diff --git a/changelog/security/2024-10-02-expat-backport.md b/changelog/security/2024-10-02-expat-backport.md
new file mode 100644
index 00000000000..c0b76856e2c
--- /dev/null
+++ b/changelog/security/2024-10-02-expat-backport.md
@@ -0,0 +1 @@
+- expat ([CVE-2024-45490](https://nvd.nist.gov/vuln/detail/CVE-2024-45490))
diff --git a/changelog/updates/2024-10-02-expat-backport.md b/changelog/updates/2024-10-02-expat-backport.md
new file mode 100644
index 00000000000..eab56d37b06
--- /dev/null
+++ b/changelog/updates/2024-10-02-expat-backport.md
@@ -0,0 +1 @@
+- expat ([2.6.3](https://github.com/libexpat/libexpat/blob/R_2_6_3/expat/Changes))
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/expat/Manifest b/sdk_container/src/third_party/portage-stable/dev-libs/expat/Manifest
index d78c6592adc..5d7d530e831 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/expat/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/expat/Manifest
@@ -2,3 +2,4 @@ DIST expat-2.5.0.tar.xz 460560 BLAKE2B 670298d076ff3b512a0212170d40cb04c601a11d6
 DIST expat-2.6.0.tar.xz 483448 BLAKE2B 2f0117317bde4e03d8662bcac1ff6c2bbb1af694846b21a82ac12d11ccd43032b481af72fa35298c3cb19b7426dba6a67e703904ca7b05663ffd854a42348bd0 SHA512 d6f1c4a1a2ec8ffc04c04d6767cc8dd7dea3d132d10b8a2c45c5bfb405893c75db032b87a56cc88300b61c961dd7f9782b93aa74dddc7e66f25acb0c6c82b1fd
 DIST expat-2.6.1.tar.xz 484000 BLAKE2B 21a177ae8d70ca1bf41cae75c299a3021a9fc1b9d5eb01eb2945b16d7b24dcbeabad855379bdd8a14de804e1a1648105ce03b505f68c2beb4096a81020e35848 SHA512 fcd7e04e9411799c48b7d08ea07808a0809d034453a0649d9a79ed09000f1a11e5082a034089fc0c0acd2789e85bdf1deb2a94d8e3e33791bbfed66ce7207bcc
 DIST expat-2.6.2.tar.xz 485236 BLAKE2B aae019270e1ab233fe8480b7eaa77f648f23ef3383dc772dc946cb13163067431716dc5446862eb502315fd089f2f52f3d476589b74a97e462575cd54df44db4 SHA512 47b60967d6346d330dded87ea1a2957aa7d34dd825043386a89aa131054714f618ede57bfe97cf6caa40582a4bc67e198d2a915e7d8dbe8ee4f581857c2e3c2e
+DIST expat-2.6.3.tar.xz 485600 BLAKE2B b8e0a0e779f0f136eaca91115cbbcf5a5cca457cab1cca6f8d6141151d19f8ef2dccb41b0e9134459c1e7d99cb2e0b4ce3922d2bd9221002ec43fe9d53a0084a SHA512 e02c4ad88f9d539258aa1c1db71ded7770a8f12c77b5535e5b34f040ae5b1361ef23132f16d96bdb7c096a83acd637a7c907916bdfcc6d5cfb9e35d04020ca0b
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/expat/expat-2.5.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/expat/expat-2.5.0.ebuild
index 16e5df51189..147a248aae0 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/expat/expat-2.5.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/expat/expat-2.5.0.ebuild
@@ -12,7 +12,7 @@ SRC_URI="https://github.com/libexpat/libexpat/releases/download/R_${PV//\./_}/ex
 
 LICENSE="MIT"
 SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="examples static-libs test unicode"
 RESTRICT="!test? ( test )"
 BDEPEND="unicode? ( ${AUTOTOOLS_DEPEND} )"
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/expat/expat-2.6.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/expat/expat-2.6.0.ebuild
index 62135af6a17..6831ba968e9 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/expat/expat-2.6.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/expat/expat-2.6.0.ebuild
@@ -12,7 +12,7 @@ SRC_URI="https://github.com/libexpat/libexpat/releases/download/R_${PV//\./_}/ex
 
 LICENSE="MIT"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="examples static-libs test unicode"
 RESTRICT="!test? ( test )"
 BDEPEND="unicode? ( ${AUTOTOOLS_DEPEND} )"
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/expat/expat-2.6.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/expat/expat-2.6.1.ebuild
index 0eded1ee056..c156f565c7a 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/expat/expat-2.6.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/expat/expat-2.6.1.ebuild
@@ -12,7 +12,7 @@ SRC_URI="https://github.com/libexpat/libexpat/releases/download/R_${PV//\./_}/ex
 
 LICENSE="MIT"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="examples static-libs test unicode"
 RESTRICT="!test? ( test )"
 BDEPEND="unicode? ( ${AUTOTOOLS_DEPEND} )"
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/expat/expat-2.6.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/expat/expat-2.6.2.ebuild
index 0eded1ee056..c156f565c7a 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/expat/expat-2.6.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/expat/expat-2.6.2.ebuild
@@ -12,7 +12,7 @@ SRC_URI="https://github.com/libexpat/libexpat/releases/download/R_${PV//\./_}/ex
 
 LICENSE="MIT"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="examples static-libs test unicode"
 RESTRICT="!test? ( test )"
 BDEPEND="unicode? ( ${AUTOTOOLS_DEPEND} )"
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/expat/expat-2.6.3.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/expat/expat-2.6.3.ebuild
new file mode 100644
index 00000000000..f3d1a9a1a4d
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/expat/expat-2.6.3.ebuild
@@ -0,0 +1,100 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+AUTOTOOLS_AUTO_DEPEND=no
+inherit autotools multilib-minimal
+
+DESCRIPTION="Stream-oriented XML parser library"
+HOMEPAGE="https://libexpat.github.io/"
+SRC_URI="https://github.com/libexpat/libexpat/releases/download/R_${PV//\./_}/expat-${PV}.tar.xz"
+
+LICENSE="MIT"
+SLOT="0"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+IUSE="examples static-libs test unicode"
+RESTRICT="!test? ( test )"
+BDEPEND="unicode? ( ${AUTOTOOLS_DEPEND} )"
+
+DOCS=( README.md )
+
+QA_CONFIG_IMPL_DECL_SKIP=(
+	# https://bugs.gentoo.org/906384
+	arc4random
+	arc4random_buf
+)
+
+src_prepare() {
+	default
+
+	# fix interpreter to be a recent/good shell
+	sed -i -e "1s:/bin/sh:${BASH}:" conftools/get-version.sh || die
+	if use unicode; then
+		cp -R "${S}" "${S}"w || die
+		pushd "${S}"w >/dev/null
+		find -name Makefile.am \
+			-exec sed \
+			-e 's,libexpat\.la,libexpatw.la,' \
+			-e 's,libexpat_la,libexpatw_la,' \
+			-i {} + || die
+		eautoreconf
+		popd >/dev/null
+	fi
+}
+
+multilib_src_configure() {
+	local myconf="$(use_with test tests) $(use_enable static-libs static) --without-docbook"
+
+	mkdir -p "${BUILD_DIR}"w || die
+
+	if use unicode; then
+		pushd "${BUILD_DIR}"w >/dev/null
+		CPPFLAGS="${CPPFLAGS} -DXML_UNICODE" ECONF_SOURCE="${S}"w econf ${myconf}
+		popd >/dev/null
+	fi
+
+	ECONF_SOURCE="${S}" econf ${myconf}
+}
+
+multilib_src_compile() {
+	emake
+
+	if use unicode; then
+		pushd "${BUILD_DIR}"w >/dev/null
+		emake -C lib
+		popd >/dev/null
+	fi
+}
+
+multilib_src_install() {
+	emake install DESTDIR="${D}"
+
+	if use unicode; then
+		pushd "${BUILD_DIR}"w >/dev/null
+		emake -C lib install DESTDIR="${D}"
+		popd >/dev/null
+
+		pushd "${ED}"/usr/$(get_libdir)/pkgconfig >/dev/null
+		cp expat.pc expatw.pc
+		sed -i -e '/^Libs/s:-lexpat:&w:' expatw.pc || die
+		popd >/dev/null
+	fi
+}
+
+multilib_src_install_all() {
+	einstalldocs
+
+	doman doc/xmlwf.1
+
+	# Note: Use of HTML_DOCS would add unwanted "doc" subfolder
+	docinto html
+	dodoc doc/*.{css,html}
+
+	if use examples; then
+		docinto examples
+		dodoc examples/*.c
+		docompress -x usr/share/doc/${PF}/examples
+	fi
+
+	find "${D}" -name '*.la' -type f -delete || die
+}