CVE-2026-1757

A flaw was identified in the interactive shell of the xmllint utility, part of the libxml2 project, where memory allocated for user input is not properly released under certain conditions. When a user submits input consisting only of whitespace, the program skips command execution but fails to free the allocated buffer. Repeating this action causes memory to continuously accumulate. Over time, this can exhaust system memory and terminate the xmllint process, creating a denial-of-service condition on the local system.

This library allows to manipulate XML files. It includes support to read, modify and write XML and HTML files. There is DTDs support this includes parsing and validation even with complex DtDs, either at parse time or later once the document has been modified. The output can be a simple SAX stream or and in-memory DOM like representations. In this case one can use the built-in XPath and XPointer implementation to select sub nodes or ranges. A flexible Input/Output mechanism is available, with existing HTTP and FTP modules and combined to an URI library.

Security Fix(es):

A flaw was identified in the interactive shell of the xmllint utility, part of the libxml2 project, where memory allocated for user input is not properly released under certain conditions. When a user submits input consisting only of whitespace, the program skips command execution but fails to free the allocated buffer. Repeating this action causes memory to continuously accumulate. Over time, this can exhaust system memory and terminate the xmllint process, creating a denial-of-service condition on the local system.(CVE-2026-1757)

Root has patched CVE-2026-1757 in the rootio-libxml2 package for Root:Debian:12. Multiple fixed versions available.

A flaw was identified in the interactive shell of the xmllint utility, part of the libxml2 project, where memory allocated for user input is not properly released under certain conditions. When a user submits input consisting only of whitespace, the program skips command execution but fails to free the allocated buffer. Repeating this action causes memory to continuously accumulate. Over time, this can exhaust system memory and terminate the xmllint process, creating a denial-of-service condition on the local system.

• CVE-2024-34459: fix buffer over-read in xmlHTMLPrintFileContext in xmllint
• CVE-2025-8732: fix stack overflow from self-referencing SGML CATALOG entries
• CVE-2026-0989: add RelaxNG include recursion limit
• CVE-2026-0990: prevent infinite recursion in xmlCatalogListXMLResolveURI
• CVE-2026-0992: ignore repeated nextCatalog entries in XML catalog parsing
• CVE-2026-1757: fix memory leak in xmllint interactive shell

• CVE-2023-45322: fix use-after-free in xmlStaticCopyNodeList when copying DTDs
• CVE-2024-34459: fix buffer over-read in xmlHTMLPrintFileContext in xmllint
• CVE-2025-6170: fix potential buffer overflows in xmllint interactive shell
• CVE-2025-8732: fix stack overflow from self-referencing SGML CATALOG entries
• CVE-2026-0989: add RelaxNG include recursion limit
• CVE-2026-0990: prevent infinite recursion in xmlCatalogListXMLResolveURI
• CVE-2026-0992: ignore repeated nextCatalog entries in XML catalog parsing
• CVE-2026-1757: fix memory leak in xmllint interactive shell

These are all security issues fixed in the libxml2-16-2.14.5-3.1 package on the GA media of openSUSE Tumbleweed.

This update for libxml2, libxslt fixes the following issues:

Changes in libxml2:

• CVE-2026-0990: call stack overflow may lead to application crash due to infinite recursion in xmlCatalogXMLResolveURI (bsc#1256807, bsc#1256811).
• CVE-2026-0992: excessive resource consumption when processing XML catalogs due to exponential behavior when handling nextCatalog elements (bsc#1256809, bsc#1256812).
• CVE-2025-8732: infinite recursion in catalog parsing functions when processing malformed SGML catalog files (bsc#1247858).
• CVE-2026-1757: memory leak in the xmllint interactive shell (bsc#1257594, bsc#1257595).
• CVE-2025-10911: parsing xsl nodes may lead to use-after-free with key data stored cross-RVT (bsc#1250553)

This update for libxml2 fixes the following issues:

• CVE-2026-0990: Fixed a call stack overflow leading to application crash due to infinite recursion in xmlCatalogXMLResolveURI. (bsc#1256807, bsc#1256811)
• CVE-2026-0992: Fixed an excessive resource consumption when processing XML catalogs due to exponential behavior. (bsc#1256809, bsc#1256812)
• CVE-2026-1757: Fixed a memory leak in the xmllint interactive shell. (bsc#1257594, bsc#1257595)
• CVE-2025-10911: Fixed a use-after-free with key data stored cross-RVT. (bsc#1250553)

This update for libxml2 fixes the following issues:

• CVE-2026-0990: Fixed a call stack overflow leading to application crash due to infinite recursion in xmlCatalogXMLResolveURI. (bsc#1256807, bsc#1256811)
• CVE-2026-0992: Fixed an excessive resource consumption when processing XML catalogs due to exponential behavior. (bsc#1256809, bsc#1256812)
• CVE-2026-1757: Fixed a memory leak in the xmllint interactive shell. (bsc#1257594, bsc#1257595)
• CVE-2025-10911: Fixed a use-after-free with key data stored cross-RVT. (bsc#1250553)
• CVE-2025-8732: Fixed an infinite recursion in catalog parsing functions when processing malformed SGML catalog files. (bsc#1247858)

This update for libxml2 fixes the following issues:

• CVE-2026-0990: Fixed a call stack overflow leading to application crash due to infinite recursion in xmlCatalogXMLResolveURI. (bsc#1256807, bsc#1256811)
• CVE-2026-0992: Fixed an excessive resource consumption when processing XML catalogs due to exponential behavior. (bsc#1256809, bsc#1256812)
• CVE-2026-1757: Fixed a memory leak in the xmllint interactive shell. (bsc#1257594, bsc#1257595)
• CVE-2025-10911: Fixed a use-after-free with key data stored cross-RVT. (bsc#1250553)
• CVE-2025-8732: Fixed an infinite recursion in catalog parsing functions when processing malformed SGML catalog files. (bsc#1247858)
• CVE-2026-0989: Fixe a call stack exhaustion leading to application crash due to RelaxNG parser not limiting the recursion depth. (bsc#1256805, bsc#1256810)

This update for libxml2 fixes the following issues:

• CVE-2026-0990: Fixed a call stack overflow leading to application crash due to infinite recursion in xmlCatalogXMLResolveURI. (bsc#1256807, bsc#1256811)
• CVE-2026-0992: Fixed an excessive resource consumption when processing XML catalogs due to exponential behavior. (bsc#1256809, bsc#1256812)
• CVE-2026-1757: Fixed a memory leak in the xmllint interactive shell. (bsc#1257594, bsc#1257595)
• CVE-2025-10911: Fixed a use-after-free with key data stored cross-RVT. (bsc#1250553)
• CVE-2026-0989: Fixe a call stack exhaustion leading to application crash due to RelaxNG parser not limiting the recursion depth. (bsc#1256805, bsc#1256810)

This update for libxml2 fixes the following issues:

• CVE-2026-0990: Fixed a call stack overflow leading to application crash due to infinite recursion in xmlCatalogXMLResolveURI. (bsc#1256807, bsc#1256811)
• CVE-2026-0992: Fixed an excessive resource consumption when processing XML catalogs due to exponential behavior. (bsc#1256809, bsc#1256812)
• CVE-2026-1757: Fixed a memory leak in the xmllint interactive shell. (bsc#1257594, bsc#1257595)
• CVE-2025-10911: Fixed a use-after-free with key data stored cross-RVT. (bsc#1250553)

This update for libxml2, libxslt fixes the following issues:

Changes in libxml2:

• CVE-2026-0990: call stack overflow may lead to application crash due to infinite recursion in xmlCatalogXMLResolveURI (bsc#1256807, bsc#1256811).
• CVE-2026-0992: excessive resource consumption when processing XML catalogs due to exponential behavior when handling nextCatalog elements (bsc#1256809, bsc#1256812).
• CVE-2025-8732: infinite recursion in catalog parsing functions when processing malformed SGML catalog files (bsc#1247858).
• CVE-2026-1757: memory leak in the xmllint interactive shell (bsc#1257594, bsc#1257595).
• CVE-2025-10911: parsing xsl nodes may lead to use-after-free with key data stored cross-RVT (bsc#1250553)

This update for libxml2, libxslt fixes the following issues:

Changes in libxml2:

• CVE-2026-0990: call stack overflow may lead to application crash due to infinite recursion in xmlCatalogXMLResolveURI (bsc#1256807, bsc#1256811).
• CVE-2026-0992: excessive resource consumption when processing XML catalogs due to exponential behavior when handling nextCatalog elements (bsc#1256809, bsc#1256812).
• CVE-2025-8732: infinite recursion in catalog parsing functions when processing malformed SGML catalog files (bsc#1247858).
• CVE-2026-1757: memory leak in the xmllint interactive shell (bsc#1257594, bsc#1257595).
• CVE-2025-10911: parsing xsl nodes may lead to use-after-free with key data stored cross-RVT (bsc#1250553)

This update for libxslt, libxml2 fixes the following issues:

libxml2:

• CVE-2026-0990: call stack overflow leading to application crash due to infinite recursion in xmlCatalogXMLResolveURI (bsc#1256807, bsc#1256811)

• CVE-2026-0992: excessive resource consumption when processing XML catalogs due to exponential behavior when handling <nextCatalog> elements (bsc#1256808, bsc#1256809, bsc#1256812)

• CVE-2025-8732: infinite recursion in catalog parsing functions when processing malformed SGML catalog files (bsc#1247858, bsc#1247850)

• CVE-2026-1757: memory leak in the xmllint interactive shell (bsc#1257593, bsc#1257594, bsc#1257595)

• CVE-2025-10911: use-after-free with key data stored cross-RVT (bsc#1250553)

• CVE-2026-0989: call stack exhaustion leading to application crash due to RelaxNG parser not limiting the recursion depth when resolving <include> directives (bsc#1256804, bsc#1256805, bsc#1256810)

libxslt:

• CVE-2025-10911 will be fixed on libxml2 side instead [bsc#1250553]

This update for libxslt, libxml2 fixes the following issues:

Changes in libxml2:

• CVE-2026-0990: call stack overflow may lead to application crash due to infinite recursion in xmlCatalogXMLResolveURI (bsc#1256807, bsc#1256811).
• CVE-2026-0992: excessive resource consumption when processing XML catalogs due to exponential behavior when handling nextCatalog elements (bsc#1256809, bsc#1256812).
• CVE-2025-8732: infinite recursion in catalog parsing functions when processing malformed SGML catalog files (bsc#1247858).
• CVE-2026-1757: memory leak in the xmllint interactive shell (bsc#1257594, bsc#1257595).
• CVE-2025-10911: parsing xsl nodes may lead to use-after-free with key data stored cross-RVT (bsc#1250553).

It was discovered that libxml2 did not properly release memory allocated in the xmllint utility. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-1757)

A type confusion vulnerability was found in libxml2 when processing a specially crafted XML document. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-6732)