [3.13] gh-158876: Update bundled Expat to 2.9.0 (GH-158881) (#160257)

    cb3a838
11. StanFromIreland

    removed

    3.12only security fixesonly security fixes

    3.13only security fixesonly security fixes

    on Oct 25, 2026
12. pablogsal

    added a commit that references this issue on Oct 25, 2026

    [3.11] gh-158876: Update bundled Expat to 2.9.0 (GH-158881) (#160261)

    b370d7a
13. StanFromIreland

    closed this as completedon Oct 25, 2026
14. icanhasmath

    added 2 commits that reference this issue on Oct 28, 2026

    [3.11] pythongh-158876: Update bundled Expat to 2.9.0 (pythonGH-158881)…

    bcd989e

    [3.11] pythongh-158876: Update bundled Expat to 2.9.0 (pythonGH-158881)…

    da54fc1

Issue actions