{"id":"CVE-2026-1757","aliases":["BELL-CVE-2026-1757","CLSA-2026-1775649722","CLSA-2026-1775731413","DEBIAN-CVE-2026-1757","EUVD-2026-5101","GHSA-7qq5-wfv8-hvvh","OESA-2026-1774","RHSA-2026:7519","ROOT-OS-DEBIAN-12-CVE-2026-1757","SUSE-SU-2026:0568-1","SUSE-SU-2026:0570-1","SUSE-SU-2026:0605-1","SUSE-SU-2026:0606-1","SUSE-SU-2026:0782-1","SUSE-SU-2026:20631-1","SUSE-SU-2026:20647-1","SUSE-SU-2026:20657-1","SUSE-SU-2026:20707-1","UBUNTU-CVE-2026-1757","USN-8460-1","openSUSE-SU-2026:10167-1","openSUSE-SU-2026:20312-1"],"status":"published","title":"Libxml2: memory leak leading to local denial of service in xmllint interactive shell","description":"A flaw was identified in the interactive shell of the xmllint utility, part of the libxml2 project, where memory allocated for user input is not properly released under certain conditions. When a user submits input consisting only of whitespace, the program skips command execution but fails to free the allocated buffer. Repeating this action causes memory to continuously accumulate. Over time, this can exhaust system memory and terminate the xmllint process, creating a denial-of-service condition on the local system.","severity":{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00217,"percentile":0.12297,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-401"],"published":"2026-02-02T12:38:14Z","modified":"2026-11-06T07:51:45Z","fixes":[{"ecosystem":"Alpaquita:23","package":"libxml2","fixed_in":["2.10.4-r8"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"libxml2","fixed_in":["2.13.9-r2"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"libxml2","fixed_in":["2.13.9-r2"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:23","package":"libxml2","fixed_in":["2.10.4-r8"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:25","package":"libxml2","fixed_in":["2.13.9-r2"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"libxml2","fixed_in":["2.13.9-r2"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libxml2","fixed_in":["2.9.14+dfsg-1.3~deb12u6"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libxml2","fixed_in":["2.12.7+dfsg+really2.9.14-2.1+deb13u3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libxml2","fixed_in":["2.15.2+dfsg-0.1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"libxml2","fixed_in":["2.11.9-13.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"libxml2","fixed_in":["2.9.10-56.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"libxml2","fixed_in":["2.9.14-27.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"libxml2","fixed_in":["2.11.9-13.oe2403sp2"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"libxml2","fixed_in":["2.11.9-13.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP2","package":"libxml2","fixed_in":["2.11.9-13.oe2403sp2"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"libxml2","fixed_in":["2.14.5+dfsg-0.2ubuntu0.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpaquita:23","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.10.3-r2"},{"fixed":"2.10.4-r8"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.13.8-r0"},{"fixed":"2.13.9-r2"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.10.3-r2"},{"fixed":"2.13.9-r2"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:23","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.10.3-r2"},{"fixed":"2.10.4-r8"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:25","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.13.8-r0"},{"fixed":"2.13.9-r2"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.10.3-r2"},{"fixed":"2.13.9-r2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.13-3.el9_2.1.tuxcare.els12"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libxml2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.13-3.el9_2.1.tuxcare.els12"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libxml2-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.13-3.el9_2.1.tuxcare.els12"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"python3-libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.13-3.el9_2.1.tuxcare.els12"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.13-12.el9_6.tuxcare.els3"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"libxml2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.13-12.el9_6.tuxcare.els3"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"libxml2-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.13-12.el9_6.tuxcare.els3"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"python3-libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.13-12.el9_6.tuxcare.els3"}]}],"bundled":8},{"source":"osv","ecosystem":"Debian:12","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.14+dfsg-1.3~deb12u6"}]}],"versions":["2.9.14+dfsg-1.2","2.9.14+dfsg-1.3~deb12u1","2.9.14+dfsg-1.3~deb12u2","2.9.14+dfsg-1.3~deb12u3","2.9.14+dfsg-1.3~deb12u4","2.9.14+dfsg-1.3~deb12u5"]},{"source":"osv","ecosystem":"Debian:13","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12.7+dfsg+really2.9.14-2.1+deb13u3"}]}],"versions":["2.12.7+dfsg+really2.9.14-2.1","2.12.7+dfsg+really2.9.14-2.1+deb13u1","2.12.7+dfsg+really2.9.14-2.1+deb13u2"]},{"source":"osv","ecosystem":"Debian:14","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.15.2+dfsg-0.1"}]}],"versions":["2.12.7+dfsg+really2.9.14-2.1","2.13.1+dfsg-0exp1","2.13.3+dfsg-0exp1","2.13.3+dfsg-0exp2","2.14.1+dfsg-0exp1","2.14.2+dfsg-0exp1","2.14.3+dfsg-0exp1","2.14.3+dfsg-0exp2","2.14.3+dfsg-0exp3","2.14.4+dfsg-0exp1","2.14.5+dfsg-0.1","2.14.5+dfsg-0.2","2.14.5+dfsg-0exp1","2.14.5+dfsg-0exp2","2.14.6+dfsg-0.1","2.15.0+dfsg-0.1","2.15.0+dfsg-0.2","2.15.0+dfsg-0.3","2.15.1+dfsg-0.1","2.15.1+dfsg-0.2","2.15.1+dfsg-0.3","2.15.1+dfsg-0.4","2.15.1+dfsg-0.5","2.15.1+dfsg-1","2.15.1+dfsg-2"]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.9-13.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.10-56.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.14-27.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.9-13.oe2403sp2"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.9-13.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.9-13.oe2403sp2"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.15.2-0.3.hum1"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libxml2-16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.15.2-0.3.hum1"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libxml2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.15.2-0.3.hum1"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libxml2-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.15.2-0.3.hum1"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3-libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.15.2-0.3.hum1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.7-150000.3.94.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"python-libxml2-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.7-150000.3.94.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"python-libxml2-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.7-150000.3.94.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.3-150500.5.38.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"libxml2-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.3-150500.5.38.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.3-150500.5.38.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"libxml2-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.3-150500.5.38.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12.10-150700.4.11.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"libxml2-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12.10-150700.4.11.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP7","package":"libxml2-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12.10-150700.4.11.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.14-150400.5.55.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"libxml2-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.14-150400.5.55.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.14-150400.5.55.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"libxml2-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.14-150400.5.55.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-46.99.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"python-libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-46.99.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13.8-160000.4.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"libxml2-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13.8-160000.4.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"libxslt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.43-160000.4.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13.8-160000.4.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"libxml2-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13.8-160000.4.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"libxslt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.43-160000.4.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13.8-160000.4.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"libxml2-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13.8-160000.4.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"libxslt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.43-160000.4.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.6-slfo.1.1_8.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"libxml2-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.6-slfo.1.1_8.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"libxslt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.38-slfo.1.1_6.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.6-12.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"libxml2-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.6-12.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"libxslt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.38-8.1"}]}],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.14.5+dfsg-0.2ubuntu0.2"}]}],"versions":["2.12.7+dfsg+really2.9.14-0.4","2.12.7+dfsg+really2.9.14-0.4ubuntu0.1","2.12.7+dfsg+really2.9.14-1","2.14.3+dfsg-0exp1","2.14.3+dfsg-0exp2","2.14.3+dfsg-0exp3","2.14.4+dfsg-0exp1","2.14.5+dfsg-0exp1","2.14.5+dfsg-0exp2","2.14.5+dfsg-0.1","2.14.5+dfsg-0.2","2.14.5+dfsg-0.2ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.14.5+dfsg-0.2ubuntu0.2"}]}],"versions":["2.12.7+dfsg+really2.9.14-0.4","2.12.7+dfsg+really2.9.14-0.4ubuntu0.1","2.12.7+dfsg+really2.9.14-1","2.14.3+dfsg-0exp1","2.14.3+dfsg-0exp2","2.14.3+dfsg-0exp3","2.14.4+dfsg-0exp1","2.14.5+dfsg-0exp1","2.14.5+dfsg-0exp2","2.14.5+dfsg-0.1","2.14.5+dfsg-0.2","2.14.5+dfsg-0.2ubuntu0.1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.15.2+dfsg-0.1ubuntu0.1"}]}],"versions":["2.14.5+dfsg-0.2","2.14.5+dfsg-0.2build1","2.15.1+dfsg-0.3","2.15.1+dfsg-0.4","2.15.1+dfsg-1","2.15.1+dfsg-2","2.15.1+dfsg-2ubuntu1","2.15.1+dfsg-2ubuntu2","2.15.2+dfsg-0.1"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.14.5-3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13.8-160000.4.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"libxml2-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13.8-160000.4.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"libxslt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.43-160000.4.1"}]}],"bundled":5}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat hardened images"},{"vendor":"red hat","product":"red hat jboss core services"},{"vendor":"red hat","product":"red hat openshift ai (rhoai)"},{"vendor":"red hat","product":"red hat openshift container platform 4"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:7519","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-1757","tags":["vdb-entry","x_refsource_REDHAT","web","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2435940","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://gitlab.gnome.org/GNOME/libxml2/-/issues/1009","tags":["report","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1757","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-7qq5-wfv8-hvvh"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-1757","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1775649722.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1775731413.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-1757","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1774","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-32415","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-32414","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-6170","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-6021","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-49796","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-49795","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-49794","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-9714","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-26434","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-0992","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-0990","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-0989","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7519.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2372406","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-6021","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-6021","tags":["advisory"]},{"url":"https://gitlab.gnome.org/GNOME/libxml2/-/issues/926","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2372952","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-6170","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-6170","tags":["advisory"]},{"url":"https://gitlab.gnome.org/GNOME/libxml2/-/issues/941","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2392605","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-9714","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-9714","tags":["advisory"]},{"url":"https://gitlab.gnome.org/GNOME/libxml2/-/commit/677a42645ef22b5a50741bad5facf9d8a8bc6d21","tags":["article"]},{"url":"https://gitlab.gnome.org/GNOME/libxslt/-/issues/148","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2393475","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-26434","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-26434","tags":["advisory"]},{"url":"https://gitlab.gnome.org/GNOME/libxml2/-/commit/5e7874015ef5ed8b2705eb2f7b0960f56f7760ea","tags":["article"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-26434","tags":["article"]},{"url":"https://source.android.com/security/bulletin/android-16","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2358121","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-32414","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-32414","tags":["advisory"]},{"url":"https://gitlab.gnome.org/GNOME/libxml2/-/issues/889","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2360768","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-32415","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-32415","tags":["advisory"]},{"url":"https://gitlab.gnome.org/GNOME/libxml2/-/issues/890","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2372373","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-49794","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-49794","tags":["advisory"]},{"url":"https://gitlab.gnome.org/GNOME/libxml2/-/issues/931","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2372379","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-49795","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-49795","tags":["advisory"]},{"url":"https://gitlab.gnome.org/GNOME/libxml2/-/issues/932","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2372385","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-49796","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-49796","tags":["advisory"]},{"url":"https://gitlab.gnome.org/GNOME/libxml2/-/issues/933","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2429933","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-0989","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0989","tags":["advisory"]},{"url":"https://gitlab.gnome.org/GNOME/libxml2/-/issues/998","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2429959","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-0990","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0990","tags":["advisory"]},{"url":"https://gitlab.gnome.org/GNOME/libxml2/-/issues/1018","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2429975","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-0992","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0992","tags":["advisory"]},{"url":"https://gitlab.gnome.org/GNOME/libxml2/-/issues/1019","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-1757","tags":["advisory","report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260568-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1250553","tags":["report"]},{"url":"https://bugzilla.suse.com/1256807","tags":["report"]},{"url":"https://bugzilla.suse.com/1256808","tags":["report"]},{"url":"https://bugzilla.suse.com/1256809","tags":["report"]},{"url":"https://bugzilla.suse.com/1256811","tags":["report"]},{"url":"https://bugzilla.suse.com/1256812","tags":["report"]},{"url":"https://bugzilla.suse.com/1257593","tags":["report"]},{"url":"https://bugzilla.suse.com/1257594","tags":["report"]},{"url":"https://bugzilla.suse.com/1257595","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-10911","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-0990","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-0992","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1757","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260570-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1247850","tags":["report"]},{"url":"https://bugzilla.suse.com/1247858","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-8732","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260605-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1256804","tags":["report"]},{"url":"https://bugzilla.suse.com/1256805","tags":["report"]},{"url":"https://bugzilla.suse.com/1256810","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-0989","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260606-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260782-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620631-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620647-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620657-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620707-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-1757","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8460-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-6732","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-1757","title":"Libxml2: memory leak leading to local denial of service in xmllint interactive shell","description":"A flaw was identified in the interactive shell of the xmllint utility, part of the libxml2 project, where memory allocated for user input is not properly released under certain conditions. When a user submits input consisting only of whitespace, the program skips command execution but fails to free the allocated buffer. Repeating this action causes memory to continuously accumulate. Over time, this can exhaust system memory and terminate the xmllint process, creating a denial-of-service condition on the local system.","status":"published","published":"2026-02-02T12:38:14.588Z","modified":"2026-11-06T07:51:45.914Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-401"],"updated_at":"2026-11-06T08:57:32.08691Z"}],"euvd":[{"id":"EUVD-2026-5101","description":"A flaw was identified in the interactive shell of the xmllint utility, part of the libxml2 project, where memory allocated for user input is not properly released under certain conditions. When a user submits input consisting only of whitespace, the program skips command execution but fails to free the allocated buffer. Repeating this action causes memory to continuously accumulate. Over time, this can exhaust system memory and terminate the xmllint process, creating a denial-of-service condition on the local system.","status":"published","published":"2026-02-02T12:38:14Z","modified":"2026-11-06T07:51:45Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-06T09:04:28.113071Z"}],"ghsa":[{"id":"GHSA-7qq5-wfv8-hvvh","title":"A flaw was identified in the interactive shell of the xmllint utility, part of the libxml2...","description":"A flaw was identified in the interactive shell of the xmllint utility, part of the libxml2 project, where memory allocated for user input is not properly released under certain conditions. When a user submits input consisting only of whitespace, the program skips command execution but fails to free the allocated buffer. Repeating this action causes memory to continuously accumulate. Over time, this can exhaust system memory and terminate the xmllint process, creating a denial-of-service condition on the local system.","status":"published","published":"2026-02-02T15:30:34Z","modified":"2026-04-22T12:30:29Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-401"],"updated_at":"2026-11-02T15:07:34.663272Z"}],"nvd":[{"id":"CVE-2026-1757","description":"A flaw was identified in the interactive shell of the xmllint utility, part of the libxml2 project, where memory allocated for user input is not properly released under certain conditions. When a user submits input consisting only of whitespace, the program skips command execution but fails to free the allocated buffer. Repeating this action causes memory to continuously accumulate. Over time, this can exhaust system memory and terminate the xmllint process, creating a denial-of-service condition on the local system.","status":"published","published":"2026-02-02T13:15:58.58Z","modified":"2026-11-06T08:17:25.533Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-401"],"updated_at":"2026-11-06T11:59:55.485307Z"}],"osv":[{"id":"BELL-CVE-2026-1757","status":"published","published":"2026-02-03T06:08:25.45884Z","modified":"2026-02-11T07:38:15.359537Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:23.037038Z"},{"id":"CVE-2026-1757","description":"A flaw was identified in the interactive shell of the xmllint utility, part of the libxml2 project, where memory allocated for user input is not properly released under certain conditions. When a user submits input consisting only of whitespace, the program skips command execution but fails to free the allocated buffer. Repeating this action causes memory to continuously accumulate. Over time, this can exhaust system memory and terminate the xmllint process, creating a denial-of-service condition on the local system.","status":"published","published":"2026-02-02T13:15:58.58Z","modified":"2026-03-23T05:07:19.377728Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:58.024074Z"},{"id":"DEBIAN-CVE-2026-1757","description":"A flaw was identified in the interactive shell of the xmllint utility, part of the libxml2 project, where memory allocated for user input is not properly released under certain conditions. When a user submits input consisting only of whitespace, the program skips command execution but fails to free the allocated buffer. Repeating this action causes memory to continuously accumulate. Over time, this can exhaust system memory and terminate the xmllint process, creating a denial-of-service condition on the local system.","status":"published","published":"2026-02-02T13:15:58.58Z","modified":"2026-11-07T09:47:38.418435997Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-07T10:14:19.880839Z"},{"id":"OESA-2026-1774","title":"libxml2 security update","description":"This library allows to manipulate XML files. It includes support\nto read, modify and write XML and HTML files. There is DTDs support\nthis includes parsing and validation even with complex DtDs, either\nat parse time or later once the document has been modified. The output\ncan be a simple SAX stream or and in-memory DOM like representations.\nIn this case one can use the built-in XPath and XPointer implementation\nto select sub nodes or ranges. A flexible Input/Output mechanism is\navailable, with existing HTTP and FTP modules and combined to an\nURI library.\r\n\r\n\nSecurity Fix(es):\n\nA flaw was identified in the interactive shell of the xmllint utility, part of the libxml2 project, where memory allocated for user input is not properly released under certain conditions. When a user submits input consisting only of whitespace, the program skips command execution but fails to free the allocated buffer. Repeating this action causes memory to continuously accumulate. Over time, this can exhaust system memory and terminate the xmllint process, creating a denial-of-service condition on the local system.(CVE-2026-1757)","status":"published","published":"2026-03-27T11:10:48Z","modified":"2026-08-18T01:19:45.877593366Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"RHSA-2026:7519","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-04-20T10:11:16Z","modified":"2026-10-15T10:27:00Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2026-1757","title":"CVE-2026-1757 in rootio-libxml2 - Patched by Root","description":"Root has patched CVE-2026-1757 in the rootio-libxml2 package for Root:Debian:12. Multiple fixed versions available.","status":"withdrawn","published":"2026-04-29T12:57:28Z","modified":"2026-07-21T14:00:18.331739588Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:31.773105Z"},{"id":"UBUNTU-CVE-2026-1757","description":"A flaw was identified in the interactive shell of the xmllint utility, part of the libxml2 project, where memory allocated for user input is not properly released under certain conditions. When a user submits input consisting only of whitespace, the program skips command execution but fails to free the allocated buffer. Repeating this action causes memory to continuously accumulate. Over time, this can exhaust system memory and terminate the xmllint process, creating a denial-of-service condition on the local system.","status":"published","published":"2026-02-02T13:15:00Z","modified":"2026-06-23T00:30:06.695445455Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:56:01.334185Z"},{"id":"CLSA-2026-1775649722","title":"libxml2: Fix of 6 CVEs","description":"- CVE-2024-34459: fix buffer over-read in xmlHTMLPrintFileContext in xmllint\n- CVE-2025-8732: fix stack overflow from self-referencing SGML CATALOG entries\n- CVE-2026-0989: add RelaxNG include recursion limit\n- CVE-2026-0990: prevent infinite recursion in xmlCatalogListXMLResolveURI\n- CVE-2026-0992: ignore repeated nextCatalog entries in XML catalog parsing\n- CVE-2026-1757: fix memory leak in xmllint interactive shell","status":"published","published":"2026-04-08T13:30:49Z","modified":"2026-06-01T00:32:21.424502497Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1775731413","title":"libxml2: Fix of 8 CVEs","description":"- CVE-2023-45322: fix use-after-free in xmlStaticCopyNodeList when copying DTDs\n- CVE-2024-34459: fix buffer over-read in xmlHTMLPrintFileContext in xmllint\n- CVE-2025-6170: fix potential buffer overflows in xmllint interactive shell\n- CVE-2025-8732: fix stack overflow from self-referencing SGML CATALOG entries\n- CVE-2026-0989: add RelaxNG include recursion limit\n- CVE-2026-0990: prevent infinite recursion in xmlCatalogListXMLResolveURI\n- CVE-2026-0992: ignore repeated nextCatalog entries in XML catalog parsing\n- CVE-2026-1757: fix memory leak in xmllint interactive shell","status":"published","published":"2026-04-09T10:43:37Z","modified":"2026-06-01T00:32:46.811894925Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"openSUSE-SU-2026:10167-1","title":"libxml2-16-2.14.5-3.1 on GA media","description":"These are all security issues fixed in the libxml2-16-2.14.5-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-02-10T00:00:00Z","modified":"2026-03-23T04:54:32.065671Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:20312-1","title":"Security update for libxml2, libxslt","description":"This update for libxml2, libxslt fixes the following issues:\n\nChanges in libxml2:\n\n- CVE-2026-0990: call stack overflow may lead to application crash due to infinite recursion in\n  `xmlCatalogXMLResolveURI` (bsc#1256807, bsc#1256811).\n- CVE-2026-0992: excessive resource consumption when processing XML catalogs due to exponential behavior when handling\n  `nextCatalog` elements (bsc#1256809, bsc#1256812).\n- CVE-2025-8732: infinite recursion in catalog parsing functions when processing malformed SGML catalog files\n  (bsc#1247858).\n- CVE-2026-1757: memory leak in the `xmllint` interactive shell (bsc#1257594, bsc#1257595).\n- CVE-2025-10911: parsing xsl nodes may lead to use-after-free with key data stored cross-RVT (bsc#1250553)\n","status":"published","published":"2026-03-04T10:51:24Z","modified":"2026-03-05T21:15:10.380704Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"SUSE-SU-2026:0568-1","title":"Security update for libxml2","description":"This update for libxml2 fixes the following issues:\n\n- CVE-2026-0990: Fixed a call stack overflow leading to application crash due to infinite recursion in `xmlCatalogXMLResolveURI`. (bsc#1256807, bsc#1256811)\n- CVE-2026-0992: Fixed an excessive resource consumption when processing XML catalogs due to exponential behavior. (bsc#1256809, bsc#1256812)\n- CVE-2026-1757: Fixed a memory leak in the `xmllint` interactive shell. (bsc#1257594, bsc#1257595)\n- CVE-2025-10911: Fixed a use-after-free with key data stored cross-RVT. (bsc#1250553)\n  ","status":"published","published":"2026-02-17T12:26:27Z","modified":"2026-03-23T04:52:21.420654Z","updated_at":"2026-11-02T15:54:00.846737Z"},{"id":"SUSE-SU-2026:0570-1","title":"Security update for libxml2","description":"This update for libxml2 fixes the following issues:\n\n- CVE-2026-0990: Fixed a call stack overflow leading to application crash due to infinite recursion in `xmlCatalogXMLResolveURI`. (bsc#1256807, bsc#1256811)\n- CVE-2026-0992: Fixed an excessive resource consumption when processing XML catalogs due to exponential behavior. (bsc#1256809, bsc#1256812)\n- CVE-2026-1757: Fixed a memory leak in the `xmllint` interactive shell. (bsc#1257594, bsc#1257595)\n- CVE-2025-10911: Fixed a use-after-free with key data stored cross-RVT. (bsc#1250553)\n- CVE-2025-8732: Fixed an infinite recursion in catalog parsing functions when processing malformed SGML catalog files. (bsc#1247858)\n  ","status":"published","published":"2026-02-17T16:38:51Z","modified":"2026-02-18T15:47:08.091063Z","updated_at":"2026-11-02T15:54:00.846737Z"},{"id":"SUSE-SU-2026:0605-1","title":"Security update for libxml2","description":"This update for libxml2 fixes the following issues:\n\n- CVE-2026-0990: Fixed a call stack overflow leading to application crash due to infinite recursion in `xmlCatalogXMLResolveURI`. (bsc#1256807, bsc#1256811)\n- CVE-2026-0992: Fixed an excessive resource consumption when processing XML catalogs due to exponential behavior. (bsc#1256809, bsc#1256812)\n- CVE-2026-1757: Fixed a memory leak in the `xmllint` interactive shell. (bsc#1257594, bsc#1257595)\n- CVE-2025-10911: Fixed a use-after-free with key data stored cross-RVT. (bsc#1250553)\n- CVE-2025-8732: Fixed an infinite recursion in catalog parsing functions when processing malformed SGML catalog files. (bsc#1247858)\n- CVE-2026-0989: Fixe a call stack exhaustion leading to application crash due to RelaxNG parser not limiting the recursion depth. (bsc#1256805, bsc#1256810)\n","status":"published","published":"2026-02-24T11:19:20Z","modified":"2026-03-23T04:52:23.488836Z","updated_at":"2026-11-02T15:54:00.846737Z"},{"id":"SUSE-SU-2026:0606-1","title":"Security update for libxml2","description":"This update for libxml2 fixes the following issues:\n\n- CVE-2026-0990: Fixed a call stack overflow leading to application crash due to infinite recursion in `xmlCatalogXMLResolveURI`. (bsc#1256807, bsc#1256811)\n- CVE-2026-0992: Fixed an excessive resource consumption when processing XML catalogs due to exponential behavior. (bsc#1256809, bsc#1256812)\n- CVE-2026-1757: Fixed a memory leak in the `xmllint` interactive shell. (bsc#1257594, bsc#1257595)\n- CVE-2025-10911: Fixed a use-after-free with key data stored cross-RVT. (bsc#1250553)\n- CVE-2026-0989: Fixe a call stack exhaustion leading to application crash due to RelaxNG parser not limiting the recursion depth. (bsc#1256805, bsc#1256810)\n","status":"published","published":"2026-02-24T11:19:39Z","modified":"2026-03-23T04:52:23.547661Z","updated_at":"2026-11-02T15:54:00.846737Z"},{"id":"SUSE-SU-2026:0782-1","title":"Security update for libxml2","description":"This update for libxml2 fixes the following issues:\n\n- CVE-2026-0990: Fixed a call stack overflow leading to application crash due to infinite recursion in `xmlCatalogXMLResolveURI`. (bsc#1256807, bsc#1256811)\n- CVE-2026-0992: Fixed an excessive resource consumption when processing XML catalogs due to exponential behavior. (bsc#1256809, bsc#1256812)\n- CVE-2026-1757: Fixed a memory leak in the `xmllint` interactive shell. (bsc#1257594, bsc#1257595)\n- CVE-2025-10911: Fixed a use-after-free with key data stored cross-RVT. (bsc#1250553)\n  ","status":"published","published":"2026-03-03T13:35:15Z","modified":"2026-03-04T22:17:00.854583Z","updated_at":"2026-11-02T15:54:01.262144Z"},{"id":"SUSE-SU-2026:20631-1","title":"Security update for libxml2, libxslt","description":"This update for libxml2, libxslt fixes the following issues:\n\nChanges in libxml2:\n\n- CVE-2026-0990: call stack overflow may lead to application crash due to infinite recursion in\n  `xmlCatalogXMLResolveURI` (bsc#1256807, bsc#1256811).\n- CVE-2026-0992: excessive resource consumption when processing XML catalogs due to exponential behavior when handling\n  `nextCatalog` elements (bsc#1256809, bsc#1256812).\n- CVE-2025-8732: infinite recursion in catalog parsing functions when processing malformed SGML catalog files\n  (bsc#1247858).\n- CVE-2026-1757: memory leak in the `xmllint` interactive shell (bsc#1257594, bsc#1257595).\n- CVE-2025-10911: parsing xsl nodes may lead to use-after-free with key data stored cross-RVT (bsc#1250553)\n","status":"published","published":"2026-03-04T10:51:03Z","modified":"2026-03-23T04:53:05.647345Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"SUSE-SU-2026:20647-1","title":"Security update for libxml2, libxslt","description":"This update for libxml2, libxslt fixes the following issues:\n\nChanges in libxml2:\n\n- CVE-2026-0990: call stack overflow may lead to application crash due to infinite recursion in\n  `xmlCatalogXMLResolveURI` (bsc#1256807, bsc#1256811).\n- CVE-2026-0992: excessive resource consumption when processing XML catalogs due to exponential behavior when handling\n  `nextCatalog` elements (bsc#1256809, bsc#1256812).\n- CVE-2025-8732: infinite recursion in catalog parsing functions when processing malformed SGML catalog files\n  (bsc#1247858).\n- CVE-2026-1757: memory leak in the `xmllint` interactive shell (bsc#1257594, bsc#1257595).\n- CVE-2025-10911: parsing xsl nodes may lead to use-after-free with key data stored cross-RVT (bsc#1250553)\n","status":"published","published":"2026-03-04T10:51:03Z","modified":"2026-03-23T04:53:06.17325Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"SUSE-SU-2026:20657-1","title":"Security update for libxslt, libxml2","description":"This update for libxslt, libxml2 fixes the following issues:\n\nlibxml2:\n\n- CVE-2026-0990: call stack overflow leading to application crash \n  due to infinite recursion in `xmlCatalogXMLResolveURI` (bsc#1256807, bsc#1256811)\n\n- CVE-2026-0992: excessive resource consumption when processing XML \n  catalogs due to exponential behavior when handling `\u003cnextCatalog\u003e` elements (bsc#1256808, bsc#1256809, bsc#1256812)\n\n- CVE-2025-8732: infinite recursion in catalog parsing functions when processing malformed SGML catalog files (bsc#1247858, bsc#1247850)\n\n- CVE-2026-1757: memory leak in the `xmllint` interactive shell (bsc#1257593, bsc#1257594, bsc#1257595)\n\n- CVE-2025-10911: use-after-free with key data stored cross-RVT (bsc#1250553)\n\n- CVE-2026-0989: call stack exhaustion leading to application crash \n  due to RelaxNG parser not limiting the recursion depth when \n  resolving `\u003cinclude\u003e` directives (bsc#1256804, bsc#1256805, bsc#1256810)\n\nlibxslt:\n\n- CVE-2025-10911 will be fixed on libxml2 side instead [bsc#1250553]\n","status":"published","published":"2026-03-06T11:37:27Z","modified":"2026-03-23T04:53:06.691721Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"SUSE-SU-2026:20707-1","title":"Security update for libxslt, libxml2","description":"This update for libxslt, libxml2 fixes the following issues:\n\nChanges in libxml2:\n\n- CVE-2026-0990: call stack overflow may lead to application crash due to infinite recursion in\n  `xmlCatalogXMLResolveURI` (bsc#1256807, bsc#1256811).\n- CVE-2026-0992: excessive resource consumption when processing XML catalogs due to exponential behavior when handling\n  `nextCatalog` elements (bsc#1256809, bsc#1256812).\n- CVE-2025-8732: infinite recursion in catalog parsing functions when processing malformed SGML catalog files\n  (bsc#1247858).\n- CVE-2026-1757: memory leak in the `xmllint` interactive shell (bsc#1257594, bsc#1257595).\n- CVE-2025-10911: parsing xsl nodes may lead to use-after-free with key data stored cross-RVT (bsc#1250553).\n","status":"published","published":"2026-03-06T11:53:41Z","modified":"2026-03-23T04:53:09.014684Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"USN-8460-1","title":"libxml2 vulnerabilities","description":"It was discovered that libxml2 did not properly release memory allocated in\nthe xmllint utility. An attacker could possibly use this issue to cause a\ndenial of service. (CVE-2026-1757)\n\nA type confusion vulnerability was found in libxml2 when processing a\nspecially crafted XML document. A remote attacker could possibly use this\nissue to cause a denial of service. (CVE-2026-6732)","status":"published","published":"2026-06-22T17:10:23Z","modified":"2026-06-23T04:49:21.672829756Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}