Please upgrade bundled Expat to 2.6.4 (e.g. for the fix to CVE-2024-50602) · Issue #126623 · python/cpython (original) (raw)

Bug report

Bug description:

Hi! 👋

Please upgrade bundled Expat to 2.6.4 (e.g. for the fix to CVE-2024-50602).

• GitHub release: https://github.com/libexpat/libexpat/releases/tag/R_2_6_4
• Change log: https://github.com/libexpat/libexpat/blob/R_2_6_4/expat/Changes

The CPython issue for previous 2.6.3 was #123678 and the related merged main pull request was #123689, in case you want to have a look. The Dockerfile from comment #123689 (review) could be of help with raising confidence in a bump pull request when going forward.

Thanks in advance!

CPython versions tested on:

3.9, 3.10, 3.11, 3.12, 3.13, 3.14, CPython main branch

Operating systems tested on:

Linux, macOS, Windows, Other

Linked PRs

• gh-126623: Update libexpat to 2.6.4, make future updates easier #126792
• [3.13] gh-126623: Update libexpat to 2.6.4, make future updates easier (GH-126792) #126796
• [3.12] gh-126623: Update libexpat to 2.6.4, make future updates easier (GH-126792) #126797
• [3.11] gh-126623: Update libexpat to 2.6.4, make future updates easier (GH-126792) #126798
• [3.10] gh-126623: Update libexpat to 2.6.4, make future updates easier (GH-126792) #126799
• [3.9] gh-126623: Update libexpat to 2.6.4, make future updates easier (GH-126792) #126800