Critical Expat UTF-16 fix, Octavia RCE, and glibc loader flaws posted same week

Three security notices hit oss-security within a day of each other: a critical Expat release, remote code execution in OpenStack Octavia’s Amphora path, and a pair of GNU C Library dynamic-loader flaws in setuid-style binaries. Together they span a widely embedded XML parser, cloud load-balancer infrastructure, and the core C runtime on Linux.

Libexpat 2.8.5 closes CVE-2026-93990, a malformed UTF-16 decoding bug scored 9.8 by upstream. High surrogates not followed by a low surrogate were previously accepted and could be smuggled into applications that trusted Expat’s validation. The failure mode echoes CVE-2022-25235: damage depends on how the host application handled the bad input, but the library was supposed to reject it. Sebastian Pipping announced the fix with the 2.8.5 release.

OpenStack published OSSA-2026-039 for Octavia. Authenticated tenants who own a load balancer on the Amphora provider could inject HAProxy configuration through unsanitized listener and pool tls_ciphers fields and L7 redirect_url and redirect_prefix values. Chen YuXiang reported the injection; an independent researcher known as Rolix showed it yields root command execution on the amphora, theft of other tenants’ TLS keys and certificates plus the deployment heartbeat key, and reachability into the control-plane network the amphora joins. Only the Amphora provider is affected. Fixes are out for supported branches. The issues are tracked as CVE-2026-94571 and CVE-2026-94572.

The GNU C Library posted two advisories for ld.so. CVE-2026-86805 is a TOCTOU race in $ORIGIN expansion for AT_SECURE programs: the loader checks a normalized path then opens the raw path. When fs.protected_hardlinks is off, a local attacker who can hard-link a qualifying setuid or setgid binary and win a symlink swap can load attacker-controlled code with elevated privileges. Major distributions ship protected_hardlinks enabled and are mitigated by default. Jann Horn reported it. A second advisory covers a stack buffer overflow in $ORIGIN processing for AT_SECURE programs when DT_RPATH or DT_RUNPATH begins with $ORIGIN followed by a NUL or slash, risking crash or memory corruption in the loader. Both issues span long-supported glibc lines through 2.44, with fixes in newer releases.

Operators should prioritize the Expat update on any network-facing or untrusted-XML path, patch Octavia Amphora deployments before exposing tenant-controlled cipher or redirect fields, and confirm protected_hardlinks and glibc updates on hosts that still run older loaders with $ORIGIN-based RPATH setuid binaries.