Every CVE Search/ Get API key

CVE-2026-6653

libxml2: Use after free in xmlParseInternalSubset via improper entity resolution handling

7.0 HighFix available

Use After Free in libxml2's xmlParseInternalSubset from GNOME libxml2 version 2.9.11 to 2.11.0 allows a remote attacker to cause a denial-of-service via maliciously crafted XML input with improper entity resolution handling.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
Low
Availability
Low

Exploit likelihood

0.36%Up 0.1 points since Jun 23, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.0

libxml2: Use after free in xmlParseInternalSubset via improper entity resolution handling

Use After Free in libxml2's xmlParseInternalSubset from GNOME libxml2 version 2.9.11 to 2.11.0 allows a remote attacker to cause a denial-of-service via maliciously crafted XML input with improper entity resolution handling.

Record
CVE-2026-6653
CVSS 4.0
7.0 HighCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Weakness
CWE-416, CWE-611
Updated
2026-11-02
EUVDEUVD-2026-38232 7.0

Use After Free in libxml2's xmlParseInternalSubset from GNOME libxml2 version 2.9.11 to 2.11.0 allows a remote attacker to cause a denial-of-service via maliciously crafted XML input with improper entity resolution handling.

Record
EUVD-2026-38232
CVSS 4.0
7.0 HighCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Updated
2026-11-02
GitHub AdvisoriesGHSA-v4qw-p44r-qhfg 7.0

Use After Free in libxml2's xmlParseInternalSubset from GNOME libxml2 version 2.9.11 to 2.11.0...

Use After Free in libxml2's xmlParseInternalSubset from GNOME libxml2 version 2.9.11 to 2.11.0 allows a remote attacker to cause a denial-of-service via maliciously crafted XML input with improper entity resolution handling.

Record
GHSA-v4qw-p44r-qhfg
CVSS 4.0
7.0 HighCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-416
Updated
2026-11-02
NVD 7.0

Use After Free in libxml2's xmlParseInternalSubset from GNOME libxml2 version 2.9.11 to 2.11.0 allows a remote attacker to cause a denial-of-service via maliciously crafted XML input with improper entity resolution handling.

Record
CVE-2026-6653
CVSS 4.0
7.0 HighCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-416, CWE-611
Updated
2026-11-02
OSVBELL-CVE-2026-6653 9.8
Record
BELL-CVE-2026-6653
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSV 7.0

libxml2: Use after free in xmlParseInternalSubset via improper entity resolution handling

Use After Free in libxml2's xmlParseInternalSubset from GNOME libxml2 version 2.9.11 to 2.11.0 allows a remote attacker to cause a denial-of-service via maliciously crafted XML input with improper entity resolution handling.

Record
CVE-2026-6653
CVSS 4.0
7.0 HighCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Weakness
CWE-416, CWE-611
Updated
2026-11-02
Show 19 moreShow less
OSVDEBIAN-CVE-2026-6653 9.8

Use After Free in libxml2's xmlParseInternalSubset from GNOME libxml2 version 2.9.11 to 2.11.0 allows a remote attacker to cause a denial-of-service via maliciously crafted XML input with improper entity resolution handling.

Record
DEBIAN-CVE-2026-6653
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVJLSEC-2026-1240 7.0

Use After Free in libxml2's xmlParseInternalSubset from GNOME libxml2 version 2.9.11 to 2.11.0 allows a remote attacker to cause a denial-of-service via maliciously crafted XML input with improper entity resolution handling.

Record
JLSEC-2026-1240
CVSS 4.0
7.0 HighCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:61247 5.9

Red Hat Security Advisory: libxml2 security update

Record
RHSA-2026:61247
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:69655 5.9

Red Hat Security Advisory: libxml2 security, bug fix, and enhancement update

Record
RHSA-2026:69655
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:61247 5.9

Moderate: libxml2 security update

The libxml2 library is a development toolbox providing the implementation of various XML standards.

Security Fix(es):

  • libxml2: mingw-libxml2: libxml2: Denial of Service via crafted XML input due to use-after-free (CVE-2026-6653)

  • libxml2: libxml2: Arbitrary code execution in xmlcatalog utility via buffer overflow (CVE-2026-11979)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:61247
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:69655 5.9

Moderate: libxml2 security, bug fix, and enhancement update

The libxml2 library is a development toolbox providing the implementation of various XML standards.

Security Fix(es):

  • libxml2: mingw-libxml2: libxml2: Denial of Service via crafted XML input due to use-after-free (CVE-2026-6653)

Bug Fix(es) and Enhancement(s):

  • libxml2: CVE-2025-9714 fix (Rocky Linux-119279) backported wrong upstream commit ? dyn:map recursion still crashes (JIRA:Rocky Linux-249282)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:69655
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-6653 7.0

Use After Free in libxml2's xmlParseInternalSubset from GNOME libxml2 version 2.9.11 to 2.11.0 allows a remote attacker to cause a denial-of-service via maliciously crafted XML input with improper entity resolution handling.

Record
UBUNTU-CVE-2026-6653
CVSS 4.0
7.0 HighCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVALSA-2026:61247 No score

Moderate: libxml2 security update

The libxml2 library is a development toolbox providing the implementation of various XML standards.

Security Fix(es):

  • libxml2: mingw-libxml2: libxml2: Denial of Service via crafted XML input due to use-after-free (CVE-2026-6653)
  • libxml2: libxml2: Arbitrary code execution in xmlcatalog utility via buffer overflow (CVE-2026-11979)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:61247
Updated
2026-11-02
OSVALSA-2026:69655 No score

Moderate: libxml2 security, bug fix, and enhancement update

The libxml2 library is a development toolbox providing the implementation of various XML standards.

Security Fix(es):

  • libxml2: mingw-libxml2: libxml2: Denial of Service via crafted XML input due to use-after-free (CVE-2026-6653)

Bug Fix(es) and Enhancement(s):

  • libxml2: CVE-2025-9714 fix (AlmaLinux-119279) backported wrong upstream commit ? dyn:map recursion still crashes (JIRA:AlmaLinux-249282)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:69655
Updated
2026-11-02
OSVCLSA-2026-1785316608 No score

libxml2: Fix of CVE-2026-6653

  • CVE-2026-6653: fix use-after-free in xmlParseInternalSubset; xmlPushInput reported EOF as failure after pushing, so the caller freed a live input
Record
CLSA-2026-1785316608
Updated
2026-11-02
OSVCLSA-2026-1785317036 No score

libxml2: Fix of CVE-2026-6653

  • CVE-2026-6653: fix use-after-free in xmlParseInternalSubset by not reporting a push failure in xmlPushInput after the input was already installed
Record
CLSA-2026-1785317036
Updated
2026-11-02
OSVCLSA-2026-1785317328 No score

libxml2: Fix of CVE-2026-6653

  • CVE-2026-6653: fix use-after-free in xmlParseInternalSubset by not reporting a push failure in xmlPushInput after the input was already installed
Record
CLSA-2026-1785317328
Updated
2026-11-02
OSVCLSA-2026-1787732374 No score

libxml2: Fix of CVE-2026-6653

  • CVE-2026-6653: fix use-after-free in xmlParseInternalSubset; xmlPushInput reported a halted parser as a push failure after the input was already installed, so the caller freed a live input
Record
CLSA-2026-1787732374
Updated
2026-11-02
OSVCLSA-2026-1789202279 No score

Fix CVE(s): CVE-2026-6653, CVE-2026-86143, CVE-2026-86144

  • SECURITY UPDATE: use-after-free in the DTD parser reachable through parameter-entity references
    • debian/patches/CVE-2026-6653.patch: drop the post-inputPush XML_PARSER_EOF early return from xmlPushInput() in parser.c. It reported an already-halted parser as a push failure after ownership of the input had been transferred, so xmlParsePEReference() freed the input still installed as ctxt->input and xmlParseInternalSubset() read through the dangling pointer. The flaw is introduced by the CVE-2021-3541 backport, not by the shipped version.
    • CVE-2026-6653
Record
CLSA-2026-1789202279
Updated
2026-11-02
OSVCLSA-2026-1789473529 No score

libxml2: Fix of CVE-2026-6653

  • CVE-2026-6653: fix use-after-free in xmlParseInternalSubset by not reporting a halted parser as an xmlPushInput failure after the input was installed
Record
CLSA-2026-1789473529
Updated
2026-11-02
OSVROOT-OS-DEBIAN-11-CVE-2026-6653 No score

CVE-2026-6653 in libxml2 - Patched by Root

Root has patched CVE-2026-6653 in the libxml2 package for Root:Debian:11. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-11-CVE-2026-6653
Updated
2026-11-02
OSVROOT-OS-DEBIAN-12-CVE-2026-6653 No score

CVE-2026-6653 in libxml2 - Patched by Root

Root has patched CVE-2026-6653 in the libxml2 package for Root:Debian:12. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-12-CVE-2026-6653
Updated
2026-11-02
OSVROOT-OS-DEBIAN-13-CVE-2026-6653 No score

CVE-2026-6653 in libxml2 - Patched by Root

Root has patched CVE-2026-6653 in the libxml2 package for Root:Debian:13. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-13-CVE-2026-6653
Updated
2026-11-02
OSVUSN-8456-1 No score

libxml2 vulnerability

Geoffrey Humphreys discovered that libxml2 had a use after free when parsing the internal subset of a DTD. A remote attacker could possibly use this issue to cause a denial of service or possibly execute arbitrary code.

Record
USN-8456-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
libxml2
AlmaLinux:9
From an advisory covering 2 CVEs
 before 2.9.13-14.el9_8.4
2.9.13-14.el9_8.4
libxml2-devel
AlmaLinux:9
From an advisory covering 2 CVEs
 before 2.9.13-14.el9_8.4
2.9.13-14.el9_8.4
python3-libxml2
AlmaLinux:9
From an advisory covering 2 CVEs
 before 2.9.13-14.el9_8.4
2.9.13-14.el9_8.4
libxml2
AlmaLinux:8
From an advisory covering 2 CVEs
 before 2.9.7-21.el8_10.8
2.9.7-21.el8_10.8
libxml2-devel
AlmaLinux:8
From an advisory covering 2 CVEs
 before 2.9.7-21.el8_10.8
2.9.7-21.el8_10.8
python3-libxml2
AlmaLinux:8
From an advisory covering 2 CVEs
 before 2.9.7-21.el8_10.8
2.9.7-21.el8_10.8
libxml2
Alpaquita:23
 2.10.3-r2 up to 2.10.4-r10
2.10.4-r10
libxml2
Alpaquita:stream
 2.10.3-r2 up to 2.11.4-r0
2.11.4-r0
libxml2
BellSoft Hardened Containers:23
 2.10.3-r2 up to 2.10.4-r10
2.10.4-r10
libxml2
BellSoft Hardened Containers:stream
 2.10.3-r2 up to 2.11.4-r0
2.11.4-r0
Show 58 moreShow less
Affected packages
PackageAffectedFixed
libxml2
TuxCare:CentOS-Stream:8
 before 2.9.7-18.el8.tuxcare.els11
2.9.7-18.el8.tuxcare.els11
libxml2-devel
TuxCare:CentOS-Stream:8
 before 2.9.7-18.el8.tuxcare.els11
2.9.7-18.el8.tuxcare.els11
libxml2-static
TuxCare:CentOS-Stream:8
 before 2.9.7-18.el8.tuxcare.els11
2.9.7-18.el8.tuxcare.els11
python3-libxml2
TuxCare:CentOS-Stream:8
 before 2.9.7-18.el8.tuxcare.els11
2.9.7-18.el8.tuxcare.els11
libxml2
TuxCare:CentOS:8.5
 before 2.9.7-9.el8_4.2.tuxcare.els16
2.9.7-9.el8_4.2.tuxcare.els16
libxml2-devel
TuxCare:CentOS:8.5
 before 2.9.7-9.el8_4.2.tuxcare.els16
2.9.7-9.el8_4.2.tuxcare.els16
libxml2-static
TuxCare:CentOS:8.5
 before 2.9.7-9.el8_4.2.tuxcare.els16
2.9.7-9.el8_4.2.tuxcare.els16
python3-libxml2
TuxCare:CentOS:8.5
 before 2.9.7-9.el8_4.2.tuxcare.els16
2.9.7-9.el8_4.2.tuxcare.els16
libxml2
TuxCare:CentOS:8.4
 before 2.9.7-9.el8_4.2.tuxcare.els16
2.9.7-9.el8_4.2.tuxcare.els16
libxml2-devel
TuxCare:CentOS:8.4
 before 2.9.7-9.el8_4.2.tuxcare.els16
2.9.7-9.el8_4.2.tuxcare.els16
libxml2-static
TuxCare:CentOS:8.4
 before 2.9.7-9.el8_4.2.tuxcare.els16
2.9.7-9.el8_4.2.tuxcare.els16
python3-libxml2
TuxCare:CentOS:8.4
 before 2.9.7-9.el8_4.2.tuxcare.els16
2.9.7-9.el8_4.2.tuxcare.els16
libxml2
TuxCare:AlmaLinux:9.6
 before 2.9.13-12.el9_6.tuxcare.els6
2.9.13-12.el9_6.tuxcare.els6
libxml2-devel
TuxCare:AlmaLinux:9.6
 before 2.9.13-12.el9_6.tuxcare.els6
2.9.13-12.el9_6.tuxcare.els6
libxml2-static
TuxCare:AlmaLinux:9.6
 before 2.9.13-12.el9_6.tuxcare.els6
2.9.13-12.el9_6.tuxcare.els6
python3-libxml2
TuxCare:AlmaLinux:9.6
 before 2.9.13-12.el9_6.tuxcare.els6
2.9.13-12.el9_6.tuxcare.els6
libxml2
TuxCare:Debian:10
From an advisory covering 4 CVEs
 before 2.9.10+dfsg-5ubuntu0.20.04.10+tuxcare.els12
2.9.10+dfsg-5ubuntu0.20.04.10+tuxcare.els12
libxml2-dev
TuxCare:Debian:10
From an advisory covering 4 CVEs
 before 2.9.10+dfsg-5ubuntu0.20.04.10+tuxcare.els12
2.9.10+dfsg-5ubuntu0.20.04.10+tuxcare.els12
libxml2-doc
TuxCare:Debian:10
From an advisory covering 4 CVEs
 before 2.9.10+dfsg-5ubuntu0.20.04.10+tuxcare.els12
2.9.10+dfsg-5ubuntu0.20.04.10+tuxcare.els12
libxml2-utils
TuxCare:Debian:10
From an advisory covering 4 CVEs
 before 2.9.10+dfsg-5ubuntu0.20.04.10+tuxcare.els12
2.9.10+dfsg-5ubuntu0.20.04.10+tuxcare.els12
python-libxml2
TuxCare:Debian:10
From an advisory covering 4 CVEs
 before 2.9.10+dfsg-5ubuntu0.20.04.10+tuxcare.els12
2.9.10+dfsg-5ubuntu0.20.04.10+tuxcare.els12
python3-libxml2
TuxCare:Debian:10
From an advisory covering 4 CVEs
 before 2.9.10+dfsg-5ubuntu0.20.04.10+tuxcare.els12
2.9.10+dfsg-5ubuntu0.20.04.10+tuxcare.els12
libxml2
TuxCare:AlmaLinux:9.2
 before 2.9.13-3.el9_2.1.tuxcare.els15
2.9.13-3.el9_2.1.tuxcare.els15
libxml2-devel
TuxCare:AlmaLinux:9.2
 before 2.9.13-3.el9_2.1.tuxcare.els15
2.9.13-3.el9_2.1.tuxcare.els15
libxml2-static
TuxCare:AlmaLinux:9.2
 before 2.9.13-3.el9_2.1.tuxcare.els15
2.9.13-3.el9_2.1.tuxcare.els15
python3-libxml2
TuxCare:AlmaLinux:9.2
 before 2.9.13-3.el9_2.1.tuxcare.els15
2.9.13-3.el9_2.1.tuxcare.els15
libxml2
Debian:12
 All versions, plus listed versions
2.12.3+dfsg-0exp12.12.5+dfsg-0exp12.12.6+dfsg-0exp12.12.6+dfsg-0exp22.12.7+dfsg+really2.9.14-0.1
Show 44 moreShow less
2.12.7+dfsg+really2.9.14-0.22.12.7+dfsg+really2.9.14-0.32.12.7+dfsg+really2.9.14-0.42.12.7+dfsg+really2.9.14-12.12.7+dfsg+really2.9.14-22.12.7+dfsg+really2.9.14-2.12.12.7+dfsg-12.12.7+dfsg-22.12.7+dfsg-32.13.1+dfsg-0exp12.13.3+dfsg-0exp12.13.3+dfsg-0exp22.14.1+dfsg-0exp12.14.2+dfsg-0exp12.14.3+dfsg-0exp12.14.3+dfsg-0exp22.14.3+dfsg-0exp32.14.4+dfsg-0exp12.14.5+dfsg-0.12.14.5+dfsg-0.22.14.5+dfsg-0exp12.14.5+dfsg-0exp22.14.6+dfsg-0.12.15.0+dfsg-0.12.15.0+dfsg-0.22.15.0+dfsg-0.32.15.1+dfsg-0.12.15.1+dfsg-0.22.15.1+dfsg-0.32.15.1+dfsg-0.42.15.1+dfsg-0.52.15.1+dfsg-12.15.1+dfsg-22.15.2+dfsg-0.12.15.3+dfsg-12.15.4+dfsg-12.9.14+dfsg-1.22.9.14+dfsg-1.32.9.14+dfsg-1.3~deb12u12.9.14+dfsg-1.3~deb12u22.9.14+dfsg-1.3~deb12u32.9.14+dfsg-1.3~deb12u42.9.14+dfsg-1.3~deb12u52.9.14+dfsg-1.3~deb12u6
 None known
libxml2
Debian:13
 All versions, plus listed versions
2.12.7+dfsg+really2.9.14-2.12.12.7+dfsg+really2.9.14-2.1+deb13u12.12.7+dfsg+really2.9.14-2.1+deb13u22.12.7+dfsg+really2.9.14-2.1+deb13u32.13.1+dfsg-0exp1
Show 26 moreShow less
2.13.3+dfsg-0exp12.13.3+dfsg-0exp22.14.1+dfsg-0exp12.14.2+dfsg-0exp12.14.3+dfsg-0exp12.14.3+dfsg-0exp22.14.3+dfsg-0exp32.14.4+dfsg-0exp12.14.5+dfsg-0.12.14.5+dfsg-0.22.14.5+dfsg-0exp12.14.5+dfsg-0exp22.14.6+dfsg-0.12.15.0+dfsg-0.12.15.0+dfsg-0.22.15.0+dfsg-0.32.15.1+dfsg-0.12.15.1+dfsg-0.22.15.1+dfsg-0.32.15.1+dfsg-0.42.15.1+dfsg-0.52.15.1+dfsg-12.15.1+dfsg-22.15.2+dfsg-0.12.15.3+dfsg-12.15.4+dfsg-1
 None known
libxml2
Debian:14
 before 2.14.5+dfsg-0.1, plus listed versions
2.12.7+dfsg+really2.9.14-2.12.13.1+dfsg-0exp12.13.3+dfsg-0exp12.13.3+dfsg-0exp22.14.1+dfsg-0exp1
Show 7 moreShow less
2.14.2+dfsg-0exp12.14.3+dfsg-0exp12.14.3+dfsg-0exp22.14.3+dfsg-0exp32.14.4+dfsg-0exp12.14.5+dfsg-0exp12.14.5+dfsg-0exp2
2.14.5+dfsg-0.1
XML2_jll
Julia
 before 2.11.5+0
2.11.5+0
libxml2-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 0:2.9.13-14.el9_8.4
0:2.9.13-14.el9_8.4
libxml2-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 0:2.9.13-14.el9_8.4
0:2.9.13-14.el9_8.4
libxml2-devel
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 0:2.9.13-14.el9_8.4
0:2.9.13-14.el9_8.4
python3-libxml2-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 0:2.9.13-14.el9_8.4
0:2.9.13-14.el9_8.4
libxml2
Red Hat:enterprise_linux:9::baseos
From an advisory covering 2 CVEs
 before 0:2.9.13-14.el9_8.4
0:2.9.13-14.el9_8.4
libxml2-debuginfo
Red Hat:enterprise_linux:9::baseos
From an advisory covering 2 CVEs
 before 0:2.9.13-14.el9_8.4
0:2.9.13-14.el9_8.4
libxml2-debugsource
Red Hat:enterprise_linux:9::baseos
From an advisory covering 2 CVEs
 before 0:2.9.13-14.el9_8.4
0:2.9.13-14.el9_8.4
python3-libxml2
Red Hat:enterprise_linux:9::baseos
From an advisory covering 2 CVEs
 before 0:2.9.13-14.el9_8.4
0:2.9.13-14.el9_8.4
python3-libxml2-debuginfo
Red Hat:enterprise_linux:9::baseos
From an advisory covering 2 CVEs
 before 0:2.9.13-14.el9_8.4
0:2.9.13-14.el9_8.4
libxml2-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:2.9.7-21.el8_10.8
0:2.9.7-21.el8_10.8
libxml2-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:2.9.7-21.el8_10.8
0:2.9.7-21.el8_10.8
libxml2-devel
Red Hat:enterprise_linux:8::appstream
 before 0:2.9.7-21.el8_10.8
0:2.9.7-21.el8_10.8
python3-libxml2-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:2.9.7-21.el8_10.8
0:2.9.7-21.el8_10.8
libxml2
Red Hat:enterprise_linux:8::baseos
 before 0:2.9.7-21.el8_10.8
0:2.9.7-21.el8_10.8
libxml2-debuginfo
Red Hat:enterprise_linux:8::baseos
 before 0:2.9.7-21.el8_10.8
0:2.9.7-21.el8_10.8
libxml2-debugsource
Red Hat:enterprise_linux:8::baseos
 before 0:2.9.7-21.el8_10.8
0:2.9.7-21.el8_10.8
python3-libxml2
Red Hat:enterprise_linux:8::baseos
 before 0:2.9.7-21.el8_10.8
0:2.9.7-21.el8_10.8
python3-libxml2-debuginfo
Red Hat:enterprise_linux:8::baseos
 before 0:2.9.7-21.el8_10.8
0:2.9.7-21.el8_10.8
libxml2
Rocky Linux:9
From an advisory covering 2 CVEs
 before 0:2.9.13-14.el9_8.4
0:2.9.13-14.el9_8.4
libxml2
Rocky Linux:8
 before 0:2.9.7-21.el8_10.8
0:2.9.7-21.el8_10.8
libxml2
Root:Debian:11
 before 2.9.10+dfsg-6.7+deb11u10.aikido.9
2.9.10+dfsg-6.7+deb11u10.aikido.9
rootio-libxml2
Root:Debian:11
 before 2.9.10+dfsg-6.7+deb11u10.aikido.9
2.9.10+dfsg-6.7+deb11u10.aikido.9
libxml2
Root:Debian:12
 before 2.9.14+dfsg-1.3~deb12u6.root.io.16
2.9.14+dfsg-1.3~deb12u6.root.io.162.9.14+dfsg-1.3~deb12u6.aikido.172.9.14+dfsg-1.3~deb12u6.aikido.182.9.14+dfsg-1.3~deb12u6.aikido.192.9.14+dfsg-1.3~deb12u6.aikido.20
rootio-libxml2
Root:Debian:12
 before 2.9.14+dfsg-1.3~deb12u6.root.io.16
2.9.14+dfsg-1.3~deb12u6.root.io.162.9.14+dfsg-1.3~deb12u6.aikido.172.9.14+dfsg-1.3~deb12u6.aikido.182.9.14+dfsg-1.3~deb12u6.aikido.192.9.14+dfsg-1.3~deb12u6.aikido.20
libxml2
Root:Debian:13
 before 2.12.7+dfsg+really2.9.14-2.1+deb13u3.aikido.14
2.12.7+dfsg+really2.9.14-2.1+deb13u3.aikido.142.12.7+dfsg+really2.9.14-2.1+deb13u3.aikido.132.12.7+dfsg+really2.9.14-2.1+deb13u3.root.io.122.12.7+dfsg+really2.9.14-2.1+deb13u3.aikido.152.12.7+dfsg+really2.9.14-2.1+deb13u3.aikido.16
rootio-libxml2
Root:Debian:13
 before 2.12.7+dfsg+really2.9.14-2.1+deb13u3.aikido.14
2.12.7+dfsg+really2.9.14-2.1+deb13u3.aikido.142.12.7+dfsg+really2.9.14-2.1+deb13u3.aikido.132.12.7+dfsg+really2.9.14-2.1+deb13u3.root.io.122.12.7+dfsg+really2.9.14-2.1+deb13u3.aikido.152.12.7+dfsg+really2.9.14-2.1+deb13u3.aikido.16
libxml2
Ubuntu:22.04:LTS
 before 2.9.13+dfsg-1ubuntu0.12, plus listed versions
2.9.12+dfsg-42.9.12+dfsg-52.9.12+dfsg-62.9.13+dfsg-12.9.13+dfsg-1build1
Show 11 moreShow less
2.9.13+dfsg-1ubuntu0.12.9.13+dfsg-1ubuntu0.22.9.13+dfsg-1ubuntu0.32.9.13+dfsg-1ubuntu0.42.9.13+dfsg-1ubuntu0.52.9.13+dfsg-1ubuntu0.62.9.13+dfsg-1ubuntu0.72.9.13+dfsg-1ubuntu0.82.9.13+dfsg-1ubuntu0.92.9.13+dfsg-1ubuntu0.102.9.13+dfsg-1ubuntu0.11
2.9.13+dfsg-1ubuntu0.12
libxml2
Ubuntu:24.04:LTS
 before 2.9.14+dfsg-1.3ubuntu3.8, plus listed versions
2.9.14+dfsg-1.32.9.14+dfsg-1.3build12.9.14+dfsg-1.3build22.9.14+dfsg-1.3build32.9.14+dfsg-1.3ubuntu1
Show 9 moreShow less
2.9.14+dfsg-1.3ubuntu22.9.14+dfsg-1.3ubuntu32.9.14+dfsg-1.3ubuntu3.12.9.14+dfsg-1.3ubuntu3.22.9.14+dfsg-1.3ubuntu3.32.9.14+dfsg-1.3ubuntu3.42.9.14+dfsg-1.3ubuntu3.52.9.14+dfsg-1.3ubuntu3.62.9.14+dfsg-1.3ubuntu3.7
2.9.14+dfsg-1.3ubuntu3.8

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-6653 is a high vulnerability (CVSS 7.0) in Gnome Libxml2, published June 22, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.36%, the 29th percentile. Fixed in libxml2 2.10.4-r10.

References

Show 33 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open