CVE-2026-0992

A flaw was found in the libxml2 library. This uncontrolled resource consumption vulnerability occurs when processing XML catalogs that contain repeated <nextCatalog> elements pointing to the same downstream catalog. A remote attacker can exploit this by supplying crafted catalogs, causing the parser to redundantly traverse catalog chains. This leads to excessive CPU consumption and degrades application availability, resulting in a denial-of-service condition.

A flaw was found in the libxml2 library. This uncontrolled resource consumption vulnerability occurs when processing XML catalogs that contain repeated <nextCatalog> elements pointing to the same downstream catalog. A remote attacker can exploit this by supplying crafted catalogs, causing the parser to redundantly traverse catalog chains. This leads to excessive CPU consumption and degrades application availability, resulting in a denial-of-service condition.

This library allows to manipulate XML files. It includes support to read, modify and write XML and HTML files. There is DTDs support this includes parsing and validation even with complex DtDs, either at parse time or later once the document has been modified. The output can be a simple SAX stream or and in-memory DOM like representations. In this case one can use the built-in XPath and XPointer implementation to select sub nodes or ranges. A flexible Input/Output mechanism is available, with existing HTTP and FTP modules and combined to an URI library.

Security Fix(es):

A vulnerability was found in libxml2 up to 2.14.5. It has been declared as problematic. This vulnerability affects the function xmlParseSGMLCatalog of the component xmlcatalog. The manipulation leads to uncontrolled recursion. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The code maintainer explains, that "[t]he issue can only be triggered with untrusted SGML catalogs and it makes absolutely no sense to use untrusted catalogs. I also doubt that anyone is still using SGML catalogs at all."(CVE-2025-8732)

A flaw was identified in the RelaxNG parser of libxml2 related to how external schema inclusions are handled. The parser does not enforce a limit on inclusion depth when resolving nested <include> directives. Specially crafted or overly complex schemas can cause excessive recursion during parsing. This may lead to stack exhaustion and application crashes, creating a denial-of-service risk.(CVE-2026-0989)

A flaw was found in libxml2, an XML parsing library. This uncontrolled recursion vulnerability occurs in the xmlCatalogXMLResolveURI function when an XML catalog contains a delegate URI entry that references itself. A remote attacker could exploit this configuration-dependent issue by providing a specially crafted XML catalog, leading to infinite recursion and call stack exhaustion. This ultimately results in a segmentation fault, causing a Denial of Service (DoS) by crashing affected applications.(CVE-2026-0990)

A flaw was found in the libxml2 library. This uncontrolled resource consumption vulnerability occurs when processing XML catalogs that contain repeated <nextCatalog> elements pointing to the same downstream catalog. A remote attacker can exploit this by supplying crafted catalogs, causing the parser to redundantly traverse catalog chains. This leads to excessive CPU consumption and degrades application availability, resulting in a denial-of-service condition.(CVE-2026-0992)

Root has patched CVE-2026-0992 in the rootio-libxml2 package for Root:Debian:12. Multiple fixed versions available.

Root has patched CVE-2026-0992 in the rootio-libxml2 package for Root:Debian:13. Multiple fixed versions available.

A flaw was found in the libxml2 library. This uncontrolled resource consumption vulnerability occurs when processing XML catalogs that contain repeated <nextCatalog> elements pointing to the same downstream catalog. A remote attacker can exploit this by supplying crafted catalogs, causing the parser to redundantly traverse catalog chains. This leads to excessive CPU consumption and degrades application availability, resulting in a denial-of-service condition.

A flaw was found in the libxml2 library. This uncontrolled resource consumption vulnerability occurs when processing XML catalogs that contain repeated <nextCatalog> elements pointing to the same downstream catalog. A remote attacker can exploit this by supplying crafted catalogs, causing the parser to redundantly traverse catalog chains. This leads to excessive CPU consumption and degrades application availability, resulting in a denial-of-service condition.

A flaw was found in the libxml2 library. This uncontrolled resource consumption vulnerability occurs when processing XML catalogs that contain repeated <nextCatalog> elements pointing to the same downstream catalog. A remote attacker can exploit this by supplying crafted catalogs, causing the parser to redundantly traverse catalog chains. This leads to excessive CPU consumption and degrades application availability, resulting in a denial-of-service condition.

• CVE-2024-34459: fix buffer over-read in xmlHTMLPrintFileContext in xmllint
• CVE-2025-8732: fix stack overflow from self-referencing SGML CATALOG entries
• CVE-2026-0989: add RelaxNG include recursion limit
• CVE-2026-0990: prevent infinite recursion in xmlCatalogListXMLResolveURI
• CVE-2026-0992: ignore repeated nextCatalog entries in XML catalog parsing
• CVE-2026-1757: fix memory leak in xmllint interactive shell

• CVE-2023-45322: fix use-after-free in xmlStaticCopyNodeList when copying DTDs
• CVE-2024-34459: fix buffer over-read in xmlHTMLPrintFileContext in xmllint
• CVE-2025-6170: fix potential buffer overflows in xmllint interactive shell
• CVE-2025-8732: fix stack overflow from self-referencing SGML CATALOG entries
• CVE-2026-0989: add RelaxNG include recursion limit
• CVE-2026-0990: prevent infinite recursion in xmlCatalogListXMLResolveURI
• CVE-2026-0992: ignore repeated nextCatalog entries in XML catalog parsing
• CVE-2026-1757: fix memory leak in xmllint interactive shell

• SECURITY UPDATE: uncontrolled recursion in SGML catalog parsing
  • debian/patches/CVE-2025-8732.patch: thread a depth counter through xmlParseSGMLCatalog() and xmlExpandCatalog() in catalog.c and bail out past MAX_CATAL_DEPTH, and register expanded catalog filenames in the SGML hash table before recursing so a repeated CATALOG directive is only followed once, to prevent stack exhaustion and exponential re-parsing on self-referencing SGML CATALOG entries. Add test files result/catalogs/recursive, test/catalogs/recursive.script and test/catalogs/recursive.sgml
  • CVE-2025-8732
• SECURITY UPDATE: uncontrolled recursion in the RelaxNG parser via nested schema includes
  • debian/patches/CVE-2026-0989.patch: add an include depth limit to the RelaxNG parser context in relaxng.c, defaulting to 1000 and overridable via the RNG_INCLUDE_LIMIT environment variable or the new xmlRelaxParserSetIncLImit() entry point in include/libxml/relaxng.h, and make xmlRelaxNGIncludePush() failures propagate. Add coverage in runtest.c and test/relaxng/include/include-limit*.rng
  • debian/libxml2.symbols: add the new xmlRelaxParserSetIncLImit symbol
  • CVE-2026-0989
• SECURITY UPDATE: uncontrolled recursion in XML catalog URI resolution
  • debian/patches/CVE-2026-0990.patch: add a MAX_CATAL_DEPTH guard to xmlCatalogListXMLResolveURI() in catalog.c and stop clobbering the catalog entry used for depth bookkeeping while walking the entry list, to prevent stack exhaustion on a self-referencing delegateURI entry
  • CVE-2026-0990
• SECURITY UPDATE: uncontrolled resource consumption via repeated nextCatalog entries
  • debian/patches/CVE-2026-0992.patch: ignore duplicate nextCatalog entries in xmlParseXMLCatalogNode() in catalog.c, to prevent redundant exponential traversal of catalog chains. Guard the new loop against a NULL entry so a nextCatalog element without a 'catalog' attribute is still skipped with an error instead of crashing
  • CVE-2026-0992

xmlcatalog xmlParseSGMLCatalog recursion. (CVE-2025-8732) Unbounded relaxng include recursion leading to stack overflow. (CVE-2026-0989) Denial of service via uncontrolled recursion in xml catalog processing. (CVE-2026-0990) Denial of service via crafted xml catalogs. (CVE-2026-0992)

These are all security issues fixed in the libxml2-16-2.14.5-4.1 package on the GA media of openSUSE Tumbleweed.

This update for libxml2, libxslt fixes the following issues:

Changes in libxml2:

• CVE-2026-0990: call stack overflow may lead to application crash due to infinite recursion in xmlCatalogXMLResolveURI (bsc#1256807, bsc#1256811).
• CVE-2026-0992: excessive resource consumption when processing XML catalogs due to exponential behavior when handling nextCatalog elements (bsc#1256809, bsc#1256812).
• CVE-2025-8732: infinite recursion in catalog parsing functions when processing malformed SGML catalog files (bsc#1247858).
• CVE-2026-1757: memory leak in the xmllint interactive shell (bsc#1257594, bsc#1257595).
• CVE-2025-10911: parsing xsl nodes may lead to use-after-free with key data stored cross-RVT (bsc#1250553)

This update for libxml2 fixes the following issues:

• CVE-2026-0990: Fixed a call stack overflow leading to application crash due to infinite recursion in xmlCatalogXMLResolveURI. (bsc#1256807, bsc#1256811)
• CVE-2026-0992: Fixed an excessive resource consumption when processing XML catalogs due to exponential behavior. (bsc#1256809, bsc#1256812)
• CVE-2026-1757: Fixed a memory leak in the xmllint interactive shell. (bsc#1257594, bsc#1257595)
• CVE-2025-10911: Fixed a use-after-free with key data stored cross-RVT. (bsc#1250553)

This update for libxml2 fixes the following issues:

• CVE-2026-0990: Fixed a call stack overflow leading to application crash due to infinite recursion in xmlCatalogXMLResolveURI. (bsc#1256807, bsc#1256811)
• CVE-2026-0992: Fixed an excessive resource consumption when processing XML catalogs due to exponential behavior. (bsc#1256809, bsc#1256812)
• CVE-2026-1757: Fixed a memory leak in the xmllint interactive shell. (bsc#1257594, bsc#1257595)
• CVE-2025-10911: Fixed a use-after-free with key data stored cross-RVT. (bsc#1250553)
• CVE-2025-8732: Fixed an infinite recursion in catalog parsing functions when processing malformed SGML catalog files. (bsc#1247858)

This update for libxml2 fixes the following issues:

• CVE-2026-0990: Fixed a call stack overflow leading to application crash due to infinite recursion in xmlCatalogXMLResolveURI. (bsc#1256807, bsc#1256811)
• CVE-2026-0992: Fixed an excessive resource consumption when processing XML catalogs due to exponential behavior. (bsc#1256809, bsc#1256812)
• CVE-2026-1757: Fixed a memory leak in the xmllint interactive shell. (bsc#1257594, bsc#1257595)
• CVE-2025-10911: Fixed a use-after-free with key data stored cross-RVT. (bsc#1250553)
• CVE-2025-8732: Fixed an infinite recursion in catalog parsing functions when processing malformed SGML catalog files. (bsc#1247858)
• CVE-2026-0989: Fixe a call stack exhaustion leading to application crash due to RelaxNG parser not limiting the recursion depth. (bsc#1256805, bsc#1256810)

This update for libxml2 fixes the following issues:

• CVE-2026-0990: Fixed a call stack overflow leading to application crash due to infinite recursion in xmlCatalogXMLResolveURI. (bsc#1256807, bsc#1256811)
• CVE-2026-0992: Fixed an excessive resource consumption when processing XML catalogs due to exponential behavior. (bsc#1256809, bsc#1256812)
• CVE-2026-1757: Fixed a memory leak in the xmllint interactive shell. (bsc#1257594, bsc#1257595)
• CVE-2025-10911: Fixed a use-after-free with key data stored cross-RVT. (bsc#1250553)
• CVE-2026-0989: Fixe a call stack exhaustion leading to application crash due to RelaxNG parser not limiting the recursion depth. (bsc#1256805, bsc#1256810)

This update for libxml2 fixes the following issues:

• CVE-2026-0990: Fixed a call stack overflow leading to application crash due to infinite recursion in xmlCatalogXMLResolveURI. (bsc#1256807, bsc#1256811)
• CVE-2026-0992: Fixed an excessive resource consumption when processing XML catalogs due to exponential behavior. (bsc#1256809, bsc#1256812)
• CVE-2026-1757: Fixed a memory leak in the xmllint interactive shell. (bsc#1257594, bsc#1257595)
• CVE-2025-10911: Fixed a use-after-free with key data stored cross-RVT. (bsc#1250553)

This update for libxml2, libxslt fixes the following issues:

Changes in libxml2:

• CVE-2026-0990: call stack overflow may lead to application crash due to infinite recursion in xmlCatalogXMLResolveURI (bsc#1256807, bsc#1256811).
• CVE-2026-0992: excessive resource consumption when processing XML catalogs due to exponential behavior when handling nextCatalog elements (bsc#1256809, bsc#1256812).
• CVE-2025-8732: infinite recursion in catalog parsing functions when processing malformed SGML catalog files (bsc#1247858).
• CVE-2026-1757: memory leak in the xmllint interactive shell (bsc#1257594, bsc#1257595).
• CVE-2025-10911: parsing xsl nodes may lead to use-after-free with key data stored cross-RVT (bsc#1250553)

This update for libxml2, libxslt fixes the following issues:

Changes in libxml2:

• CVE-2026-0990: call stack overflow may lead to application crash due to infinite recursion in xmlCatalogXMLResolveURI (bsc#1256807, bsc#1256811).
• CVE-2026-0992: excessive resource consumption when processing XML catalogs due to exponential behavior when handling nextCatalog elements (bsc#1256809, bsc#1256812).
• CVE-2025-8732: infinite recursion in catalog parsing functions when processing malformed SGML catalog files (bsc#1247858).
• CVE-2026-1757: memory leak in the xmllint interactive shell (bsc#1257594, bsc#1257595).
• CVE-2025-10911: parsing xsl nodes may lead to use-after-free with key data stored cross-RVT (bsc#1250553)

This update for libxslt, libxml2 fixes the following issues:

libxml2:

• CVE-2026-0990: call stack overflow leading to application crash due to infinite recursion in xmlCatalogXMLResolveURI (bsc#1256807, bsc#1256811)

• CVE-2026-0992: excessive resource consumption when processing XML catalogs due to exponential behavior when handling <nextCatalog> elements (bsc#1256808, bsc#1256809, bsc#1256812)

• CVE-2025-8732: infinite recursion in catalog parsing functions when processing malformed SGML catalog files (bsc#1247858, bsc#1247850)

• CVE-2026-1757: memory leak in the xmllint interactive shell (bsc#1257593, bsc#1257594, bsc#1257595)

• CVE-2025-10911: use-after-free with key data stored cross-RVT (bsc#1250553)

• CVE-2026-0989: call stack exhaustion leading to application crash due to RelaxNG parser not limiting the recursion depth when resolving <include> directives (bsc#1256804, bsc#1256805, bsc#1256810)

libxslt:

• CVE-2025-10911 will be fixed on libxml2 side instead [bsc#1250553]

This update for libxslt, libxml2 fixes the following issues:

Changes in libxml2:

• CVE-2026-0990: call stack overflow may lead to application crash due to infinite recursion in xmlCatalogXMLResolveURI (bsc#1256807, bsc#1256811).
• CVE-2026-0992: excessive resource consumption when processing XML catalogs due to exponential behavior when handling nextCatalog elements (bsc#1256809, bsc#1256812).
• CVE-2025-8732: infinite recursion in catalog parsing functions when processing malformed SGML catalog files (bsc#1247858).
• CVE-2026-1757: memory leak in the xmllint interactive shell (bsc#1257594, bsc#1257595).
• CVE-2025-10911: parsing xsl nodes may lead to use-after-free with key data stored cross-RVT (bsc#1250553).