Hartwork Blog

Expat 2.7.5 released, includes security fixes

Sebastian Pipping — Tue, 17 Mar 2026 18:26:00 GMT

For readers new to Expat:

libexpat is a fast streaming XML parser. Alongside libxml2, Expat is one of the most widely used software libre XML parsers written in C, specifically C99. It is cross-platform and licensed under the MIT license.

Expat 2.7.5 was released earlier today. The key motivation for cutting a release and doing so now is three security fixes:

CVE-2026-32776 — NULL pointer dereference (CWE-476)
CVE-2026-32777 — infinite loop (CWE-835)
CVE-2026-32778 — NULL pointer dereference (CWE-476)

The first NULL pointer dereference was reported and fixed by Francesco Bertolaccini of Trail of Bits with help from their AI tool Buttercup.

The infinite loop denial of service issue was uncovered by Google ClusterFuzz through continuesly fuzzing with xml_lpm_fuzzer that Mark Brand of Project Zero and I teamed up on in the past for Expat 2.7.0. Berkay Eren Ürün and I teamed up for analysis and a fix under a 90 day disclosure deadline.

The second NULL pointer dereference was reported by Christian Ng, and he and I teamed up on a fix.

So much for the fixed vulnerabilities. There are also three known unfixed security issues remaining in libexpat, and there is a GitHub issue listing known unfixed security issues in libexpat for anyone interested.

Thanks to everyone who contributed to this release of Expat!

For more details about this release, please check out the change log.

If you maintain Expat packaging, a bundled copy of Expat, or a pinned version of Expat, please update to version 2.7.5. Thank you!

Sebastian Pipping

Learn from me!

Sebastian Pipping — Sun, 08 Feb 2026 14:41:56 GMT

Not too long ago, someone literally asked me what they "could learn from me", and that question has stuck with me since.

One thing it made me do was label about 30 earlier blog posts in a new blog topic "Learn from me" that contains posts I consider to be teaching something, be at least somewhat timeless, and be somewhat unique to this blog of mine — posts like:

Maybe more importantly though, there are some non-IT learnings that I would like to share with you now for a draft answer to that question "What can you (potentially) learn from me?" below:

Sometimes "throwing 50 bucks at it" is a good solution to a problem if you can.
Especially when you experienced poverty or near-poverty and were lucky to grew out of it later, there can be learned resistance to spend (reasonable) amounts of money to solve a problem. When you have an okay salary, spending ten hours on a problem, that does not give you joy and could be solve with spending (or giving up on gaining) 50 bucks can be worth reconsideration. (There is one particular person that learned this from me.)
Pay attention to what people did not say.
Sometimes people use particular wording or omit things where a closer look reveals that their omission, them not saying it differently, reveals a hidden truth that they did not intend to share. Ask yourself: Why did they say it this way? What is that difference saying? What are they not saying?
Meaning depends on the right level of zoom.
What do I mean? Activities like watering a plant can have meaning if your zoom level is a garden or the humans around that plant every day. If you zoom out too far or even up to universe level, the plant and these humans become a bunch of cells that lack any meaning. Zooming out to far destroys meaning and zooming in allows finding or creating meaning. Be mindful of the right zoom level.
You can be one in a houndred and still not be wrong.
Just because everyone else says something is true does not make it true. Just because it's written in a book or told by a professor does not make it true. Trust in that possibility that you could be right. (From personal experience.)
Be kind to service personnel.
It takes five positive things to outweigh one negative, and then… who is making up for the bad-day customers before you? Authentically be that someone if you can, pay it forward.
The word "must" is hardly ever true.
When someone says they "must" do something, it's almost always they "want" or decide to do it but are afraid to take responsibility. Pay attention to use of the word "must" (and its siblings "have to", "must not" and "cannot") and try to be true about what you "must" or "want" to do. (Learned from Marshall B. Rosenberg.)

If you learned something here or would like to share your own answer, please find me at sebastian@pipping.org.

I will likely edit this post over time. Please be invited to bookmark it and return later 👋

Best, Sebastian

Expat 2.7.4 released, includes security fixes

Sebastian Pipping — Sat, 31 Jan 2026 12:44:12 GMT

For readers new to Expat:

libexpat is a fast streaming XML parser. Alongside libxml2, Expat is one of the most widely used software libre XML parsers written in C, specifically C99. It is cross-platform and licensed under the MIT license.

Expat 2.7.4 was released earlier today. The key motivation for cutting a release and doing so now is two security fixes:

CVE-2026-24515 — NULL pointer dereference (CWE-476)
CVE-2026-25210 — integer overflow (CWE-190)

The NULL pointer dereference finding and fix were contributed by Artiphishell Inc., and originated in AI.

Another highlight in this release is the introduction of (off-by-default) symbol versioning which Gordon Messmer of Fedora and I teamed up for. If you have seen things like @@GLIBC_2.42 before, it's that same kind of symbol versioning. The rest of the release consists of a mix of minor improvements and fixes, particularly to both build systems, documentation, and infrastructure.

Thanks to everyone who contributed to this release of Expat!

For more details about this release, please check out the change log.

If you maintain Expat packaging, a bundled copy of Expat, or a pinned version of Expat, please update to version 2.7.4. Thank you!

Sebastian Pipping

Fwd: The "60 Minutes" segment about the CECOT prison that was pulled last minute

Sebastian Pipping — Wed, 31 Dec 2025 20:24:47 GMT

When I tried watching The 60 Minutes Story The Trump Administration Doesn't Want You To See from my bookmarks today, I got error…

Video unavailable

This video is no longer available due to a copyright claim by Paramount Global companies[.]

…and so below you can find a re-upload if you also are curious what the pulled video is about:

Original title: The 60 Minutes story the Trump regime did not want you to see

For additional context:

Original title: Chris Murphy: Trump Has Taken 'Editorial Control Of CBS' After 60 Minutes Pulls Critical Segment

Fwd: In memory of GM Daniel "Danya" Naroditsky

Sebastian Pipping — Wed, 29 Oct 2025 00:35:33 GMT

Wikipedia: Daniel Naroditsky

Original title: In memory of Daniel Naroditsky ❤️

Original title: David Howell on his friend Daniel Naroditsky passing away

Original title: Justice for Grandmaster Daniel Naroditsky.

Fwd: Python: The Documentary | An origin story

Sebastian Pipping — Fri, 03 Oct 2025 22:59:02 GMT

Python: The Documentary | An origin story

Expat 2.7.3 released, includes security fixes

Sebastian Pipping — Wed, 24 Sep 2025 20:23:45 GMT

For readers new to Expat:

libexpat is a fast streaming XML parser. Alongside libxml2, Expat is one of the most widely used software libre XML parsers written in C, specifically C99. It is cross-platform and licensed under the MIT license.

Expat 2.7.3 was released earlier today. The key motivation for cutting a release and doing so now is the two regressions fixed with earlier security fixes:

The original fix for vulnerability CVE-2024-8176 in Expat 2.7.0 turned out to cause false reports as well-formed for some malformed documents that should have been rejected with error XML_ERROR_ASYNC_ENTITY.
The original fix for vulnerability CVE-2025-59375 in Expat 2.7.2 turned out to have portability issues with regard to some non-amd64 architectures (e.g. sparc32).

While neither of these fixes is known to have a security impact, they should be of particular interest to distributors who backported one or more of the original fixes.

The rest of the release consists of a mix of minor improvements and fixes, particularly in documentation and infrastructure.

Thanks to everyone who contributed to this release of Expat!

For more details about this release, please check out the change log.

If you maintain Expat packaging, a bundled copy of Expat, or a pinned version of Expat, please update to version 2.7.3. Thank you!

Sebastian Pipping

Fwd: Jimmy Kimmel is Back!

Sebastian Pipping — Wed, 24 Sep 2025 16:07:05 GMT

Original title: Jimmy Kimmel is Back!

Fwd: Linkin Park - The Emptiness Machine (Acoustic Version)

Sebastian Pipping — Sun, 21 Sep 2025 22:43:24 GMT

Original title: Linkin Park - The Emptiness Machine (stripped-down version), live at EastWest Studios

Original title: The Emptiness Machine (Acoustic ~~Cover~~) 4K 60 FPS - Linkin Park

Fwd: David Letterman on the Future of Free Speech

Sebastian Pipping — Sun, 21 Sep 2025 22:13:38 GMT

Original title: David Letterman on the Future of Free Speech | The Atlantic Festival 2025