1. Forum
  2. Newsgroups
  3. comp.lang.ada

  • XML/Ada SEC.XMLADA-0008-v2 AdaCore security advisory

    From Alastair Hogge@[email protected] to comp.lang.ada on Sun Aug 30 10:52:00 2026
    From Newsgroup: comp.lang.ada

    Hello all,

    Regarding the XML/Ada[1] advisory from AdaCore, they mention that the mitigation is to update to 27.0, however I cannot find this branch or release/tag upstream. I emailed info@, and [email protected] for advice
    1 week ago and have not had a response, I am also not sure if those are
    the correct contacts for such queries.

    Does anyone have any idea if 27.0 is pubically avaiable and if there are problems with version mismatches between XML/Ada-27.0, the rest of the GNATColl Stack and GPRbuild, which are at 26.2?

    1:
    https://docs.adacore.com/corp/security-advisories/SEC.XMLADA-0008-v2.pdf
    --
    To health and anarchy,
    Alastair
    --- Synchronet 3.22a-Linux NewsLink 1.2
  • From =?UTF-8?B?QmrDtnJu?= Persson@[email protected] to comp.lang.ada on Sun Aug 30 20:41:21 2026
    From Newsgroup: comp.lang.ada

    Alastair Hogge wrote:
    Regarding the XML/Ada[1] advisory from AdaCore, they mention that the mitigation is to update to 27.0, however I cannot find this branch or release/tag upstream.
    Me neither. On Github I see commits related to the Gnatcoll Core vulnerabilities that were disclosed around the same time, but for
    XMLada they seem to be withholding any commits made since January.
    If Adacore continue their usual pattern, we can expect a version 27
    sometime in October or November. Until then, I guess your options are
    to dive into the code to find the bug and fix it yourself, or avoid
    processing any untrusted XML data.
    I'd be interested in a patch to apply to the Fedora package, if
    somebody has one.
    Björn Persson
    --- Synchronet 3.22a-Linux NewsLink 1.2
  • From Alastair Hogge@[email protected] to comp.lang.ada on Mon Nov 2 00:20:06 2026
    From Newsgroup: comp.lang.ada

    On Sun, 30 Aug 2026 20:41:21 +0200, Björn Persson wrote:

    Alastair Hogge wrote:
    Regarding the XML/Ada[1] advisory from AdaCore, they mention that the
    mitigation is to update to 27.0, however I cannot find this branch or
    release/tag upstream.

    Me neither. On Github I see commits related to the Gnatcoll Core vulnerabilities that were disclosed around the same time, but for XMLada
    they seem to be withholding any commits made since January.

    If Adacore continue their usual pattern, we can expect a version 27
    sometime in October or November. Until then, I guess your options are to
    dive into the code to find the bug and fix it yourself, or avoid
    processing any untrusted XML data.

    I'd be interested in a patch to apply to the Fedora package, if somebody
    has one.

    Björn Persson

    Looks like release/27.1 was branched 2 weeks ago: https://github.com/AdaCore/xmlada/branches
    --
    To health and anarchy,
    Alastair
    --- Synchronet 3.22a-Linux NewsLink 1.2