Uses vulnerable version 2.7.1 of libexpat
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 72/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Active
- Tech stack
- zig
- Domain
- build-system, security
Research direction
Open build.zig.zon at lines 3-7 and inspect how libexpat 2.7.1 is pinned. Run the supplied git diff command against the Expat release tags to review the listed CVEs and identify an appropriate newer release. Done means the bundle no longer uses 2.7.1 and points to a reviewed release with the vulnerable changes addressed.
Written by the indexing model from the issue text.
Description
Hi!
I found a vulnerable outdated bundle of libexpat 2.7.1 in here at…
Based on a quick…
# git diff R_2_7_1 R_2_8_4 -- Changes | grep '^+' | grep -o 'CVE-[0-9-]\+' | sed 's,^,- ,' | sort -u
…I believe the list of unfixed CVEs is this, if you'd like to have a closer look:
- CVE-2024-8176
- CVE-2025-59375
- CVE-2026-24515
- CVE-2026-25210
- CVE-2026-32776
- CVE-2026-32777
- CVE-2026-32778
- CVE-2026-41080
- CVE-2026-45186
- CVE-2026-50219
- CVE-2026-56131
- CVE-2026-56132
- CVE-2026-56403
- CVE-2026-56404
- CVE-2026-56405
- CVE-2026-56406
- CVE-2026-56407
- CVE-2026-56408
- CVE-2026-56409
- CVE-2026-56410
- CVE-2026-56411
- CVE-2026-56412
- CVE-2026-66046
- CVE-2026-72522
- CVE-2026-76641
- CVE-2026-76956
- CVE-2026-76957
Are you aware of this issue?
Best, Sebastian
PS: The next release of Expat is likely upcoming next week.
- Dominant language
- Zig
- Stars
- 3
- Forks
- 1
- PR merge metrics
- No merged PRs in 30d
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Similar issues
-
type/automation type/tech-debt
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
priority: p3
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
googleapis/librarian#7636 ·
-
package-update
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
oSoWoSo/vOid_Community_repOsitory#147 · 1 comment ·
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
-
agentic-workflows cascade-suspected
Difficulty 1/5 Under an hour Newbie friendliness 88/100