CVE-2026-6732
Libxml2: libxml2: denial of service via crafted xsd-validated document
A flaw was found in libxml2. This vulnerability occurs when the library processes a specially crafted XML Schema Definition (XSD) validated document that includes an internal entity reference. An attacker could exploit this by providing a malicious document, leading to a type confusion error that causes the application to crash. This results in a denial of service (DoS), making the affected system or application unavailable.
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Libxml2: libxml2: denial of service via crafted xsd-validated document
A flaw was found in libxml2. This vulnerability occurs when the library processes a specially crafted XML Schema Definition (XSD) validated document that includes an internal entity reference. An attacker could exploit this by providing a malicious document, leading to a type confusion error that causes the application to crash. This results in a denial of service (DoS), making the affected system or application unavailable.
- Record
CVE-2026-6732- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-843
- Updated
- 2026-11-05
EUVDEUVD-2026-25346
A flaw was found in libxml2. This vulnerability occurs when the library processes a specially crafted XML Schema Definition (XSD) validated document that includes an internal entity reference. An attacker could exploit this by providing a malicious document, leading to a type confusion error that causes the application to crash. This results in a denial of service (DoS), making the affected system or application unavailable.
- Record
EUVD-2026-25346- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-05
GitHub AdvisoriesGHSA-6rf6-xrp6-223m
A flaw was found in libxml2. This vulnerability occurs when the library processes a specially...
A flaw was found in libxml2. This vulnerability occurs when the library processes a specially crafted XML Schema Definition (XSD) validated document that includes an internal entity reference. An attacker could exploit this by providing a malicious document, leading to a type confusion error that causes the application to crash. This results in a denial of service (DoS), making the affected system or application unavailable.
- Record
GHSA-6rf6-xrp6-223m- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-843
- Updated
- 2026-11-02
NVD
A flaw was found in libxml2. This vulnerability occurs when the library processes a specially crafted XML Schema Definition (XSD) validated document that includes an internal entity reference. An attacker could exploit this by providing a malicious document, leading to a type confusion error that causes the application to crash. This results in a denial of service (DoS), making the affected system or application unavailable.
- Record
CVE-2026-6732- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-843
- Updated
- 2026-11-05
OSVALPINE-CVE-2026-6732
A flaw was found in libxml2. This vulnerability occurs when the library processes a specially crafted XML Schema Definition (XSD) validated document that includes an internal entity reference. An attacker could exploit this by providing a malicious document, leading to a type confusion error that causes the application to crash. This results in a denial of service (DoS), making the affected system or application unavailable.
- Record
ALPINE-CVE-2026-6732- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
OSVBELL-CVE-2026-6732
- Record
BELL-CVE-2026-6732- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 11 moreShow less
OSV
Libxml2: libxml2: denial of service via crafted xsd-validated document
A flaw was found in libxml2. This vulnerability occurs when the library processes a specially crafted XML Schema Definition (XSD) validated document that includes an internal entity reference. An attacker could exploit this by providing a malicious document, leading to a type confusion error that causes the application to crash. This results in a denial of service (DoS), making the affected system or application unavailable.
- Record
CVE-2026-6732- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-843
- Updated
- 2026-11-07
OSVDEBIAN-CVE-2026-6732
A flaw was found in libxml2. This vulnerability occurs when the library processes a specially crafted XML Schema Definition (XSD) validated document that includes an internal entity reference. An attacker could exploit this by providing a malicious document, leading to a type confusion error that causes the application to crash. This results in a denial of service (DoS), making the affected system or application unavailable.
- Record
DEBIAN-CVE-2026-6732- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVJLSEC-2026-1241
A flaw was found in libxml2. This vulnerability occurs when the library processes a specially crafted XML Schema Definition (XSD) validated document that includes an internal entity reference. An attacker could exploit this by providing a malicious document, leading to a type confusion error that causes the application to crash. This results in a denial of service (DoS), making the affected system or application unavailable.
- Record
JLSEC-2026-1241- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2026:11503
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
- Record
RHSA-2026:11503- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H - Updated
- 2026-11-02
OSVROOT-OS-DEBIAN-12-CVE-2026-6732
CVE-2026-6732 in libxml2 - Patched by Root
Root has patched CVE-2026-6732 in the libxml2 package for Root:Debian:12. Multiple fixed versions available.
- Record
ROOT-OS-DEBIAN-12-CVE-2026-6732- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-6732
A flaw was found in libxml2. This vulnerability occurs when the library processes a specially crafted XML Schema Definition (XSD) validated document that includes an internal entity reference. An attacker could exploit this by providing a malicious document, leading to a type confusion error that causes the application to crash. This results in a denial of service (DoS), making the affected system or application unavailable.
- Record
UBUNTU-CVE-2026-6732- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVMGASA-2026-0248 No score
Updated libxml2 packages fix a security vulnerability
The updated packages fix a security vulnerability: Denial of service via crafted xsd-validated document. (CVE-2026-6732)
- Record
MGASA-2026-0248- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:21317-1 No score
Security update for libxml2
This update for libxml2 fixes the following issues
- CVE-2026-6732: crafted XSD-validated document can cause a denial of service (bsc#1262719).
- CVE-2026-11979: stack-based buffer overflows in the
xmlcatalogutility when running in--shellmode (bsc#1269790).
- Record
openSUSE-SU-2026:21317-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:22596-1 No score
Security update for libxml2
This update for libxml2 fixes the following issues
- CVE-2026-6732: crafted XSD-validated document can cause a denial of service (bsc#1262719).
- CVE-2026-11979: stack-based buffer overflows in the
xmlcatalogutility when running in--shellmode (bsc#1269790).
- Record
SUSE-SU-2026:22596-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:22636-1 No score
Security update for libxml2
This update for libxml2 fixes the following issues
- CVE-2026-6732: crafted XSD-validated document can cause a denial of service (bsc#1262719).
- CVE-2026-11979: stack-based buffer overflows in the
xmlcatalogutility when running in--shellmode (bsc#1269790).
- Record
SUSE-SU-2026:22636-1- Updated
- 2026-11-02
OSVUSN-8460-1 No score
libxml2 vulnerabilities
It was discovered that libxml2 did not properly release memory allocated in the xmllint utility. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-1757)
A type confusion vulnerability was found in libxml2 when processing a specially crafted XML document. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-6732)
- Record
USN-8460-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libxml2Alpine:v3.21 |
2.13.0 up to 2.13.9-r1 | 2.13.9-r1 |
libxml2Alpine:v3.22 |
2.13.0 up to 2.13.9-r1 | 2.13.9-r1 |
libxml2Alpine:v3.23 |
2.13.0 up to 2.13.9-r1 | 2.13.9-r1 |
libxml2Alpine:v3.24 |
2.13.0 up to 2.13.9-r2 | 2.13.9-r2 |
openjdk21Alpine:v3.23 |
before 21.0.13.0.3_p1-r0 | 21.0.13.0.3_p1-r0 |
openjdk21Alpine:v3.24 |
before 21.0.13.0.3_p1-r0 | 21.0.13.0.3_p1-r0 |
openjdk25Alpine:v3.23 |
before 25.0.5.0.3_p1-r0 | 25.0.5.0.3_p1-r0 |
openjdk25Alpine:v3.24 |
before 25.0.5.0.3_p1-r0 | 25.0.5.0.3_p1-r0 |
qt6-qtwebengineAlpine:v3.23 |
before 6.10.3-r3 | 6.10.3-r3 |
qt6-qtwebengineAlpine:v3.24 |
before 6.11.0-r9 | 6.11.0-r9 |
Show 112 moreShow less
| Package | Affected | Fixed |
|---|---|---|
openjdk11Alpaquita:23 |
11.0.19_p7-r0 up to 11.0.33.0.3_p7-r0 | 11.0.33.0.3_p7-r0 |
openjdk11-container-jreAlpaquita:23 |
11.0.19_p7-r0 up to 11.0.33.0.3_p7-r0 | 11.0.33.0.3_p7-r0 |
openjdk11-liteAlpaquita:23 |
11.0.19_p7-r1 up to 11.0.33.0.3_p7-r0 | 11.0.33.0.3_p7-r0 |
openjdk11-perfAlpaquita:23 |
11.0.20.1_p1-r0 up to 11.0.33.0.3_p8-r0 | 11.0.33.0.3_p8-r0 |
openjdk17Alpaquita:23 |
17.0.7_p7-r1 up to 17.0.21.0.3_p5-r0 | 17.0.21.0.3_p5-r0 |
openjdk17-container-jreAlpaquita:23 |
17.0.7_p7-r0 up to 17.0.21.0.3_p5-r0 | 17.0.21.0.3_p5-r0 |
openjdk17-cracAlpaquita:23 |
17.0.13_p13-r0 up to 17.0.21.0.3_p6-r0 | 17.0.21.0.3_p6-r0 |
openjdk17-liteAlpaquita:23 |
17.0.7_p7-r1 up to 17.0.21.0.3_p5-r0 | 17.0.21.0.3_p5-r0 |
openjdk21Alpaquita:23 |
21_p37-r0 up to 21.0.13.0.3_p5-r0 | 21.0.13.0.3_p5-r0 |
openjdk21-container-jreAlpaquita:23 |
21_p37-r0 up to 21.0.13.0.3_p5-r0 | 21.0.13.0.3_p5-r0 |
openjdk21-cracAlpaquita:23 |
21.0.5_p12-r0 up to 21.0.13.0.3_p6-r0 | 21.0.13.0.3_p6-r0 |
openjdk21-liteAlpaquita:23 |
21_p37-r0 up to 21.0.13.0.3_p5-r0 | 21.0.13.0.3_p5-r0 |
openjdk25Alpaquita:23 |
25_p37-r0 up to 25.0.5.0.3_p5-r0 | 25.0.5.0.3_p5-r0 |
openjdk25-container-jreAlpaquita:23 |
25_p37-r0 up to 25.0.5.0.3_p5-r0 | 25.0.5.0.3_p5-r0 |
openjdk25-liteAlpaquita:23 |
25_p37-r0 up to 25.0.5.0.3_p5-r0 | 25.0.5.0.3_p5-r0 |
openjdk8Alpaquita:23 |
8u372_p7-r0 up to 8.513_p9-r0 | 8.513_p9-r0 |
openjdk8-perfAlpaquita:23 |
8u392_p9-r1 up to 8.513_p10-r0 | 8.513_p10-r0 |
libxml2Alpaquita:25 |
2.13.8-r0 up to 2.13.9-r4 | 2.13.9-r4 |
openjdk11Alpaquita:25 |
11.0.27_p9-r0 up to 11.0.33.0.3_p7-r0 | 11.0.33.0.3_p7-r0 |
openjdk11-container-jreAlpaquita:25 |
11.0.27_p9-r0 up to 11.0.33.0.3_p7-r0 | 11.0.33.0.3_p7-r0 |
openjdk11-liteAlpaquita:25 |
11.0.27_p9-r0 up to 11.0.33.0.3_p7-r0 | 11.0.33.0.3_p7-r0 |
openjdk11-perfAlpaquita:25 |
11.0.29_p11-r0 up to 11.0.33.0.3_p8-r0 | 11.0.33.0.3_p8-r0 |
openjdk17Alpaquita:25 |
17.0.15_p10-r1 up to 17.0.21.0.3_p5-r0 | 17.0.21.0.3_p5-r0 |
openjdk17-container-jreAlpaquita:25 |
17.0.15_p10-r0 up to 17.0.21.0.3_p5-r0 | 17.0.21.0.3_p5-r0 |
openjdk17-cracAlpaquita:25 |
17.0.15_p13-r1 up to 17.0.21.0.3_p6-r0 | 17.0.21.0.3_p6-r0 |
openjdk17-liteAlpaquita:25 |
17.0.15_p10-r0 up to 17.0.21.0.3_p5-r0 | 17.0.21.0.3_p5-r0 |
openjdk21Alpaquita:25 |
21.0.7_p9-r1 up to 21.0.13.0.3_p5-r0 | 21.0.13.0.3_p5-r0 |
openjdk21-container-jreAlpaquita:25 |
21.0.7_p9-r0 up to 21.0.13.0.3_p5-r0 | 21.0.13.0.3_p5-r0 |
openjdk21-cracAlpaquita:25 |
21.0.7_p12-r1 up to 21.0.13.0.3_p6-r0 | 21.0.13.0.3_p6-r0 |
openjdk21-liteAlpaquita:25 |
21.0.7_p9-r0 up to 21.0.13.0.3_p5-r0 | 21.0.13.0.3_p5-r0 |
openjdk25Alpaquita:25 |
25_p37-r0 up to 25.0.5.0.3_p5-r0 | 25.0.5.0.3_p5-r0 |
openjdk25-container-jreAlpaquita:25 |
25_p37-r0 up to 25.0.5.0.3_p5-r0 | 25.0.5.0.3_p5-r0 |
openjdk25-liteAlpaquita:25 |
25_p37-r0 up to 25.0.5.0.3_p5-r0 | 25.0.5.0.3_p5-r0 |
openjdk8Alpaquita:25 |
8.452_p11-r0 up to 8.513_p9-r0 | 8.513_p9-r0 |
openjdk8-perfAlpaquita:25 |
8.472_p10-r0 up to 8.513_p10-r0 | 8.513_p10-r0 |
libxml2Alpaquita:stream |
2.13.8-r0 up to 2.13.9-r5 | 2.13.9-r5 |
openjdk11Alpaquita:stream |
11.0.19_p7-r0 up to 11.0.33.0.3_p7-r0 | 11.0.33.0.3_p7-r0 |
openjdk11-container-jreAlpaquita:stream |
11.0.19_p7-r0 up to 11.0.33.0.3_p7-r0 | 11.0.33.0.3_p7-r0 |
openjdk11-liteAlpaquita:stream |
11.0.19_p7-r1 up to 11.0.33.0.3_p7-r0 | 11.0.33.0.3_p7-r0 |
openjdk17Alpaquita:stream |
17.0.7_p7-r1 up to 17.0.21.0.3_p5-r0 | 17.0.21.0.3_p5-r0 |
openjdk17-container-jreAlpaquita:stream |
17.0.7_p7-r0 up to 17.0.21.0.3_p5-r0 | 17.0.21.0.3_p5-r0 |
openjdk17-cracAlpaquita:stream |
17.0.10_p13-r0 up to 17.0.21.0.3_p6-r0 | 17.0.21.0.3_p6-r0 |
openjdk17-liteAlpaquita:stream |
17.0.7_p7-r1 up to 17.0.21.0.3_p5-r0 | 17.0.21.0.3_p5-r0 |
openjdk21Alpaquita:stream |
21_p37-r0 up to 21.0.13.0.3_p5-r0 | 21.0.13.0.3_p5-r0 |
openjdk21-container-jreAlpaquita:stream |
21_p37-r0 up to 21.0.13.0.3_p5-r0 | 21.0.13.0.3_p5-r0 |
openjdk21-cracAlpaquita:stream |
21.0.2_p15-r0 up to 21.0.13.0.3_p6-r0 | 21.0.13.0.3_p6-r0 |
openjdk21-liteAlpaquita:stream |
21_p37-r0 up to 21.0.13.0.3_p5-r0 | 21.0.13.0.3_p5-r0 |
openjdk25Alpaquita:stream |
25_p37-r0 up to 25.0.5.0.3_p5-r0 | 25.0.5.0.3_p5-r0 |
openjdk25-container-jreAlpaquita:stream |
25_p37-r0 up to 25.0.5.0.3_p5-r0 | 25.0.5.0.3_p5-r0 |
openjdk25-liteAlpaquita:stream |
25_p37-r0 up to 25.0.5.0.3_p5-r0 | 25.0.5.0.3_p5-r0 |
openjdk8Alpaquita:stream |
8u372_p7-r1 up to 8.513_p9-r0 | 8.513_p9-r0 |
openjdk11-container-jreBellSoft Hardened Containers:23 |
11.0.19_p7-r0 up to 11.0.33.0.3_p7-r0 | 11.0.33.0.3_p7-r0 |
openjdk11-liteBellSoft Hardened Containers:23 |
11.0.19_p7-r1 up to 11.0.33.0.3_p7-r0 | 11.0.33.0.3_p7-r0 |
openjdk11-perfBellSoft Hardened Containers:23 |
11.0.20.1_p1-r0 up to 11.0.33.0.3_p8-r0 | 11.0.33.0.3_p8-r0 |
openjdk17-container-jreBellSoft Hardened Containers:23 |
17.0.7_p7-r0 up to 17.0.21.0.3_p5-r0 | 17.0.21.0.3_p5-r0 |
openjdk17-cracBellSoft Hardened Containers:23 |
17.0.13_p13-r0 up to 17.0.21.0.3_p6-r0 | 17.0.21.0.3_p6-r0 |
openjdk17-liteBellSoft Hardened Containers:23 |
17.0.7_p7-r1 up to 17.0.21.0.3_p5-r0 | 17.0.21.0.3_p5-r0 |
openjdk21-container-jreBellSoft Hardened Containers:23 |
21_p37-r0 up to 21.0.13.0.3_p5-r0 | 21.0.13.0.3_p5-r0 |
openjdk21-cracBellSoft Hardened Containers:23 |
21.0.5_p12-r0 up to 21.0.13.0.3_p6-r0 | 21.0.13.0.3_p6-r0 |
openjdk21-liteBellSoft Hardened Containers:23 |
21_p37-r0 up to 21.0.13.0.3_p5-r0 | 21.0.13.0.3_p5-r0 |
openjdk25-container-jreBellSoft Hardened Containers:23 |
25_p37-r0 up to 25.0.5.0.3_p5-r0 | 25.0.5.0.3_p5-r0 |
openjdk25-liteBellSoft Hardened Containers:23 |
25_p37-r0 up to 25.0.5.0.3_p5-r0 | 25.0.5.0.3_p5-r0 |
openjdk8BellSoft Hardened Containers:23 |
8u372_p7-r0 up to 8.513_p9-r0 | 8.513_p9-r0 |
openjdk8-perfBellSoft Hardened Containers:23 |
8u392_p9-r1 up to 8.513_p10-r0 | 8.513_p10-r0 |
libxml2BellSoft Hardened Containers:25 |
2.13.8-r0 up to 2.13.9-r4 | 2.13.9-r4 |
openjdk11-container-jreBellSoft Hardened Containers:25 |
11.0.27_p9-r0 up to 11.0.33.0.3_p7-r0 | 11.0.33.0.3_p7-r0 |
openjdk11-liteBellSoft Hardened Containers:25 |
11.0.27_p9-r0 up to 11.0.33.0.3_p7-r0 | 11.0.33.0.3_p7-r0 |
openjdk11-perfBellSoft Hardened Containers:25 |
11.0.29_p11-r0 up to 11.0.33.0.3_p8-r0 | 11.0.33.0.3_p8-r0 |
openjdk17-container-jreBellSoft Hardened Containers:25 |
17.0.15_p10-r0 up to 17.0.21.0.3_p5-r0 | 17.0.21.0.3_p5-r0 |
openjdk17-cracBellSoft Hardened Containers:25 |
17.0.15_p13-r1 up to 17.0.21.0.3_p6-r0 | 17.0.21.0.3_p6-r0 |
openjdk17-liteBellSoft Hardened Containers:25 |
17.0.15_p10-r0 up to 17.0.21.0.3_p5-r0 | 17.0.21.0.3_p5-r0 |
openjdk21-container-jreBellSoft Hardened Containers:25 |
21.0.7_p9-r0 up to 21.0.13.0.3_p5-r0 | 21.0.13.0.3_p5-r0 |
openjdk21-cracBellSoft Hardened Containers:25 |
21.0.7_p12-r1 up to 21.0.13.0.3_p6-r0 | 21.0.13.0.3_p6-r0 |
openjdk21-liteBellSoft Hardened Containers:25 |
21.0.7_p9-r0 up to 21.0.13.0.3_p5-r0 | 21.0.13.0.3_p5-r0 |
openjdk25-container-jreBellSoft Hardened Containers:25 |
25_p37-r0 up to 25.0.5.0.3_p5-r0 | 25.0.5.0.3_p5-r0 |
openjdk25-liteBellSoft Hardened Containers:25 |
25_p37-r0 up to 25.0.5.0.3_p5-r0 | 25.0.5.0.3_p5-r0 |
openjdk8BellSoft Hardened Containers:25 |
8.452_p11-r0 up to 8.513_p9-r0 | 8.513_p9-r0 |
openjdk8-perfBellSoft Hardened Containers:25 |
8.472_p10-r0 up to 8.513_p10-r0 | 8.513_p10-r0 |
libxml2BellSoft Hardened Containers:stream |
2.13.8-r0 up to 2.13.9-r5 | 2.13.9-r5 |
openjdk11-container-jreBellSoft Hardened Containers:stream |
11.0.19_p7-r0 up to 11.0.33.0.3_p7-r0 | 11.0.33.0.3_p7-r0 |
openjdk11-liteBellSoft Hardened Containers:stream |
11.0.19_p7-r1 up to 11.0.33.0.3_p7-r0 | 11.0.33.0.3_p7-r0 |
openjdk17-container-jreBellSoft Hardened Containers:stream |
17.0.7_p7-r0 up to 17.0.21.0.3_p5-r0 | 17.0.21.0.3_p5-r0 |
openjdk17-cracBellSoft Hardened Containers:stream |
17.0.10_p13-r0 up to 17.0.21.0.3_p6-r0 | 17.0.21.0.3_p6-r0 |
openjdk17-liteBellSoft Hardened Containers:stream |
17.0.7_p7-r1 up to 17.0.21.0.3_p5-r0 | 17.0.21.0.3_p5-r0 |
openjdk21-container-jreBellSoft Hardened Containers:stream |
21_p37-r0 up to 21.0.13.0.3_p5-r0 | 21.0.13.0.3_p5-r0 |
openjdk21-cracBellSoft Hardened Containers:stream |
21.0.2_p15-r0 up to 21.0.13.0.3_p6-r0 | 21.0.13.0.3_p6-r0 |
openjdk21-liteBellSoft Hardened Containers:stream |
21_p37-r0 up to 21.0.13.0.3_p5-r0 | 21.0.13.0.3_p5-r0 |
openjdk25-container-jreBellSoft Hardened Containers:stream |
25_p37-r0 up to 25.0.5.0.3_p5-r0 | 25.0.5.0.3_p5-r0 |
openjdk25-liteBellSoft Hardened Containers:stream |
25_p37-r0 up to 25.0.5.0.3_p5-r0 | 25.0.5.0.3_p5-r0 |
openjdk8BellSoft Hardened Containers:stream |
8u372_p7-r1 up to 8.513_p9-r0 | 8.513_p9-r0 |
libxml2Debian:14 |
before 2.15.3+dfsg-1, plus listed versions 2.12.7+dfsg+really2.9.14-2.12.13.1+dfsg-0exp12.13.3+dfsg-0exp12.13.3+dfsg-0exp22.14.1+dfsg-0exp1 Show 21 moreShow less2.14.2+dfsg-0exp12.14.3+dfsg-0exp12.14.3+dfsg-0exp22.14.3+dfsg-0exp32.14.4+dfsg-0exp12.14.5+dfsg-0.12.14.5+dfsg-0.22.14.5+dfsg-0exp12.14.5+dfsg-0exp22.14.6+dfsg-0.12.15.0+dfsg-0.12.15.0+dfsg-0.22.15.0+dfsg-0.32.15.1+dfsg-0.12.15.1+dfsg-0.22.15.1+dfsg-0.32.15.1+dfsg-0.42.15.1+dfsg-0.52.15.1+dfsg-12.15.1+dfsg-22.15.2+dfsg-0.1 |
2.15.3+dfsg-1 |
XML2_jllJulia |
2.13.1+0 up to 2.15.3+0 | 2.15.3+0 |
libxml2Mageia:10 |
before 2.15.1-3.1.mga10 | 2.15.1-3.1.mga10 |
libxml2Red Hat:hummingbird:1 From an advisory covering 2 CVEs |
before 0:2.15.3-0.1.hum1 | 0:2.15.3-0.1.hum1 |
libxml2-16Red Hat:hummingbird:1 From an advisory covering 2 CVEs |
before 0:2.15.3-0.1.hum1 | 0:2.15.3-0.1.hum1 |
libxml2-develRed Hat:hummingbird:1 From an advisory covering 2 CVEs |
before 0:2.15.3-0.1.hum1 | 0:2.15.3-0.1.hum1 |
libxml2-staticRed Hat:hummingbird:1 From an advisory covering 2 CVEs |
before 0:2.15.3-0.1.hum1 | 0:2.15.3-0.1.hum1 |
python3-libxml2Red Hat:hummingbird:1 From an advisory covering 2 CVEs |
before 0:2.15.3-0.1.hum1 | 0:2.15.3-0.1.hum1 |
libxml2Root:Debian:12 |
before 2.9.14+dfsg-1.3~deb12u6.root.io.16 | 2.9.14+dfsg-1.3~deb12u6.root.io.162.9.14+dfsg-1.3~deb12u6.aikido.172.9.14+dfsg-1.3~deb12u6.aikido.182.9.14+dfsg-1.3~deb12u6.aikido.19 |
rootio-libxml2Root:Debian:12 |
before 2.9.14+dfsg-1.3~deb12u6.root.io.16 | 2.9.14+dfsg-1.3~deb12u6.root.io.162.9.14+dfsg-1.3~deb12u6.aikido.172.9.14+dfsg-1.3~deb12u6.aikido.182.9.14+dfsg-1.3~deb12u6.aikido.19 |
libxml2SUSE:Linux Micro 6.2 From an advisory covering 2 CVEs |
before 2.13.8-160000.5.1 | 2.13.8-160000.5.1 |
libxml2-pythonSUSE:Linux Micro 6.2 From an advisory covering 2 CVEs |
before 2.13.8-160000.5.1 | 2.13.8-160000.5.1 |
libxml2SUSE:Linux Enterprise Server 16.0 From an advisory covering 2 CVEs |
before 2.13.8-160000.5.1 | 2.13.8-160000.5.1 |
libxml2-pythonSUSE:Linux Enterprise Server 16.0 From an advisory covering 2 CVEs |
before 2.13.8-160000.5.1 | 2.13.8-160000.5.1 |
libxml2SUSE:Linux Enterprise Server for SAP applications 16.0 From an advisory covering 2 CVEs |
before 2.13.8-160000.5.1 | 2.13.8-160000.5.1 |
libxml2-pythonSUSE:Linux Enterprise Server for SAP applications 16.0 From an advisory covering 2 CVEs |
before 2.13.8-160000.5.1 | 2.13.8-160000.5.1 |
libxml2Ubuntu:25.10 |
before 2.14.5+dfsg-0.2ubuntu0.2, plus listed versions 2.12.7+dfsg+really2.9.14-0.42.12.7+dfsg+really2.9.14-0.4ubuntu0.12.12.7+dfsg+really2.9.14-12.14.3+dfsg-0exp12.14.3+dfsg-0exp2 Show 7 moreShow less2.14.3+dfsg-0exp32.14.4+dfsg-0exp12.14.5+dfsg-0exp12.14.5+dfsg-0exp22.14.5+dfsg-0.12.14.5+dfsg-0.22.14.5+dfsg-0.2ubuntu0.1 |
2.14.5+dfsg-0.2ubuntu0.2 |
libxml2Ubuntu:26.04:LTS |
before 2.15.2+dfsg-0.1ubuntu0.1, plus listed versions 2.14.5+dfsg-0.22.14.5+dfsg-0.2build12.15.1+dfsg-0.32.15.1+dfsg-0.42.15.1+dfsg-1 Show 4 moreShow less2.15.1+dfsg-22.15.1+dfsg-2ubuntu12.15.1+dfsg-2ubuntu22.15.2+dfsg-0.1 |
2.15.2+dfsg-0.1ubuntu0.1 |
libxml2Ubuntu:25.10 From an advisory covering 2 CVEs |
before 2.14.5+dfsg-0.2ubuntu0.2, plus listed versions 2.12.7+dfsg+really2.9.14-0.42.12.7+dfsg+really2.9.14-0.4ubuntu0.12.12.7+dfsg+really2.9.14-12.14.3+dfsg-0exp12.14.3+dfsg-0exp2 Show 7 moreShow less2.14.3+dfsg-0exp32.14.4+dfsg-0exp12.14.5+dfsg-0exp12.14.5+dfsg-0exp22.14.5+dfsg-0.12.14.5+dfsg-0.22.14.5+dfsg-0.2ubuntu0.1 |
2.14.5+dfsg-0.2ubuntu0.2 |
libxml2Ubuntu:26.04:LTS From an advisory covering 2 CVEs |
before 2.15.2+dfsg-0.1ubuntu0.1, plus listed versions 2.14.5+dfsg-0.22.14.5+dfsg-0.2build12.15.1+dfsg-0.32.15.1+dfsg-0.42.15.1+dfsg-1 Show 4 moreShow less2.15.1+dfsg-22.15.1+dfsg-2ubuntu12.15.1+dfsg-2ubuntu22.15.2+dfsg-0.1 |
2.15.2+dfsg-0.1ubuntu0.1 |
libxml2openSUSE:Leap 16.0 From an advisory covering 2 CVEs |
before 2.13.8-160000.5.1 | 2.13.8-160000.5.1 |
libxml2-pythonopenSUSE:Leap 16.0 From an advisory covering 2 CVEs |
before 2.13.8-160000.5.1 | 2.13.8-160000.5.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | CVE List, EUVD, NVD | |
| facts | OSV | |
| affected | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-6732 is a medium vulnerability (CVSS 6.5) in Xmlsoft Libxml2, published April 23, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.63%, the 50th percentile. Fixed in libxml2 2.13.9-r1.
References
access.redhat.com/errata/RHSA-2026:11503
bugzilla.redhat.com/show_bug.cgi?id=2461300
gitlab.gnome.org/GNOME/libxml2/-/issues/1097
nvd.nist.gov/vuln/detail/CVE-2026-6732
Show 28 moreShow less
github.com/advisories/GHSA-6rf6-xrp6-223m
security.alpinelinux.org/vuln/CVE-2026-6732
docs.bell-sw.com/security/cves/CVE-2026-6732
catalog.redhat.com/software/containers
security-tracker.debian.org/tracker/CVE-2026-6732
advisories.mageia.org/MGASA-2026-0248.html
bugs.mageia.org/show_bug.cgi?id=35749
ubuntu.com/security/notices/USN-8460-1
images.redhat.com
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_11503.json
cve.org/CVERecord?id=CVE-2025-7425
suse.com/support/update/announcement/2026/suse-su-202622596-1
bugzilla.suse.com/1262719