Expat is a stream-oriented XML 1.0 parser library written in C.
Expat is a typical, widely used open-source library that is integrated into countless software and hardware applications.
In the city of Munich alone, it is installed on at least 2,700 Linux servers (as detected by a scanner). For example, our default browser Firefox, QGIS, WinSCP, Audacity, and Python use libexpat. But it's also used in proprietary software, such as our Web Application Firewall.
Open Source Sabbatical
In the second half of 2026, we will be offering an Open Source Sabbatical to the maintainer of Expat. In addition to general software maintenance and further development, the following priorities will be addressed:
- Fix already known and unfixed security vulnerabilities.
- Addressing additional security vulnerabilities reported as part of the current flood of security analyses.
- Support for XML 1.0r5.
- Improving the maintainability of Expat (e.g. more code documentation, improving the test suite)