diff --git a/pkgs/development/libraries/expat/default.nix b/pkgs/development/libraries/expat/default.nix
index 915fbf8d5498..0d52da9c0923 100644
--- a/pkgs/development/libraries/expat/default.nix
+++ b/pkgs/development/libraries/expat/default.nix
@@ -15,6 +15,13 @@ stdenv.mkDerivation rec {
       sha256 = "1i7bq9sp2k5348dvbfv26bprzv6ka1abf0j5ixjaff9alndm4f19";
       stripLen = 1;
     })
+    (fetchpatch {
+      name = "CVE-2019-15903.patch";
+      url = "https://sources.debian.org/data/main/e/expat/2.2.7-2/debian/patches/CVE-2019-15903_Deny_internal_entities_closing_the_doctype.patch";
+      sha256 = "0lv4392ihpk71fgaf1fz03gandqkaqisal8xrzvcqnvnq4mnmwxp";
+      stripLen = 1;
+      excludes = [ "tests/runtests.c" "Changes" ];
+    })
   ];
 
   outputs = [ "out" "dev" ]; # TODO: fix referrers