{"id":"CVE-2026-74860","aliases":["ALSA-2026:71585","ALSA-2026:71586","ALSA-2026:71641","AZL-100941","BELL-CVE-2026-74860","CLSA-2026-1790786185","CLSA-2026-1790833998","CLSA-2026-1791280039","CLSA-2026-1791372460","CLSA-2026-1791489916","CLSA-2026-1791493216","CLSA-2026-1791551729","CLSA-2026-1792537548","DEBIAN-CVE-2026-74860","EUVD-2026-72691","GHSA-8626-cqqj-mfff","RHSA-2026:64463","RHSA-2026:71585","RHSA-2026:71586","RHSA-2026:71641","RLSA-2026:71585","RLSA-2026:71586","RLSA-2026:71641","ROOT-OS-DEBIAN-12-CVE-2026-74860","UBUNTU-CVE-2026-74860","USN-8787-1"],"status":"published","title":"Libxml2: double-free/uaf in libxml2 python bindings","description":"A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition (DTD) with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callback handler, where a string is freed twice. This flaw can lead to a denial of service (DoS) due to a reproducible crash in Python applications using the libxml2 SAX bindings.","severity":{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00658,"percentile":0.51929,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-763"],"published":"2026-09-08T11:27:45Z","modified":"2026-11-11T15:31:43Z","fixes":[{"ecosystem":"Azure Linux:3","package":"libxml2","fixed_in":["2.11.5-11"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"libxml2","fixed_in":["2.10.4-r11"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"libxml2","fixed_in":["2.13.9-r5"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"libxml2","fixed_in":["2.13.9-r6"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:23","package":"libxml2","fixed_in":["2.10.4-r11"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:25","package":"libxml2","fixed_in":["2.13.9-r5"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"libxml2","fixed_in":["2.13.9-r6"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"libxml2","fixed_in":["2.9.13-12.el9_6.tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"libxml2-devel","fixed_in":["2.9.13-12.el9_6.tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"libxml2-static","fixed_in":["2.9.13-12.el9_6.tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"python3-libxml2","fixed_in":["2.9.13-12.el9_6.tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"libxml2","fixed_in":["2.9.13-3.el9_2.1.tuxcare.els18"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"libxml2-devel","fixed_in":["2.9.13-3.el9_2.1.tuxcare.els18"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"libxml2-static","fixed_in":["2.9.13-3.el9_2.1.tuxcare.els18"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"python3-libxml2","fixed_in":["2.9.13-3.el9_2.1.tuxcare.els18"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"libxml2","fixed_in":["2.9.7-9.el8_4.2.tuxcare.els19"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"libxml2-devel","fixed_in":["2.9.7-9.el8_4.2.tuxcare.els19"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"libxml2-static","fixed_in":["2.9.7-9.el8_4.2.tuxcare.els19"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"python3-libxml2","fixed_in":["2.9.7-9.el8_4.2.tuxcare.els19"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"libxml2","fixed_in":["2.9.7-18.el8.tuxcare.els14"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"libxml2-devel","fixed_in":["2.9.7-18.el8.tuxcare.els14"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"libxml2-static","fixed_in":["2.9.7-18.el8.tuxcare.els14"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"python3-libxml2","fixed_in":["2.9.7-18.el8.tuxcare.els14"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:20.04","package":"libxml2","fixed_in":["2.9.10+dfsg-5ubuntu0.20.04.10+tuxcare.els16"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:20.04","package":"libxml2-dev","fixed_in":["2.9.10+dfsg-5ubuntu0.20.04.10+tuxcare.els16"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:20.04","package":"libxml2-doc","fixed_in":["2.9.10+dfsg-5ubuntu0.20.04.10+tuxcare.els16"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:20.04","package":"libxml2-utils","fixed_in":["2.9.10+dfsg-5ubuntu0.20.04.10+tuxcare.els16"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:20.04","package":"python-libxml2","fixed_in":["2.9.10+dfsg-5ubuntu0.20.04.10+tuxcare.els16"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:20.04","package":"python3-libxml2","fixed_in":["2.9.10+dfsg-5ubuntu0.20.04.10+tuxcare.els16"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libxml2","fixed_in":["2.9.4+dfsg1-6.1ubuntu1.9+tuxcare.els12"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libxml2-dev","fixed_in":["2.9.4+dfsg1-6.1ubuntu1.9+tuxcare.els12"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libxml2-doc","fixed_in":["2.9.4+dfsg1-6.1ubuntu1.9+tuxcare.els12"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libxml2-utils","fixed_in":["2.9.4+dfsg1-6.1ubuntu1.9+tuxcare.els12"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"python-libxml2","fixed_in":["2.9.4+dfsg1-6.1ubuntu1.9+tuxcare.els12"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"python3-libxml2","fixed_in":["2.9.4+dfsg1-6.1ubuntu1.9+tuxcare.els12"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"libxml2","fixed_in":["2.9.3+dfsg1-1ubuntu0.7+tuxcare.els17"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"libxml2-dev","fixed_in":["2.9.3+dfsg1-1ubuntu0.7+tuxcare.els17"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"libxml2-doc","fixed_in":["2.9.3+dfsg1-1ubuntu0.7+tuxcare.els17"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"libxml2-utils","fixed_in":["2.9.3+dfsg1-1ubuntu0.7+tuxcare.els17"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"python-libxml2","fixed_in":["2.9.3+dfsg1-1ubuntu0.7+tuxcare.els17"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libxml2","fixed_in":["2.15.3+dfsg-1"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"libxml2","fixed_in":["2.9.14+dfsg-1.3~deb12u6.aikido.19","2.9.14+dfsg-1.3~deb12u6.aikido.20"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-libxml2","fixed_in":["2.9.14+dfsg-1.3~deb12u6.aikido.19","2.9.14+dfsg-1.3~deb12u6.aikido.20"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libxml2","fixed_in":["2.9.1+dfsg1-3ubuntu4.13+esm12"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libxml2","fixed_in":["2.9.3+dfsg1-1ubuntu0.7+esm13"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libxml2","fixed_in":["2.9.4+dfsg1-6.1ubuntu1.9+esm8"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libxml2","fixed_in":["2.9.10+dfsg-5ubuntu0.20.04.10+esm5"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"libxml2","fixed_in":["2.9.13+dfsg-1ubuntu0.13"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"libxml2","fixed_in":["2.9.14+dfsg-1.3ubuntu3.9"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"libxml2","fixed_in":["2.15.2+dfsg-0.1ubuntu0.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:9","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.13-14.el9_8.5"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"libxml2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.13-14.el9_8.5"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"python3-libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.13-14.el9_8.5"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12.5-10.el10_2.4"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"libxml2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12.5-10.el10_2.4"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"libxml2-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12.5-10.el10_2.4"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"python3-libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12.5-10.el10_2.4"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.7-21.el8_10.9"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libxml2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.7-21.el8_10.9"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"python3-libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.7-21.el8_10.9"}]}],"bundled":5},{"source":"osv","ecosystem":"Azure Linux:3","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.5-11"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.10.3-r2"},{"fixed":"2.10.4-r11"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.13.8-r0"},{"fixed":"2.13.9-r5"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.10.3-r2"},{"fixed":"2.13.9-r6"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:23","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.10.3-r2"},{"fixed":"2.10.4-r11"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:25","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.13.8-r0"},{"fixed":"2.13.9-r5"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.10.3-r2"},{"fixed":"2.13.9-r6"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.13-12.el9_6.tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"libxml2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.13-12.el9_6.tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"libxml2-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.13-12.el9_6.tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"python3-libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.13-12.el9_6.tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.13-3.el9_2.1.tuxcare.els18"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libxml2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.13-3.el9_2.1.tuxcare.els18"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libxml2-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.13-3.el9_2.1.tuxcare.els18"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"python3-libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.13-3.el9_2.1.tuxcare.els18"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.7-9.el8_4.2.tuxcare.els19"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"libxml2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.7-9.el8_4.2.tuxcare.els19"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"libxml2-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.7-9.el8_4.2.tuxcare.els19"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"python3-libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.7-9.el8_4.2.tuxcare.els19"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.7-18.el8.tuxcare.els14"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"libxml2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.7-18.el8.tuxcare.els14"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"libxml2-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.7-18.el8.tuxcare.els14"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"python3-libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.7-18.el8.tuxcare.els14"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.10+dfsg-5ubuntu0.20.04.10+tuxcare.els16"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"libxml2-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.10+dfsg-5ubuntu0.20.04.10+tuxcare.els16"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"libxml2-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.10+dfsg-5ubuntu0.20.04.10+tuxcare.els16"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"libxml2-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.10+dfsg-5ubuntu0.20.04.10+tuxcare.els16"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"python-libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.10+dfsg-5ubuntu0.20.04.10+tuxcare.els16"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"python3-libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.10+dfsg-5ubuntu0.20.04.10+tuxcare.els16"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4+dfsg1-6.1ubuntu1.9+tuxcare.els12"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libxml2-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4+dfsg1-6.1ubuntu1.9+tuxcare.els12"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libxml2-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4+dfsg1-6.1ubuntu1.9+tuxcare.els12"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libxml2-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4+dfsg1-6.1ubuntu1.9+tuxcare.els12"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"python-libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4+dfsg1-6.1ubuntu1.9+tuxcare.els12"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"python3-libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4+dfsg1-6.1ubuntu1.9+tuxcare.els12"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.3+dfsg1-1ubuntu0.7+tuxcare.els17"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libxml2-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.3+dfsg1-1ubuntu0.7+tuxcare.els17"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libxml2-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.3+dfsg1-1ubuntu0.7+tuxcare.els17"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libxml2-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.3+dfsg1-1ubuntu0.7+tuxcare.els17"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"python-libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.3+dfsg1-1ubuntu0.7+tuxcare.els17"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.10+dfsg-5ubuntu0.20.04.10+tuxcare.els16"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libxml2-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.10+dfsg-5ubuntu0.20.04.10+tuxcare.els16"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libxml2-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.10+dfsg-5ubuntu0.20.04.10+tuxcare.els16"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libxml2-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.10+dfsg-5ubuntu0.20.04.10+tuxcare.els16"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"python-libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.10+dfsg-5ubuntu0.20.04.10+tuxcare.els16"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"python3-libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.10+dfsg-5ubuntu0.20.04.10+tuxcare.els16"}]}],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.12.3+dfsg-0exp1","2.12.5+dfsg-0exp1","2.12.6+dfsg-0exp1","2.12.6+dfsg-0exp2","2.12.7+dfsg+really2.9.14-0.1","2.12.7+dfsg+really2.9.14-0.2","2.12.7+dfsg+really2.9.14-0.3","2.12.7+dfsg+really2.9.14-0.4","2.12.7+dfsg+really2.9.14-1","2.12.7+dfsg+really2.9.14-2","2.12.7+dfsg+really2.9.14-2.1","2.12.7+dfsg-1","2.12.7+dfsg-2","2.12.7+dfsg-3","2.13.1+dfsg-0exp1","2.13.3+dfsg-0exp1","2.13.3+dfsg-0exp2","2.14.1+dfsg-0exp1","2.14.2+dfsg-0exp1","2.14.3+dfsg-0exp1","2.14.3+dfsg-0exp2","2.14.3+dfsg-0exp3","2.14.4+dfsg-0exp1","2.14.5+dfsg-0.1","2.14.5+dfsg-0.2","2.14.5+dfsg-0exp1","2.14.5+dfsg-0exp2","2.14.6+dfsg-0.1","2.15.0+dfsg-0.1","2.15.0+dfsg-0.2","2.15.0+dfsg-0.3","2.15.1+dfsg-0.1","2.15.1+dfsg-0.2","2.15.1+dfsg-0.3","2.15.1+dfsg-0.4","2.15.1+dfsg-0.5","2.15.1+dfsg-1","2.15.1+dfsg-2","2.15.2+dfsg-0.1","2.15.3+dfsg-1","2.15.4+dfsg-1","2.9.14+dfsg-1.2","2.9.14+dfsg-1.3","2.9.14+dfsg-1.3~deb12u1","2.9.14+dfsg-1.3~deb12u2","2.9.14+dfsg-1.3~deb12u3","2.9.14+dfsg-1.3~deb12u4","2.9.14+dfsg-1.3~deb12u5","2.9.14+dfsg-1.3~deb12u6"]},{"source":"osv","ecosystem":"Debian:13","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.12.7+dfsg+really2.9.14-2.1","2.12.7+dfsg+really2.9.14-2.1+deb13u1","2.12.7+dfsg+really2.9.14-2.1+deb13u2","2.12.7+dfsg+really2.9.14-2.1+deb13u3","2.13.1+dfsg-0exp1","2.13.3+dfsg-0exp1","2.13.3+dfsg-0exp2","2.14.1+dfsg-0exp1","2.14.2+dfsg-0exp1","2.14.3+dfsg-0exp1","2.14.3+dfsg-0exp2","2.14.3+dfsg-0exp3","2.14.4+dfsg-0exp1","2.14.5+dfsg-0.1","2.14.5+dfsg-0.2","2.14.5+dfsg-0exp1","2.14.5+dfsg-0exp2","2.14.6+dfsg-0.1","2.15.0+dfsg-0.1","2.15.0+dfsg-0.2","2.15.0+dfsg-0.3","2.15.1+dfsg-0.1","2.15.1+dfsg-0.2","2.15.1+dfsg-0.3","2.15.1+dfsg-0.4","2.15.1+dfsg-0.5","2.15.1+dfsg-1","2.15.1+dfsg-2","2.15.2+dfsg-0.1","2.15.3+dfsg-1","2.15.4+dfsg-1"]},{"source":"osv","ecosystem":"Debian:14","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.15.3+dfsg-1"}]}],"versions":["2.12.7+dfsg+really2.9.14-2.1","2.13.1+dfsg-0exp1","2.13.3+dfsg-0exp1","2.13.3+dfsg-0exp2","2.14.1+dfsg-0exp1","2.14.2+dfsg-0exp1","2.14.3+dfsg-0exp1","2.14.3+dfsg-0exp2","2.14.3+dfsg-0exp3","2.14.4+dfsg-0exp1","2.14.5+dfsg-0.1","2.14.5+dfsg-0.2","2.14.5+dfsg-0exp1","2.14.5+dfsg-0exp2","2.14.6+dfsg-0.1","2.15.0+dfsg-0.1","2.15.0+dfsg-0.2","2.15.0+dfsg-0.3","2.15.1+dfsg-0.1","2.15.1+dfsg-0.2","2.15.1+dfsg-0.3","2.15.1+dfsg-0.4","2.15.1+dfsg-0.5","2.15.1+dfsg-1","2.15.1+dfsg-2","2.15.2+dfsg-0.1"]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.15.4-0.1.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libxml2-16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.15.4-0.1.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libxml2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.15.4-0.1.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libxml2-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.15.4-0.1.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3-libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.15.4-0.1.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libxml2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.13-14.el9_8.5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libxml2-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.13-14.el9_8.5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libxml2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.13-14.el9_8.5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python3-libxml2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.13-14.el9_8.5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.13-14.el9_8.5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libxml2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.13-14.el9_8.5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libxml2-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.13-14.el9_8.5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"python3-libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.13-14.el9_8.5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"python3-libxml2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.13-14.el9_8.5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libxml2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12.5-10.el10_2.4"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libxml2-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12.5-10.el10_2.4"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libxml2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12.5-10.el10_2.4"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"python3-libxml2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12.5-10.el10_2.4"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12.5-10.el10_2.4"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"python3-libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12.5-10.el10_2.4"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libxml2-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12.5-10.el10_2.4"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libxml2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.7-21.el8_10.9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libxml2-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.7-21.el8_10.9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libxml2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.7-21.el8_10.9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python3-libxml2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.7-21.el8_10.9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.7-21.el8_10.9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libxml2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.7-21.el8_10.9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libxml2-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.7-21.el8_10.9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"python3-libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.7-21.el8_10.9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"python3-libxml2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.7-21.el8_10.9"}]}],"bundled":5},{"source":"osv","ecosystem":"Rocky Linux:9","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.13-14.el9_8.5"}]}],"bundled":6},{"source":"osv","ecosystem":"Rocky Linux:10","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12.5-10.el10_2.4"}]}],"bundled":6},{"source":"osv","ecosystem":"Rocky Linux:8","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.7-21.el8_10.9"}]}],"bundled":5},{"source":"osv","ecosystem":"Root:Debian:12","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.14+dfsg-1.3~deb12u6.aikido.19"},{"fixed":"2.9.14+dfsg-1.3~deb12u6.aikido.20"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.14+dfsg-1.3~deb12u6.aikido.19"},{"fixed":"2.9.14+dfsg-1.3~deb12u6.aikido.20"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.1+dfsg1-3ubuntu4.13+esm12"}]}],"versions":["2.9.1+dfsg1-3ubuntu2","2.9.1+dfsg1-3ubuntu3","2.9.1+dfsg1-3ubuntu4","2.9.1+dfsg1-3ubuntu4.1","2.9.1+dfsg1-3ubuntu4.2","2.9.1+dfsg1-3ubuntu4.3","2.9.1+dfsg1-3ubuntu4.4","2.9.1+dfsg1-3ubuntu4.5","2.9.1+dfsg1-3ubuntu4.6","2.9.1+dfsg1-3ubuntu4.7","2.9.1+dfsg1-3ubuntu4.8","2.9.1+dfsg1-3ubuntu4.9","2.9.1+dfsg1-3ubuntu4.10","2.9.1+dfsg1-3ubuntu4.11","2.9.1+dfsg1-3ubuntu4.12","2.9.1+dfsg1-3ubuntu4.13","2.9.1+dfsg1-3ubuntu4.13+esm1","2.9.1+dfsg1-3ubuntu4.13+esm2","2.9.1+dfsg1-3ubuntu4.13+esm3","2.9.1+dfsg1-3ubuntu4.13+esm4","2.9.1+dfsg1-3ubuntu4.13+esm5","2.9.1+dfsg1-3ubuntu4.13+esm6","2.9.1+dfsg1-3ubuntu4.13+esm7","2.9.1+dfsg1-3ubuntu4.13+esm8","2.9.1+dfsg1-3ubuntu4.13+esm9","2.9.1+dfsg1-3ubuntu4.13+esm10","2.9.1+dfsg1-3ubuntu4.13+esm11"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.3+dfsg1-1ubuntu0.7+esm13"}]}],"versions":["2.9.2+zdfsg1-4","2.9.2+zdfsg1-4ubuntu1","2.9.2+zdfsg1-4ubuntu2","2.9.2+zdfsg1-4ubuntu3","2.9.3+dfsg1-1","2.9.3+dfsg1-1ubuntu0.1","2.9.3+dfsg1-1ubuntu0.2","2.9.3+dfsg1-1ubuntu0.3","2.9.3+dfsg1-1ubuntu0.4","2.9.3+dfsg1-1ubuntu0.5","2.9.3+dfsg1-1ubuntu0.6","2.9.3+dfsg1-1ubuntu0.7","2.9.3+dfsg1-1ubuntu0.7+esm1","2.9.3+dfsg1-1ubuntu0.7+esm2","2.9.3+dfsg1-1ubuntu0.7+esm3","2.9.3+dfsg1-1ubuntu0.7+esm4","2.9.3+dfsg1-1ubuntu0.7+esm5","2.9.3+dfsg1-1ubuntu0.7+esm6","2.9.3+dfsg1-1ubuntu0.7+esm7","2.9.3+dfsg1-1ubuntu0.7+esm8","2.9.3+dfsg1-1ubuntu0.7+esm9","2.9.3+dfsg1-1ubuntu0.7+esm10","2.9.3+dfsg1-1ubuntu0.7+esm11","2.9.3+dfsg1-1ubuntu0.7+esm12"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4+dfsg1-6.1ubuntu1.9+esm8"}]}],"versions":["2.9.4+dfsg1-4ubuntu1","2.9.4+dfsg1-5ubuntu1","2.9.4+dfsg1-5ubuntu2","2.9.4+dfsg1-5.1ubuntu1","2.9.4+dfsg1-5.2ubuntu1","2.9.4+dfsg1-6.1ubuntu1","2.9.4+dfsg1-6.1ubuntu1.2","2.9.4+dfsg1-6.1ubuntu1.3","2.9.4+dfsg1-6.1ubuntu1.4","2.9.4+dfsg1-6.1ubuntu1.5","2.9.4+dfsg1-6.1ubuntu1.6","2.9.4+dfsg1-6.1ubuntu1.7","2.9.4+dfsg1-6.1ubuntu1.8","2.9.4+dfsg1-6.1ubuntu1.9","2.9.4+dfsg1-6.1ubuntu1.9+esm1","2.9.4+dfsg1-6.1ubuntu1.9+esm2","2.9.4+dfsg1-6.1ubuntu1.9+esm3","2.9.4+dfsg1-6.1ubuntu1.9+esm4","2.9.4+dfsg1-6.1ubuntu1.9+esm5","2.9.4+dfsg1-6.1ubuntu1.9+esm6","2.9.4+dfsg1-6.1ubuntu1.9+esm7"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.10+dfsg-5ubuntu0.20.04.10+esm5"}]}],"versions":["2.9.4+dfsg1-7ubuntu3","2.9.4+dfsg1-7ubuntu5","2.9.4+dfsg1-8ubuntu1","2.9.4+dfsg1-8ubuntu2","2.9.4+dfsg1-8ubuntu3","2.9.10+dfsg-1ubuntu3","2.9.10+dfsg-4build1","2.9.10+dfsg-5","2.9.10+dfsg-5ubuntu0.20.04.1","2.9.10+dfsg-5ubuntu0.20.04.2","2.9.10+dfsg-5ubuntu0.20.04.3","2.9.10+dfsg-5ubuntu0.20.04.4","2.9.10+dfsg-5ubuntu0.20.04.5","2.9.10+dfsg-5ubuntu0.20.04.6","2.9.10+dfsg-5ubuntu0.20.04.7","2.9.10+dfsg-5ubuntu0.20.04.8","2.9.10+dfsg-5ubuntu0.20.04.9","2.9.10+dfsg-5ubuntu0.20.04.10","2.9.10+dfsg-5ubuntu0.20.04.10+esm1","2.9.10+dfsg-5ubuntu0.20.04.10+esm2","2.9.10+dfsg-5ubuntu0.20.04.10+esm3","2.9.10+dfsg-5ubuntu0.20.04.10+esm4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.13+dfsg-1ubuntu0.13"}]}],"versions":["2.9.12+dfsg-4","2.9.12+dfsg-5","2.9.12+dfsg-6","2.9.13+dfsg-1","2.9.13+dfsg-1build1","2.9.13+dfsg-1ubuntu0.1","2.9.13+dfsg-1ubuntu0.2","2.9.13+dfsg-1ubuntu0.3","2.9.13+dfsg-1ubuntu0.4","2.9.13+dfsg-1ubuntu0.5","2.9.13+dfsg-1ubuntu0.6","2.9.13+dfsg-1ubuntu0.7","2.9.13+dfsg-1ubuntu0.8","2.9.13+dfsg-1ubuntu0.9","2.9.13+dfsg-1ubuntu0.10","2.9.13+dfsg-1ubuntu0.11","2.9.13+dfsg-1ubuntu0.12"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.14+dfsg-1.3ubuntu3.9"}]}],"versions":["2.9.14+dfsg-1.3","2.9.14+dfsg-1.3build1","2.9.14+dfsg-1.3build2","2.9.14+dfsg-1.3build3","2.9.14+dfsg-1.3ubuntu1","2.9.14+dfsg-1.3ubuntu2","2.9.14+dfsg-1.3ubuntu3","2.9.14+dfsg-1.3ubuntu3.1","2.9.14+dfsg-1.3ubuntu3.2","2.9.14+dfsg-1.3ubuntu3.3","2.9.14+dfsg-1.3ubuntu3.4","2.9.14+dfsg-1.3ubuntu3.5","2.9.14+dfsg-1.3ubuntu3.6","2.9.14+dfsg-1.3ubuntu3.7","2.9.14+dfsg-1.3ubuntu3.8"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.15.2+dfsg-0.1ubuntu0.2"}]}],"versions":["2.14.5+dfsg-0.2","2.14.5+dfsg-0.2build1","2.15.1+dfsg-0.3","2.15.1+dfsg-0.4","2.15.1+dfsg-1","2.15.1+dfsg-2","2.15.1+dfsg-2ubuntu1","2.15.1+dfsg-2ubuntu2","2.15.2+dfsg-0.1","2.15.2+dfsg-0.1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.1+dfsg1-3ubuntu4.13+esm12"}]}],"versions":["2.9.1+dfsg1-3ubuntu2","2.9.1+dfsg1-3ubuntu3","2.9.1+dfsg1-3ubuntu4","2.9.1+dfsg1-3ubuntu4.1","2.9.1+dfsg1-3ubuntu4.2","2.9.1+dfsg1-3ubuntu4.3","2.9.1+dfsg1-3ubuntu4.4","2.9.1+dfsg1-3ubuntu4.5","2.9.1+dfsg1-3ubuntu4.6","2.9.1+dfsg1-3ubuntu4.7","2.9.1+dfsg1-3ubuntu4.8","2.9.1+dfsg1-3ubuntu4.9","2.9.1+dfsg1-3ubuntu4.10","2.9.1+dfsg1-3ubuntu4.11","2.9.1+dfsg1-3ubuntu4.12","2.9.1+dfsg1-3ubuntu4.13","2.9.1+dfsg1-3ubuntu4.13+esm1","2.9.1+dfsg1-3ubuntu4.13+esm2","2.9.1+dfsg1-3ubuntu4.13+esm3","2.9.1+dfsg1-3ubuntu4.13+esm4","2.9.1+dfsg1-3ubuntu4.13+esm5","2.9.1+dfsg1-3ubuntu4.13+esm6","2.9.1+dfsg1-3ubuntu4.13+esm7","2.9.1+dfsg1-3ubuntu4.13+esm8","2.9.1+dfsg1-3ubuntu4.13+esm9","2.9.1+dfsg1-3ubuntu4.13+esm10","2.9.1+dfsg1-3ubuntu4.13+esm11"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.3+dfsg1-1ubuntu0.7+esm13"}]}],"versions":["2.9.2+zdfsg1-4","2.9.2+zdfsg1-4ubuntu1","2.9.2+zdfsg1-4ubuntu2","2.9.2+zdfsg1-4ubuntu3","2.9.3+dfsg1-1","2.9.3+dfsg1-1ubuntu0.1","2.9.3+dfsg1-1ubuntu0.2","2.9.3+dfsg1-1ubuntu0.3","2.9.3+dfsg1-1ubuntu0.4","2.9.3+dfsg1-1ubuntu0.5","2.9.3+dfsg1-1ubuntu0.6","2.9.3+dfsg1-1ubuntu0.7","2.9.3+dfsg1-1ubuntu0.7+esm1","2.9.3+dfsg1-1ubuntu0.7+esm2","2.9.3+dfsg1-1ubuntu0.7+esm3","2.9.3+dfsg1-1ubuntu0.7+esm4","2.9.3+dfsg1-1ubuntu0.7+esm5","2.9.3+dfsg1-1ubuntu0.7+esm6","2.9.3+dfsg1-1ubuntu0.7+esm7","2.9.3+dfsg1-1ubuntu0.7+esm8","2.9.3+dfsg1-1ubuntu0.7+esm9","2.9.3+dfsg1-1ubuntu0.7+esm10","2.9.3+dfsg1-1ubuntu0.7+esm11","2.9.3+dfsg1-1ubuntu0.7+esm12"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4+dfsg1-6.1ubuntu1.9+esm8"}]}],"versions":["2.9.4+dfsg1-4ubuntu1","2.9.4+dfsg1-5ubuntu1","2.9.4+dfsg1-5ubuntu2","2.9.4+dfsg1-5.1ubuntu1","2.9.4+dfsg1-5.2ubuntu1","2.9.4+dfsg1-6.1ubuntu1","2.9.4+dfsg1-6.1ubuntu1.2","2.9.4+dfsg1-6.1ubuntu1.3","2.9.4+dfsg1-6.1ubuntu1.4","2.9.4+dfsg1-6.1ubuntu1.5","2.9.4+dfsg1-6.1ubuntu1.6","2.9.4+dfsg1-6.1ubuntu1.7","2.9.4+dfsg1-6.1ubuntu1.8","2.9.4+dfsg1-6.1ubuntu1.9","2.9.4+dfsg1-6.1ubuntu1.9+esm1","2.9.4+dfsg1-6.1ubuntu1.9+esm2","2.9.4+dfsg1-6.1ubuntu1.9+esm3","2.9.4+dfsg1-6.1ubuntu1.9+esm4","2.9.4+dfsg1-6.1ubuntu1.9+esm5","2.9.4+dfsg1-6.1ubuntu1.9+esm6","2.9.4+dfsg1-6.1ubuntu1.9+esm7"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.10+dfsg-5ubuntu0.20.04.10+esm5"}]}],"versions":["2.9.4+dfsg1-7ubuntu3","2.9.4+dfsg1-7ubuntu5","2.9.4+dfsg1-8ubuntu1","2.9.4+dfsg1-8ubuntu2","2.9.4+dfsg1-8ubuntu3","2.9.10+dfsg-1ubuntu3","2.9.10+dfsg-4build1","2.9.10+dfsg-5","2.9.10+dfsg-5ubuntu0.20.04.1","2.9.10+dfsg-5ubuntu0.20.04.2","2.9.10+dfsg-5ubuntu0.20.04.3","2.9.10+dfsg-5ubuntu0.20.04.4","2.9.10+dfsg-5ubuntu0.20.04.5","2.9.10+dfsg-5ubuntu0.20.04.6","2.9.10+dfsg-5ubuntu0.20.04.7","2.9.10+dfsg-5ubuntu0.20.04.8","2.9.10+dfsg-5ubuntu0.20.04.9","2.9.10+dfsg-5ubuntu0.20.04.10","2.9.10+dfsg-5ubuntu0.20.04.10+esm1","2.9.10+dfsg-5ubuntu0.20.04.10+esm2","2.9.10+dfsg-5ubuntu0.20.04.10+esm3","2.9.10+dfsg-5ubuntu0.20.04.10+esm4"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.13+dfsg-1ubuntu0.13"}]}],"versions":["2.9.12+dfsg-4","2.9.12+dfsg-5","2.9.12+dfsg-6","2.9.13+dfsg-1","2.9.13+dfsg-1build1","2.9.13+dfsg-1ubuntu0.1","2.9.13+dfsg-1ubuntu0.2","2.9.13+dfsg-1ubuntu0.3","2.9.13+dfsg-1ubuntu0.4","2.9.13+dfsg-1ubuntu0.5","2.9.13+dfsg-1ubuntu0.6","2.9.13+dfsg-1ubuntu0.7","2.9.13+dfsg-1ubuntu0.8","2.9.13+dfsg-1ubuntu0.9","2.9.13+dfsg-1ubuntu0.10","2.9.13+dfsg-1ubuntu0.11","2.9.13+dfsg-1ubuntu0.12"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.14+dfsg-1.3ubuntu3.9"}]}],"versions":["2.9.14+dfsg-1.3","2.9.14+dfsg-1.3build1","2.9.14+dfsg-1.3build2","2.9.14+dfsg-1.3build3","2.9.14+dfsg-1.3ubuntu1","2.9.14+dfsg-1.3ubuntu2","2.9.14+dfsg-1.3ubuntu3","2.9.14+dfsg-1.3ubuntu3.1","2.9.14+dfsg-1.3ubuntu3.2","2.9.14+dfsg-1.3ubuntu3.3","2.9.14+dfsg-1.3ubuntu3.4","2.9.14+dfsg-1.3ubuntu3.5","2.9.14+dfsg-1.3ubuntu3.6","2.9.14+dfsg-1.3ubuntu3.7","2.9.14+dfsg-1.3ubuntu3.8"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.15.2+dfsg-0.1ubuntu0.2"}]}],"versions":["2.14.5+dfsg-0.2","2.14.5+dfsg-0.2build1","2.15.1+dfsg-0.3","2.15.1+dfsg-0.4","2.15.1+dfsg-1","2.15.1+dfsg-2","2.15.1+dfsg-2ubuntu1","2.15.1+dfsg-2ubuntu2","2.15.2+dfsg-0.1","2.15.2+dfsg-0.1ubuntu0.1"],"bundled":2}],"products":[{"vendor":"red hat","product":"cert manager support for red hat openshift release 1.20"},{"vendor":"red hat","product":"red hat cost management on-premise 1"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 10.0 extended update support"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7 extended lifecycle support"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 8.4 advanced mission critical update support"},{"vendor":"red hat","product":"red hat enterprise linux 8.4 extended update support long-life add-on"},{"vendor":"red hat","product":"red hat enterprise linux 8.6 advanced mission critical update support"},{"vendor":"red hat","product":"red hat enterprise linux 8.6 extended update support long-life add-on"},{"vendor":"red hat","product":"red hat enterprise linux 8.8 telecommunications update service"},{"vendor":"red hat","product":"red hat enterprise linux 8.8 update services for sap solutions"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat enterprise linux 9.2 update services for sap solutions"},{"vendor":"red hat","product":"red hat enterprise linux 9.4 update services for sap solutions"},{"vendor":"red hat","product":"red hat enterprise linux 9.6 extended update support"},{"vendor":"red hat","product":"red hat hardened images"},{"vendor":"red hat","product":"red hat openshift ai (rhoai)"},{"vendor":"red hat","product":"red hat openshift ai 3.0"},{"vendor":"red hat","product":"red hat openshift ai 3.4"},{"vendor":"red hat","product":"red hat openshift ai 3.5"},{"vendor":"red hat","product":"red hat openshift container platform 4"},{"vendor":"red hat","product":"red hat openshift container platform 5"},{"vendor":"red hat","product":"red hat update infrastructure 5"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:64463","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:71585","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:71586","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:71641","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:72470","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:72475","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:72476","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:79357","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:82939","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:89750","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:89759","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:90309","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:91202","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:91204","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:91206","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:91207","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:91217","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:91218","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:91219","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:91224","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:91232","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:91233","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:91234","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:91235","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:91236","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:91237","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:91238","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:91241","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:91242","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:91243","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:91244","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:91245","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:91246","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:91248","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:91249","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:92352","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:92589","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:93463","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:93473","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:93791","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:94459","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:94468","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:94474","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:94476","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:98468","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:98572","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-74860","tags":["vdb-entry","x_refsource_REDHAT","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2529697","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74860","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-8626-cqqj-mfff"},{"url":"https://access.redhat.com/security/cve/CVE-2026-86138","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-86140","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-86142","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-86143","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-86144","tags":["report"]},{"url":"https://bugzilla.redhat.com/2528986","tags":["report"]},{"url":"https://bugzilla.redhat.com/2528987","tags":["report"]},{"url":"https://bugzilla.redhat.com/2528989","tags":["report"]},{"url":"https://bugzilla.redhat.com/2528990","tags":["report"]},{"url":"https://bugzilla.redhat.com/2528992","tags":["report"]},{"url":"https://bugzilla.redhat.com/2529697","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-71585.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-71586.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-71641.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-74860","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1790786185.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1790833998.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos8.4els/CLSA-2026-1791280039.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos-stream8els/CLSA-2026-1791372460.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu20.04els/CLSA-2026-1791489916.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2026-1791493216.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu16.04els/CLSA-2026-1791551729.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/debian10els/CLSA-2026-1792537548.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-7425","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-74860","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-86137","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-86141","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-86139","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_64463.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-74860","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2528985","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-86137","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86137","tags":["advisory"]},{"url":"https://github.com/GNOME/libxml2/commit/76fe08d97de88bfaef2f7d5cd27f11954cc5bee2","tags":["article"]},{"url":"https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4","tags":["article"]},{"url":"https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1099","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2528986","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-86138","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86138","tags":["advisory"]},{"url":"https://github.com/GNOME/libxml2/commit/a4cba4b5b5a8c42e155ed42d2d2a44955465a2e4","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2528991","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-86139","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86139","tags":["advisory"]},{"url":"https://github.com/GNOME/libxml2/commit/8edbbdb09f24d26a2f900141fddc2b9d014f53b0","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2528989","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-86140","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86140","tags":["advisory"]},{"url":"https://github.com/GNOME/libxml2/commit/d1686f91dbda141a752200419d35639fd6b38340","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2528988","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-86141","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86141","tags":["advisory"]},{"url":"https://github.com/GNOME/libxml2/commit/e89a8aae4c9b40cdafcf66b3f9e57c62db37bb55","tags":["article"]},{"url":"https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1107","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2528990","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-86142","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86142","tags":["advisory"]},{"url":"https://github.com/GNOME/libxml2/commit/6b3a736c0edc74ceec3d82f5252499d7911b3a58","tags":["article"]},{"url":"https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1113","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2528987","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-86143","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86143","tags":["advisory"]},{"url":"https://github.com/GNOME/libxml2/commit/90f293ba74d28b1d570920382e707586f68ebf35","tags":["article"]},{"url":"https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1111","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2528992","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-86144","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86144","tags":["advisory"]},{"url":"https://github.com/GNOME/libxml2/commit/b63cd517afecb76582dd9488c55e54ceaf50de61","tags":["article"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_71585.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_71586.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_71641.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:71585","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:71586","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:71641","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-74860","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8787-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-86140","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-74860","title":"Libxml2: double-free/uaf in libxml2 python bindings","description":"A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition (DTD) with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callback handler, where a string is freed twice. This flaw can lead to a denial of service (DoS) due to a reproducible crash in Python applications using the libxml2 SAX bindings.","status":"published","published":"2026-09-08T11:27:45.158Z","modified":"2026-11-11T13:22:48.574Z","cvss":[{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-763"],"updated_at":"2026-11-11T14:28:43.346708Z"}],"euvd":[{"id":"EUVD-2026-72691","description":"A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition (DTD) with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callback handler, where a string is freed twice. This flaw can lead to a denial of service (DoS) due to a reproducible crash in Python applications using the libxml2 SAX bindings.","status":"published","published":"2026-09-08T11:27:45Z","modified":"2026-11-11T13:22:48Z","cvss":[{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-11T14:28:59.314266Z"}],"ghsa":[{"id":"GHSA-8626-cqqj-mfff","title":"A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this...","description":"A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition (DTD) with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callback handler, where a string is freed twice. This flaw can lead to a denial of service (DoS) due to a reproducible crash in Python applications using the libxml2 SAX bindings.","status":"published","published":"2026-09-08T12:31:30Z","modified":"2026-11-11T15:31:43Z","cvss":[{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-763"],"updated_at":"2026-11-11T15:34:48.112751Z"}],"nvd":[{"id":"CVE-2026-74860","description":"A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition (DTD) with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callback handler, where a string is freed twice. This flaw can lead to a denial of service (DoS) due to a reproducible crash in Python applications using the libxml2 SAX bindings.","status":"published","published":"2026-09-08T12:16:58.083Z","modified":"2026-11-11T14:17:46.427Z","cvss":[{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-763"],"updated_at":"2026-11-11T15:25:15.031694Z"}],"osv":[{"id":"BELL-CVE-2026-74860","status":"published","published":"2026-09-10T06:05:04.49698Z","modified":"2026-10-06T07:15:03.983661739Z","cvss":[{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:26.041478Z"},{"id":"DEBIAN-CVE-2026-74860","description":"A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition (DTD) with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callback handler, where a string is freed twice. This flaw can lead to a denial of service (DoS) due to a reproducible crash in Python applications using the libxml2 SAX bindings.","status":"published","published":"2026-09-08T12:16:58.083Z","modified":"2026-11-05T09:47:35.416567452Z","cvss":[{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-05T13:31:24.64316Z"},{"id":"RHSA-2026:64463","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-09-09T10:19:53Z","modified":"2026-10-16T10:22:19Z","cvss":[{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:71585","title":"Red Hat Security Advisory: libxml2 security update","status":"published","published":"2026-09-25T10:15:32Z","modified":"2026-10-16T10:24:35Z","cvss":[{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:71586","title":"Red Hat Security Advisory: libxml2 security update","status":"published","published":"2026-09-25T10:15:33Z","modified":"2026-10-16T10:24:36Z","cvss":[{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:71641","title":"Red Hat Security Advisory: libxml2 security update","status":"published","published":"2026-09-25T10:15:41Z","modified":"2026-10-16T10:24:42Z","cvss":[{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RLSA-2026:71585","title":"Important: libxml2 security update","description":"The libxml2 library is a development toolbox providing the implementation of various XML standards.\n\nSecurity Fix(es):\n\n* libxml2: libxml2: Arbitrary code execution via heap-based buffer overflow (CVE-2026-86138)\n\n* libxml2: libxml2: Data integrity issues due to integer overflow in write callbacks (CVE-2026-86143)\n\n* libxml2: libxml2: Arbitrary code execution via stack-based buffer overflow in xmlSnprintfElements (CVE-2026-86140)\n\n* libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation (CVE-2026-86142)\n\n* libxml2: libxml2: Information disclosure, SSRF, or denial of service due to improper parseFlags propagation. (CVE-2026-86144)\n\n* libxml2: double-free/UAF in libxml2 Python bindings (CVE-2026-74860)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-09-25T18:04:58.698983Z","modified":"2026-09-25T18:24:41.544627833Z","cvss":[{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:71586","title":"Important: libxml2 security update","description":"The libxml2 library is a development toolbox providing the implementation of various XML standards.\n\nSecurity Fix(es):\n\n* libxml2: libxml2: Arbitrary code execution via heap-based buffer overflow (CVE-2026-86138)\n\n* libxml2: libxml2: Data integrity issues due to integer overflow in write callbacks (CVE-2026-86143)\n\n* libxml2: libxml2: Arbitrary code execution via stack-based buffer overflow in xmlSnprintfElements (CVE-2026-86140)\n\n* libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation (CVE-2026-86142)\n\n* libxml2: libxml2: Information disclosure, SSRF, or denial of service due to improper parseFlags propagation. (CVE-2026-86144)\n\n* libxml2: double-free/UAF in libxml2 Python bindings (CVE-2026-74860)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-09-25T12:09:37.504383Z","modified":"2026-09-25T12:30:02.740418238Z","cvss":[{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:71641","title":"Important: libxml2 security update","description":"The libxml2 library is a development toolbox providing the implementation of various XML standards.\n\nSecurity Fix(es):\n\n* libxml2: libxml2: Arbitrary code execution via heap-based buffer overflow (CVE-2026-86138)\n\n* libxml2: libxml2: Data integrity issues due to integer overflow in write callbacks (CVE-2026-86143)\n\n* libxml2: libxml2: Arbitrary code execution via stack-based buffer overflow in xmlSnprintfElements (CVE-2026-86140)\n\n* libxml2: libxml2: Information disclosure, SSRF, or denial of service due to improper parseFlags propagation. (CVE-2026-86144)\n\n* libxml2: double-free/UAF in libxml2 Python bindings (CVE-2026-74860)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-09-26T06:01:07.694195Z","modified":"2026-09-26T06:30:03.069148825Z","cvss":[{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"UBUNTU-CVE-2026-74860","description":"A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition (DTD) with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callback handler, where a string is freed twice. This flaw can lead to a denial of service (DoS) due to a reproducible crash in Python applications using the libxml2 SAX bindings.","status":"published","published":"2026-09-08T12:16:00Z","modified":"2026-09-21T21:38:32.885293273Z","cvss":[{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:57:13.483205Z"},{"id":"ALSA-2026:71585","title":"Important: libxml2 security update","description":"The libxml2 library is a development toolbox providing the implementation of various XML standards.  \n\nSecurity Fix(es):  \n\n  * libxml2: libxml2: Arbitrary code execution via heap-based buffer overflow (CVE-2026-86138)\n  * libxml2: libxml2: Data integrity issues due to integer overflow in write callbacks (CVE-2026-86143)\n  * libxml2: libxml2: Arbitrary code execution via stack-based buffer overflow in xmlSnprintfElements (CVE-2026-86140)\n  * libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation (CVE-2026-86142)\n  * libxml2: libxml2: Information disclosure, SSRF, or denial of service due to improper parseFlags propagation. (CVE-2026-86144)\n  * libxml2: double-free/UAF in libxml2 Python bindings (CVE-2026-74860)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-09-24T00:00:00Z","modified":"2026-10-29T11:32:32.499614877Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:71586","title":"Important: libxml2 security update","description":"The libxml2 library is a development toolbox providing the implementation of various XML standards.  \n\nSecurity Fix(es):  \n\n  * libxml2: libxml2: Arbitrary code execution via heap-based buffer overflow (CVE-2026-86138)\n  * libxml2: libxml2: Data integrity issues due to integer overflow in write callbacks (CVE-2026-86143)\n  * libxml2: libxml2: Arbitrary code execution via stack-based buffer overflow in xmlSnprintfElements (CVE-2026-86140)\n  * libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation (CVE-2026-86142)\n  * libxml2: libxml2: Information disclosure, SSRF, or denial of service due to improper parseFlags propagation. (CVE-2026-86144)\n  * libxml2: double-free/UAF in libxml2 Python bindings (CVE-2026-74860)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-09-24T00:00:00Z","modified":"2026-10-29T11:30:08.493986372Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:71641","title":"Important: libxml2 security update","description":"The libxml2 library is a development toolbox providing the implementation of various XML standards.  \n\nSecurity Fix(es):  \n\n  * libxml2: libxml2: Arbitrary code execution via heap-based buffer overflow (CVE-2026-86138)\n  * libxml2: libxml2: Data integrity issues due to integer overflow in write callbacks (CVE-2026-86143)\n  * libxml2: libxml2: Arbitrary code execution via stack-based buffer overflow in xmlSnprintfElements (CVE-2026-86140)\n  * libxml2: libxml2: Information disclosure, SSRF, or denial of service due to improper parseFlags propagation. (CVE-2026-86144)\n  * libxml2: double-free/UAF in libxml2 Python bindings (CVE-2026-74860)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-09-24T00:00:00Z","modified":"2026-10-29T11:02:29.63748716Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"AZL-100941","title":"CVE-2026-74860 affecting package libxml2 for versions less than 2.11.5-11","description":"A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition (DTD) with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callback handler, where a string is freed twice. This flaw can lead to a denial of service (DoS) due to a reproducible crash in Python applications using the libxml2 SAX bindings.","status":"published","published":"2026-09-08T12:16:58Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:17.128158Z"},{"id":"CLSA-2026-1790786185","title":"libxml2: Fix of CVE-2026-74860","description":"- CVE-2026-74860: drop the extra Py_DECREF() on each enumeration value string in\n  pythonAttributeDecl(), since PyList_SetItem() already steals that reference","status":"published","published":"2026-09-30T16:36:39Z","modified":"2026-10-26T09:31:36.56388205Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790833998","title":"libxml2: Fix of CVE-2026-74860","description":"- CVE-2026-74860: drop the extra Py_DECREF() on each enumeration value\n  string in pythonAttributeDecl(), since PyList_SetItem() already steals\n  that reference","status":"published","published":"2026-10-01T10:55:10Z","modified":"2026-10-26T09:30:51.858025266Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1791280039","title":"libxml2: Fix of CVE-2026-74860","description":"- CVE-2026-74860: do not decref the attribute name string after PyList_SetItem\n  in the Python SAX attributeDecl callback to avoid a double-free","status":"published","published":"2026-10-06T09:47:30Z","modified":"2026-10-26T09:31:43.909509722Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1791372460","title":"libxml2: Fix of CVE-2026-74860","description":"- CVE-2026-74860: do not decref enumerated attribute value strings after\n  adding them to the list in the Python SAX attributeDecl callback,\n  preventing a double free","status":"published","published":"2026-10-07T11:27:54Z","modified":"2026-10-26T09:30:56.812926087Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1791489916","title":"Fix CVE(s): CVE-2026-74860","description":"   * SECURITY UPDATE: double free in the Python bindings' SAX attributeDecl\n     callback\n     - debian/patches/CVE-2026-74860.patch: do not Py_DECREF() the attribute\n       name string after PyList_SetItem() has stolen its reference in\n       pythonAttributeDecl() in python/libxml.c\n     - CVE-2026-74860","status":"published","published":"2026-10-08T20:05:27Z","modified":"2026-10-26T09:32:06.36693719Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1791493216","title":"Fix CVE(s): CVE-2026-74860","description":"   * SECURITY UPDATE: double free in the Python bindings' SAX attributeDecl\n     callback\n     - debian/patches/CVE-2026-74860.patch: do not Py_DECREF() the attribute\n       name string after PyList_SetItem() has stolen its reference in\n       pythonAttributeDecl() in python/libxml.c\n     - CVE-2026-74860","status":"published","published":"2026-10-08T21:00:26Z","modified":"2026-10-26T09:32:04.829958968Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1791551729","title":"Fix CVE(s): CVE-2026-74860","description":"   * SECURITY UPDATE: double free in the Python SAX attributeDecl callback\n     - debian/patches/CVE-2026-74860.patch: do not drop the reference to\n       each enumeration name after PyList_SetItem() in pythonAttributeDecl()\n       in python/libxml.c\n     - CVE-2026-74860","status":"published","published":"2026-10-09T13:15:39Z","modified":"2026-10-26T09:32:02.419080208Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1792537548","title":"Fix CVE(s): CVE-2025-7425","description":"   * SECURITY UPDATE: double free in the Python bindings' SAX attributeDecl\n     callback\n     - debian/patches/CVE-2026-74860.patch: do not Py_DECREF() the attribute\n       name string after PyList_SetItem() has stolen its reference in\n       pythonAttributeDecl() in python/libxml.c\n     - CVE-2026-74860","status":"published","published":"2026-10-20T23:05:59Z","modified":"2026-10-26T09:31:53.679562663Z","updated_at":"2026-11-02T15:43:54.672859Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2026-74860","title":"CVE-2026-74860 in libxml2 - Patched by Root","description":"Root has patched CVE-2026-74860 in the libxml2 package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-10-07T08:00:13Z","modified":"2026-10-07T09:15:06.170551378Z","updated_at":"2026-11-02T15:53:32.570806Z"},{"id":"USN-8787-1","title":"libxml2 vulnerabilities","description":"It was discovered that libxml2 incorrectly handled certain XML elements\nunder certain circumstances. An attacker could possibly use this issue to\ncause libxml2 to crash or execute arbitrary code. (CVE-2026-86140)\n\nIt was discovered that libxml2 incorrectly handled certain XML documents\nwhen used with Python bindings. A remote attacker could possibly use this\nissue to cause applications using libxml2 to crash, resulting in a denial\nof service. (CVE-2026-74860)","status":"published","published":"2026-09-21T12:31:10Z","modified":"2026-09-21T21:42:48.039004937Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}