There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Expat through 2.8.4 fails to validate low surrogates following high surrogates in UTF-16 input, allowing
    malformed UTF-16 sequences to be accepted. Attackers can craft UTF-16 encoded XML with lone high
    surrogates that consume following code units, hiding markup characters from the parser and enabling XML
    injection attacks. (CVE-2026-93990)

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且廠商未提供可用的修補程式。

  - Expat through 2.8.4 無法驗證 UTF-16 輸入中高代理之後的低代理，因此可以接受格式錯誤的 UTF-16 序列。攻擊者可以使用消耗以下程式碼單元的單獨高代理來製作 UTF-16 編碼的 XML，從而隱藏剖析器的標記字元並啟用 XML 插入攻擊。（CVE-2026-93990）

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - Expat 通过 2.8.4 无法验证 UTF-16 输入中高代理之后的低代理，从而允许接受畸形 UTF-16 序列。攻击者可使用消耗后续代码单元的单独高代理构建 UTF-16 编码的 XML，从而对解析器隐藏标记字符并启用 XML 注入攻击。（CVE-2026-93990）

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - 2.8.4 までの Expat は、UTF-16 入力の高サロゲートに続く低サロゲートの検証に失敗し、無効な形式の UTF-16 シーケンスが受け入れられる可能性があります。攻撃者が、以下のコードユニットを消費する唯一の高代理で UTF-16 エンコードされた XML を細工し、パーサーからマークアップ文字を隠し、XML インジェクション攻撃を可能にします。(CVE-2026-93990)

Nessus は、ベンダーから報告されたパッケージの存在に依存していることに注意してください。

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Expat through 2.8.4 fails to validate low surrogates following high surrogates in UTF-16 input, allowing     malformed UTF-16 sequences to be accepted. Attackers can craft UTF-16 encoded XML with lone high     surrogates that consume following code units, hiding markup characters from the parser and enabling XML     injection attacks. (CVE-2026-93990)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:72448 advisory.

    Expat is a C library for parsing XML documents.

    Security Fix(es):

    * expat: Expat: Denial of Service via quadratic complexity in attribute processing (CVE-2026-66046)

    * expat: Expat: XML Injection via Malformed UTF-16 Input (CVE-2026-93990)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
448299	Alpine: libexpat, multiple expat packages: security update to 2.8.5-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	2026/9/24	2026/9/24	high
448299	Alpine: libexpat, multiple expat packages: security update to 2.8.5-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	2026/9/24	2026/9/24	high
348348	Linux Distros 未修補弱點：CVE-2026-93990	Nessus	Misc.	2026/9/20	2026/9/28	high
348348	Linux Distros 未修补的漏洞：CVE-2026-93990	Nessus	Misc.	2026/9/20	2026/9/28	high
348348	Linux Distros のパッチ未適用の脆弱性: CVE-2026-93990	Nessus	Misc.	2026/9/20	2026/9/28	high
348348	Linux Distros Unpatched Vulnerability : CVE-2026-93990	Nessus	Misc.	2026/9/20	2026/9/28	high
350928	RHEL 8 : expat (RHSA-2026:72448)	Nessus	Red Hat Local Security Checks	2026/9/29	2026/9/29	high

偵測

搜尋 Plugin

high

high

high

high

high

high

high