Re: libexpat 2.8.2 regression affecting large Subversion checkouts on Windows and 32-bit platforms (fixed in 2.8.3)

Den ons 12 aug. 2026 kl 14:36 skrev Evgeny Kotkov via dev <
[email protected]>:

> Hi all,
>
> This is a small heads-up for those who use or package Apache Subversion.
>
> Subversion internally uses libexpat to parse the XML responses.  libexpat
> version 2.8.2 (released Jun 25 2026) contains a regression that can cause
> unexpected "Malformed XML: out of memory" errors on Windows (x86 and x64)
> and 32-bit platforms with large XML responses.
>
> An example of such issue would be a checkout that uses bulk-style updates
> with an overall size of more than 2 GB:
>
>   svn co https://svn.example.com/files wc
>   A    wc\2gb.iso
>   svn: E175009: The XML response contains invalid XML
>   svn: E130003: Malformed XML: out of memory at line 129
>
> This regression has been fixed in libexpat 2.8.3.  So if you are packaging
> Apache Subversion with libexpat 2.8.2, consider updating to the fixed
> version.
>
> More details on the issue can be found here:
> - https://github.com/libexpat/libexpat/issues/1297
> - https://github.com/libexpat/libexpat/releases/tag/R_2_8_3
> - https://blog.hartwork.org/posts/expat-2-8-3-released/
>
> Information about use of bulk-style updates in Subversion can be found
> here:
> -
> https://subversion.apache.org/docs/release-notes/1.8.html#serf-skelta-default
>
>
> Thanks,
> Evgeny Kotkov
>

Thanks for the heads-up. TortoiseSVN was affected (I updated to Expat 2.8.2
some weeks ago in anticipation for 1.15), now we are at 2.8.3.

Kind regards,
Daniel