Vulnerability-Lookup

RHSA-2026:71585

Vulnerability from csaf_redhat - Published: 2026-09-24 20:47 - Updated: 2026-09-24 21:48

Summary

Red Hat Security Advisory: libxml2 security update

Severity

Important

Notes

Topic: An update for libxml2 is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fix(es): * libxml2: libxml2: Arbitrary code execution via heap-based buffer overflow (CVE-2026-86138) * libxml2: libxml2: Data integrity issues due to integer overflow in write callbacks (CVE-2026-86143) * libxml2: libxml2: Arbitrary code execution via stack-based buffer overflow in xmlSnprintfElements (CVE-2026-86140) * libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation (CVE-2026-86142) * libxml2: libxml2: Information disclosure, SSRF, or denial of service due to improper parseFlags propagation. (CVE-2026-86144) * libxml2: double-free/UAF in libxml2 Python bindings (CVE-2026-74860) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-74860

A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition (DTD) with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callback handler, where a string is freed twice. This flaw can lead to a denial of service (DoS) due to a reproducible crash in Python applications using the libxml2 SAX bindings.

8.5 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

CWE-763 - Release of Invalid Pointer or Reference

Affected products

Fixed 45 products

Product	Version	Remediation
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.i686	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.i686	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.i686	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.src	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.i686	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64	—	Vendor Fix fix

Threats

Impact Important

CVE-2026-86138

A flaw was found in libxml2, a software library for parsing XML documents. An integer overflow within the `xmlDictAddQString` function can lead to a heap-based buffer overflow. This vulnerability could allow a local attacker to execute arbitrary code on the system, potentially compromising its integrity and confidentiality.

6.9 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L

CWE-190 - Integer Overflow or Wraparound

Affected products

Fixed 45 products, the same list as for CVE-2026-74860

Threats

Impact Moderate

CVE-2026-86140

A flaw was found in libxml2. A local attacker could exploit a stack-based buffer overflow in the `xmlSnprintfElements` function to achieve arbitrary code execution. This vulnerability in a fundamental system library could lead to significant system compromise if successfully exploited.

7.4 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Affected products

Fixed 45 products, the same list as for CVE-2026-74860

Threats

Impact Important

CVE-2026-86142

A flaw in libxml2's xmlXPtrEvalXPtrPart function allows a local attacker to cause a heap-based buffer overflow. An integer overflow while processing an oversized xpointer() expression leads to incorrect memory allocation and an out-of-bounds write, potentially resulting in information disclosure, data corruption, or a denial of service (DoS).

6.9 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L

CWE-805 - Buffer Access with Incorrect Length Value

Affected products

Fixed 45 products, the same list as for CVE-2026-74860

Threats

Impact Moderate

CVE-2026-86143

An integer overflow in the libxml2 xmlIO module occurs when data backlogs exceed maximum integer limits. This flaw passes negative length values to downstream write callbacks, creating an unsafe state that can lead to data corruption or compromise application confidentiality and integrity.

6.9 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L

CWE-192 - Integer Coercion Error

Affected products

Fixed 45 products, the same list as for CVE-2026-74860

Threats

Impact Moderate

CVE-2026-86144

A flaw in libxml2's XInclude processing (xmlXIncludeProcess and xmlXIncludeProcessTree) fails to propagate parser flags like XML_PARSE_NONET. This allows custom resource loaders to fetch external network resources, potentially enabling Server-Side Request Forgery (SSRF), XML External Entity (XXE) injection, or Denial of Service (DoS) attacks.

5.6 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L

CWE-669 - Incorrect Resource Transfer Between Spheres

Affected products

Fixed 45 products, the same list as for CVE-2026-74860

Threats

Impact Moderate

References

41 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:71585	self
https://access.redhat.com/security/updates/classi…	external
https://bugzilla.redhat.com/show_bug.cgi?id=2528986	external
https://bugzilla.redhat.com/show_bug.cgi?id=2528987	external
https://bugzilla.redhat.com/show_bug.cgi?id=2528989	external
https://bugzilla.redhat.com/show_bug.cgi?id=2528990	external
https://bugzilla.redhat.com/show_bug.cgi?id=2528992	external
https://bugzilla.redhat.com/show_bug.cgi?id=2529697	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-74860	self
https://bugzilla.redhat.com/show_bug.cgi?id=2529697	external
https://www.cve.org/CVERecord?id=CVE-2026-74860	external
https://nvd.nist.gov/vuln/detail/CVE-2026-74860	external
https://access.redhat.com/security/cve/CVE-2026-86138	self
https://bugzilla.redhat.com/show_bug.cgi?id=2528986	external
https://www.cve.org/CVERecord?id=CVE-2026-86138	external
https://nvd.nist.gov/vuln/detail/CVE-2026-86138	external
https://github.com/GNOME/libxml2/commit/a4cba4b5b…	external
https://github.com/GNOME/libxml2/compare/v2.15.3.…	external
https://access.redhat.com/security/cve/CVE-2026-86140	self
https://bugzilla.redhat.com/show_bug.cgi?id=2528989	external
https://www.cve.org/CVERecord?id=CVE-2026-86140	external
https://nvd.nist.gov/vuln/detail/CVE-2026-86140	external
https://github.com/GNOME/libxml2/commit/d1686f91d…	external
https://access.redhat.com/security/cve/CVE-2026-86142	self
https://bugzilla.redhat.com/show_bug.cgi?id=2528990	external
https://www.cve.org/CVERecord?id=CVE-2026-86142	external
https://nvd.nist.gov/vuln/detail/CVE-2026-86142	external
https://github.com/GNOME/libxml2/commit/6b3a736c0…	external
https://gitlab.gnome.org/GNOME/libxml2/-/work_ite…	external
https://access.redhat.com/security/cve/CVE-2026-86143	self
https://bugzilla.redhat.com/show_bug.cgi?id=2528987	external
https://www.cve.org/CVERecord?id=CVE-2026-86143	external
https://nvd.nist.gov/vuln/detail/CVE-2026-86143	external
https://github.com/GNOME/libxml2/commit/90f293ba7…	external
https://gitlab.gnome.org/GNOME/libxml2/-/work_ite…	external
https://access.redhat.com/security/cve/CVE-2026-86144	self
https://bugzilla.redhat.com/show_bug.cgi?id=2528992	external
https://www.cve.org/CVERecord?id=CVE-2026-86144	external
https://nvd.nist.gov/vuln/detail/CVE-2026-86144	external
https://github.com/GNOME/libxml2/commit/b63cd517a…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for libxml2 is now available for Red Hat Enterprise Linux 9.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The libxml2 library is a development toolbox providing the implementation of various XML standards.\n\nSecurity Fix(es):\n\n* libxml2: libxml2: Arbitrary code execution via heap-based buffer overflow (CVE-2026-86138)\n\n* libxml2: libxml2: Data integrity issues due to integer overflow in write callbacks (CVE-2026-86143)\n\n* libxml2: libxml2: Arbitrary code execution via stack-based buffer overflow in xmlSnprintfElements (CVE-2026-86140)\n\n* libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation (CVE-2026-86142)\n\n* libxml2: libxml2: Information disclosure, SSRF, or denial of service due to improper parseFlags propagation. (CVE-2026-86144)\n\n* libxml2: double-free/UAF in libxml2 Python bindings (CVE-2026-74860)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:71585",
        "url": "https://access.redhat.com/errata/RHSA-2026:71585"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2528986",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528986"
      },
      {
        "category": "external",
        "summary": "2528987",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528987"
      },
      {
        "category": "external",
        "summary": "2528989",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528989"
      },
      {
        "category": "external",
        "summary": "2528990",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528990"
      },
      {
        "category": "external",
        "summary": "2528992",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528992"
      },
      {
        "category": "external",
        "summary": "2529697",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2529697"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_71585.json"
      }
    ],
    "title": "Red Hat Security Advisory: libxml2 security update",
    "tracking": {
      "current_release_date": "2026-09-24T21:48:59+00:00",
      "generator": {
        "date": "2026-09-24T21:48:59+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.0"
        }
      },
      "id": "RHSA-2026:71585",
      "initial_release_date": "2026-09-24T20:47:38+00:00",
      "revision_history": [
        {
          "date": "2026-09-24T20:47:38+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-09-24T20:47:38+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-09-24T21:48:59+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream (v. 9)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream (v. 9)",
                  "product_id": "AppStream-9.8.0.Z.MAIN.EUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:enterprise_linux:9::appstream"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux BaseOS (v. 9)",
                "product": {
                  "name": "Red Hat Enterprise Linux BaseOS (v. 9)",
                  "product_id": "BaseOS-9.8.0.Z.MAIN.EUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:9::baseos"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libxml2-0:2.9.13-14.el9_8.5.src",
                "product": {
                  "name": "libxml2-0:2.9.13-14.el9_8.5.src",
                  "product_id": "libxml2-0:2.9.13-14.el9_8.5.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libxml2@2.9.13-14.el9_8.5?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libxml2-0:2.9.13-14.el9_8.5.aarch64",
                "product": {
                  "name": "libxml2-0:2.9.13-14.el9_8.5.aarch64",
                  "product_id": "libxml2-0:2.9.13-14.el9_8.5.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libxml2@2.9.13-14.el9_8.5?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python3-libxml2-0:2.9.13-14.el9_8.5.aarch64",
                "product": {
                  "name": "python3-libxml2-0:2.9.13-14.el9_8.5.aarch64",
                  "product_id": "python3-libxml2-0:2.9.13-14.el9_8.5.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python3-libxml2@2.9.13-14.el9_8.5?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libxml2-debugsource-0:2.9.13-14.el9_8.5.aarch64",
                "product": {
                  "name": "libxml2-debugsource-0:2.9.13-14.el9_8.5.aarch64",
                  "product_id": "libxml2-debugsource-0:2.9.13-14.el9_8.5.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libxml2-debugsource@2.9.13-14.el9_8.5?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
                "product": {
                  "name": "libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
                  "product_id": "libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libxml2-debuginfo@2.9.13-14.el9_8.5?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
                "product": {
                  "name": "python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
                  "product_id": "python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python3-libxml2-debuginfo@2.9.13-14.el9_8.5?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libxml2-devel-0:2.9.13-14.el9_8.5.aarch64",
                "product": {
                  "name": "libxml2-devel-0:2.9.13-14.el9_8.5.aarch64",
                  "product_id": "libxml2-devel-0:2.9.13-14.el9_8.5.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libxml2-devel@2.9.13-14.el9_8.5?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libxml2-0:2.9.13-14.el9_8.5.i686",
                "product": {
                  "name": "libxml2-0:2.9.13-14.el9_8.5.i686",
                  "product_id": "libxml2-0:2.9.13-14.el9_8.5.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libxml2@2.9.13-14.el9_8.5?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libxml2-debugsource-0:2.9.13-14.el9_8.5.i686",
                "product": {
                  "name": "libxml2-debugsource-0:2.9.13-14.el9_8.5.i686",
                  "product_id": "libxml2-debugsource-0:2.9.13-14.el9_8.5.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libxml2-debugsource@2.9.13-14.el9_8.5?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
                "product": {
                  "name": "libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
                  "product_id": "libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libxml2-debuginfo@2.9.13-14.el9_8.5?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
                "product": {
                  "name": "python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
                  "product_id": "python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python3-libxml2-debuginfo@2.9.13-14.el9_8.5?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libxml2-devel-0:2.9.13-14.el9_8.5.i686",
                "product": {
                  "name": "libxml2-devel-0:2.9.13-14.el9_8.5.i686",
                  "product_id": "libxml2-devel-0:2.9.13-14.el9_8.5.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libxml2-devel@2.9.13-14.el9_8.5?arch=i686"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i686"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libxml2-0:2.9.13-14.el9_8.5.x86_64",
                "product": {
                  "name": "libxml2-0:2.9.13-14.el9_8.5.x86_64",
                  "product_id": "libxml2-0:2.9.13-14.el9_8.5.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libxml2@2.9.13-14.el9_8.5?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python3-libxml2-0:2.9.13-14.el9_8.5.x86_64",
                "product": {
                  "name": "python3-libxml2-0:2.9.13-14.el9_8.5.x86_64",
                  "product_id": "python3-libxml2-0:2.9.13-14.el9_8.5.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python3-libxml2@2.9.13-14.el9_8.5?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libxml2-debugsource-0:2.9.13-14.el9_8.5.x86_64",
                "product": {
                  "name": "libxml2-debugsource-0:2.9.13-14.el9_8.5.x86_64",
                  "product_id": "libxml2-debugsource-0:2.9.13-14.el9_8.5.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libxml2-debugsource@2.9.13-14.el9_8.5?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64",
                "product": {
                  "name": "libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64",
                  "product_id": "libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libxml2-debuginfo@2.9.13-14.el9_8.5?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64",
                "product": {
                  "name": "python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64",
                  "product_id": "python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python3-libxml2-debuginfo@2.9.13-14.el9_8.5?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libxml2-devel-0:2.9.13-14.el9_8.5.x86_64",
                "product": {
                  "name": "libxml2-devel-0:2.9.13-14.el9_8.5.x86_64",
                  "product_id": "libxml2-devel-0:2.9.13-14.el9_8.5.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libxml2-devel@2.9.13-14.el9_8.5?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libxml2-0:2.9.13-14.el9_8.5.ppc64le",
                "product": {
                  "name": "libxml2-0:2.9.13-14.el9_8.5.ppc64le",
                  "product_id": "libxml2-0:2.9.13-14.el9_8.5.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libxml2@2.9.13-14.el9_8.5?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python3-libxml2-0:2.9.13-14.el9_8.5.ppc64le",
                "product": {
                  "name": "python3-libxml2-0:2.9.13-14.el9_8.5.ppc64le",
                  "product_id": "python3-libxml2-0:2.9.13-14.el9_8.5.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python3-libxml2@2.9.13-14.el9_8.5?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libxml2-debugsource-0:2.9.13-14.el9_8.5.ppc64le",
                "product": {
                  "name": "libxml2-debugsource-0:2.9.13-14.el9_8.5.ppc64le",
                  "product_id": "libxml2-debugsource-0:2.9.13-14.el9_8.5.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libxml2-debugsource@2.9.13-14.el9_8.5?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
                "product": {
                  "name": "libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
                  "product_id": "libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libxml2-debuginfo@2.9.13-14.el9_8.5?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
                "product": {
                  "name": "python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
                  "product_id": "python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python3-libxml2-debuginfo@2.9.13-14.el9_8.5?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libxml2-devel-0:2.9.13-14.el9_8.5.ppc64le",
                "product": {
                  "name": "libxml2-devel-0:2.9.13-14.el9_8.5.ppc64le",
                  "product_id": "libxml2-devel-0:2.9.13-14.el9_8.5.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libxml2-devel@2.9.13-14.el9_8.5?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libxml2-0:2.9.13-14.el9_8.5.s390x",
                "product": {
                  "name": "libxml2-0:2.9.13-14.el9_8.5.s390x",
                  "product_id": "libxml2-0:2.9.13-14.el9_8.5.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libxml2@2.9.13-14.el9_8.5?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python3-libxml2-0:2.9.13-14.el9_8.5.s390x",
                "product": {
                  "name": "python3-libxml2-0:2.9.13-14.el9_8.5.s390x",
                  "product_id": "python3-libxml2-0:2.9.13-14.el9_8.5.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python3-libxml2@2.9.13-14.el9_8.5?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libxml2-debugsource-0:2.9.13-14.el9_8.5.s390x",
                "product": {
                  "name": "libxml2-debugsource-0:2.9.13-14.el9_8.5.s390x",
                  "product_id": "libxml2-debugsource-0:2.9.13-14.el9_8.5.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libxml2-debugsource@2.9.13-14.el9_8.5?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
                "product": {
                  "name": "libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
                  "product_id": "libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libxml2-debuginfo@2.9.13-14.el9_8.5?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
                "product": {
                  "name": "python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
                  "product_id": "python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python3-libxml2-debuginfo@2.9.13-14.el9_8.5?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libxml2-devel-0:2.9.13-14.el9_8.5.s390x",
                "product": {
                  "name": "libxml2-devel-0:2.9.13-14.el9_8.5.s390x",
                  "product_id": "libxml2-devel-0:2.9.13-14.el9_8.5.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libxml2-devel@2.9.13-14.el9_8.5?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64"
        },
        "product_reference": "libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686"
        },
        "product_reference": "libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le"
        },
        "product_reference": "libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x"
        },
        "product_reference": "libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64"
        },
        "product_reference": "libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxml2-debugsource-0:2.9.13-14.el9_8.5.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.aarch64"
        },
        "product_reference": "libxml2-debugsource-0:2.9.13-14.el9_8.5.aarch64",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxml2-debugsource-0:2.9.13-14.el9_8.5.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.i686"
        },
        "product_reference": "libxml2-debugsource-0:2.9.13-14.el9_8.5.i686",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxml2-debugsource-0:2.9.13-14.el9_8.5.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.ppc64le"
        },
        "product_reference": "libxml2-debugsource-0:2.9.13-14.el9_8.5.ppc64le",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxml2-debugsource-0:2.9.13-14.el9_8.5.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.s390x"
        },
        "product_reference": "libxml2-debugsource-0:2.9.13-14.el9_8.5.s390x",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxml2-debugsource-0:2.9.13-14.el9_8.5.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.x86_64"
        },
        "product_reference": "libxml2-debugsource-0:2.9.13-14.el9_8.5.x86_64",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxml2-devel-0:2.9.13-14.el9_8.5.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.aarch64"
        },
        "product_reference": "libxml2-devel-0:2.9.13-14.el9_8.5.aarch64",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxml2-devel-0:2.9.13-14.el9_8.5.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.i686"
        },
        "product_reference": "libxml2-devel-0:2.9.13-14.el9_8.5.i686",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxml2-devel-0:2.9.13-14.el9_8.5.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.ppc64le"
        },
        "product_reference": "libxml2-devel-0:2.9.13-14.el9_8.5.ppc64le",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxml2-devel-0:2.9.13-14.el9_8.5.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.s390x"
        },
        "product_reference": "libxml2-devel-0:2.9.13-14.el9_8.5.s390x",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxml2-devel-0:2.9.13-14.el9_8.5.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.x86_64"
        },
        "product_reference": "libxml2-devel-0:2.9.13-14.el9_8.5.x86_64",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64"
        },
        "product_reference": "python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686"
        },
        "product_reference": "python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le"
        },
        "product_reference": "python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x"
        },
        "product_reference": "python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64"
        },
        "product_reference": "python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxml2-0:2.9.13-14.el9_8.5.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
          "product_id": "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.aarch64"
        },
        "product_reference": "libxml2-0:2.9.13-14.el9_8.5.aarch64",
        "relates_to_product_reference": "BaseOS-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxml2-0:2.9.13-14.el9_8.5.i686 as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
          "product_id": "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.i686"
        },
        "product_reference": "libxml2-0:2.9.13-14.el9_8.5.i686",
        "relates_to_product_reference": "BaseOS-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxml2-0:2.9.13-14.el9_8.5.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
          "product_id": "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.ppc64le"
        },
        "product_reference": "libxml2-0:2.9.13-14.el9_8.5.ppc64le",
        "relates_to_product_reference": "BaseOS-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxml2-0:2.9.13-14.el9_8.5.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
          "product_id": "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.s390x"
        },
        "product_reference": "libxml2-0:2.9.13-14.el9_8.5.s390x",
        "relates_to_product_reference": "BaseOS-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxml2-0:2.9.13-14.el9_8.5.src as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
          "product_id": "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.src"
        },
        "product_reference": "libxml2-0:2.9.13-14.el9_8.5.src",
        "relates_to_product_reference": "BaseOS-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxml2-0:2.9.13-14.el9_8.5.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
          "product_id": "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.x86_64"
        },
        "product_reference": "libxml2-0:2.9.13-14.el9_8.5.x86_64",
        "relates_to_product_reference": "BaseOS-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
          "product_id": "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64"
        },
        "product_reference": "libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
        "relates_to_product_reference": "BaseOS-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686 as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
          "product_id": "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686"
        },
        "product_reference": "libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
        "relates_to_product_reference": "BaseOS-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
          "product_id": "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le"
        },
        "product_reference": "libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
        "relates_to_product_reference": "BaseOS-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
          "product_id": "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x"
        },
        "product_reference": "libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
        "relates_to_product_reference": "BaseOS-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
          "product_id": "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64"
        },
        "product_reference": "libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64",
        "relates_to_product_reference": "BaseOS-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxml2-debugsource-0:2.9.13-14.el9_8.5.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
          "product_id": "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.aarch64"
        },
        "product_reference": "libxml2-debugsource-0:2.9.13-14.el9_8.5.aarch64",
        "relates_to_product_reference": "BaseOS-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxml2-debugsource-0:2.9.13-14.el9_8.5.i686 as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
          "product_id": "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.i686"
        },
        "product_reference": "libxml2-debugsource-0:2.9.13-14.el9_8.5.i686",
        "relates_to_product_reference": "BaseOS-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxml2-debugsource-0:2.9.13-14.el9_8.5.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
          "product_id": "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.ppc64le"
        },
        "product_reference": "libxml2-debugsource-0:2.9.13-14.el9_8.5.ppc64le",
        "relates_to_product_reference": "BaseOS-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxml2-debugsource-0:2.9.13-14.el9_8.5.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
          "product_id": "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.s390x"
        },
        "product_reference": "libxml2-debugsource-0:2.9.13-14.el9_8.5.s390x",
        "relates_to_product_reference": "BaseOS-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxml2-debugsource-0:2.9.13-14.el9_8.5.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
          "product_id": "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.x86_64"
        },
        "product_reference": "libxml2-debugsource-0:2.9.13-14.el9_8.5.x86_64",
        "relates_to_product_reference": "BaseOS-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3-libxml2-0:2.9.13-14.el9_8.5.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
          "product_id": "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.aarch64"
        },
        "product_reference": "python3-libxml2-0:2.9.13-14.el9_8.5.aarch64",
        "relates_to_product_reference": "BaseOS-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3-libxml2-0:2.9.13-14.el9_8.5.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
          "product_id": "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.ppc64le"
        },
        "product_reference": "python3-libxml2-0:2.9.13-14.el9_8.5.ppc64le",
        "relates_to_product_reference": "BaseOS-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3-libxml2-0:2.9.13-14.el9_8.5.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
          "product_id": "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.s390x"
        },
        "product_reference": "python3-libxml2-0:2.9.13-14.el9_8.5.s390x",
        "relates_to_product_reference": "BaseOS-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3-libxml2-0:2.9.13-14.el9_8.5.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
          "product_id": "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.x86_64"
        },
        "product_reference": "python3-libxml2-0:2.9.13-14.el9_8.5.x86_64",
        "relates_to_product_reference": "BaseOS-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
          "product_id": "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64"
        },
        "product_reference": "python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
        "relates_to_product_reference": "BaseOS-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686 as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
          "product_id": "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686"
        },
        "product_reference": "python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
        "relates_to_product_reference": "BaseOS-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
          "product_id": "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le"
        },
        "product_reference": "python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
        "relates_to_product_reference": "BaseOS-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
          "product_id": "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x"
        },
        "product_reference": "python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
        "relates_to_product_reference": "BaseOS-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
          "product_id": "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64"
        },
        "product_reference": "python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64",
        "relates_to_product_reference": "BaseOS-9.8.0.Z.MAIN.EUS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-74860",
      "cwe": {
        "id": "CWE-763",
        "name": "Release of Invalid Pointer or Reference"
      },
      "discovery_date": "2026-09-08T07:16:42.486000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2529697"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition (DTD) with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callback handler, where a string is freed twice. This flaw can lead to a denial of service (DoS) due to a reproducible crash in Python applications using the libxml2 SAX bindings.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libxml2: double-free/UAF in libxml2 Python bindings",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
          "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.i686",
          "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.i686",
          "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
          "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.aarch64",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.i686",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.ppc64le",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.s390x",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.src",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.x86_64",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.aarch64",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.i686",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.ppc64le",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.s390x",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.x86_64",
          "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.aarch64",
          "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.ppc64le",
          "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.s390x",
          "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.x86_64",
          "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
          "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
          "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
          "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
          "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-74860"
        },
        {
          "category": "external",
          "summary": "RHBZ#2529697",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2529697"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-74860",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-74860"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-74860",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74860"
        }
      ],
      "release_date": "2026-03-08T09:20:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-24T20:47:38+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.i686",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.src",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.i686",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:71585"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.i686",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.src",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.i686",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "libxml2: double-free/UAF in libxml2 Python bindings"
    },
    {
      "cve": "CVE-2026-86138",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "discovery_date": "2026-09-05T04:31:00.379678+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2528986"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in libxml2, a software library for parsing XML documents. An integer overflow within the `xmlDictAddQString` function can lead to a heap-based buffer overflow. This vulnerability could allow a local attacker to execute arbitrary code on the system, potentially compromising its integrity and confidentiality.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libxml2: libxml2: Arbitrary code execution via heap-based buffer overflow",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate severity heap-based buffer overflow in libxml2, specifically within the `xmlDictAddQString` function, could enable arbitrary code execution. While no user interaction or privileges are required, the high attack complexity and local attack vector reduce the overall risk in Red Hat environments.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
          "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.i686",
          "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.i686",
          "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
          "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.aarch64",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.i686",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.ppc64le",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.s390x",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.src",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.x86_64",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.aarch64",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.i686",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.ppc64le",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.s390x",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.x86_64",
          "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.aarch64",
          "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.ppc64le",
          "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.s390x",
          "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.x86_64",
          "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
          "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
          "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
          "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
          "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-86138"
        },
        {
          "category": "external",
          "summary": "RHBZ#2528986",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528986"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-86138",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-86138"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-86138",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86138"
        },
        {
          "category": "external",
          "summary": "https://github.com/GNOME/libxml2/commit/a4cba4b5b5a8c42e155ed42d2d2a44955465a2e4",
          "url": "https://github.com/GNOME/libxml2/commit/a4cba4b5b5a8c42e155ed42d2d2a44955465a2e4"
        },
        {
          "category": "external",
          "summary": "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4",
          "url": "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4"
        }
      ],
      "release_date": "2026-09-05T04:21:53.127000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-24T20:47:38+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.i686",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.src",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.i686",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:71585"
        },
        {
          "category": "workaround",
          "details": "Bound XML document and QName (prefix + local name) size before intern. Cap process and cgroup memory so a ~4 GiB dictionary pool cannot be built. Keep FORTIFY_SOURCE and heap hardening on Red Hat binaries.",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.i686",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.src",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.i686",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.i686",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.src",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.i686",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "libxml2: libxml2: Arbitrary code execution via heap-based buffer overflow"
    },
    {
      "cve": "CVE-2026-86140",
      "cwe": {
        "id": "CWE-120",
        "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
      },
      "discovery_date": "2026-09-05T04:41:05.796692+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2528989"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in libxml2. A local attacker could exploit a stack-based buffer overflow in the `xmlSnprintfElements` function to achieve arbitrary code execution. This vulnerability in a fundamental system library could lead to significant system compromise if successfully exploited.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libxml2: libxml2: Arbitrary code execution via stack-based buffer overflow in xmlSnprintfElements",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important flaw in libxml2 allows a local attacker to achieve arbitrary code execution due to a stack-based buffer overflow. While requiring local access, the vulnerability\u0027s presence in a fundamental system library could lead to significant system compromise if exploited.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
          "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.i686",
          "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.i686",
          "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
          "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.aarch64",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.i686",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.ppc64le",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.s390x",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.src",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.x86_64",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.aarch64",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.i686",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.ppc64le",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.s390x",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.x86_64",
          "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.aarch64",
          "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.ppc64le",
          "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.s390x",
          "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.x86_64",
          "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
          "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
          "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
          "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
          "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-86140"
        },
        {
          "category": "external",
          "summary": "RHBZ#2528989",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528989"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-86140",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-86140"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-86140",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86140"
        },
        {
          "category": "external",
          "summary": "https://github.com/GNOME/libxml2/commit/d1686f91dbda141a752200419d35639fd6b38340",
          "url": "https://github.com/GNOME/libxml2/commit/d1686f91dbda141a752200419d35639fd6b38340"
        },
        {
          "category": "external",
          "summary": "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4",
          "url": "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4"
        }
      ],
      "release_date": "2026-09-05T04:26:13.860000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-24T20:47:38+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.i686",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.src",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.i686",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:71585"
        },
        {
          "category": "workaround",
          "details": "To mitigate this, administrators should disable DTD processing and validation for untrusted documents within libxml2 parsers and restrict network access so only authorized users can submit XML data to the application. For robust defense-in-depth against buffer overflow exploitation, ensure the library and dependent applications are compiled with memory safety flags like stack canaries (-fstack-protector-strong) and bounds checking (_FORTIFY_SOURCE=2), while verifying that standard OS-level protections such as ASLR and Data Execution Prevention (NX/XD Bit) are active on the host system.",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.i686",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.src",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.i686",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.i686",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.src",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.i686",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "libxml2: libxml2: Arbitrary code execution via stack-based buffer overflow in xmlSnprintfElements"
    },
    {
      "cve": "CVE-2026-86142",
      "cwe": {
        "id": "CWE-805",
        "name": "Buffer Access with Incorrect Length Value"
      },
      "discovery_date": "2026-09-05T04:41:08.714165+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2528990"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw in libxml2\u0027s xmlXPtrEvalXPtrPart function allows a local attacker to cause a heap-based buffer overflow. An integer overflow while processing an oversized xpointer() expression leads to incorrect memory allocation and an out-of-bounds write, potentially resulting in information disclosure, data corruption, or a denial of service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A heap-based buffer overflow in libxml2\u0027s xmlXPtrEvalXPtrPart function enables an out-of-bounds write during the evaluation of oversized xpointer() expressions. The flaw is assigned a Moderate severity rating because exploitation strictly requires local access and complex, multi-gigabyte payload inputs, effectively mitigating the threat of remote or automated system compromise.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
          "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.i686",
          "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.i686",
          "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
          "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.aarch64",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.i686",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.ppc64le",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.s390x",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.src",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.x86_64",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.aarch64",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.i686",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.ppc64le",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.s390x",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.x86_64",
          "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.aarch64",
          "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.ppc64le",
          "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.s390x",
          "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.x86_64",
          "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
          "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
          "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
          "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
          "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-86142"
        },
        {
          "category": "external",
          "summary": "RHBZ#2528990",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528990"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-86142",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-86142"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-86142",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86142"
        },
        {
          "category": "external",
          "summary": "https://github.com/GNOME/libxml2/commit/6b3a736c0edc74ceec3d82f5252499d7911b3a58",
          "url": "https://github.com/GNOME/libxml2/commit/6b3a736c0edc74ceec3d82f5252499d7911b3a58"
        },
        {
          "category": "external",
          "summary": "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4",
          "url": "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4"
        },
        {
          "category": "external",
          "summary": "https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1113",
          "url": "https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1113"
        }
      ],
      "release_date": "2026-09-05T04:29:33.323000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-24T20:47:38+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.i686",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.src",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.i686",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:71585"
        },
        {
          "category": "workaround",
          "details": "To mitigate this applications should avoid passing untrusted XPointer expressions into xmlXPtrEval or XInclude xpointer= attributes and strictly cap input length well below INT_MAX. Additionally, administrators should enforce process or cgroup memory limits to prevent the construction of multi-gigabyte scheme bodies, relying on heap allocator hardening rather than standard fortify flags, which cannot stop this byte-store loop.",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.i686",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.src",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.i686",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.i686",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.src",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.i686",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation"
    },
    {
      "cve": "CVE-2026-86143",
      "cwe": {
        "id": "CWE-192",
        "name": "Integer Coercion Error"
      },
      "discovery_date": "2026-09-05T04:40:59.552825+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2528987"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "An integer overflow in the libxml2 xmlIO module occurs when data backlogs exceed maximum integer limits. This flaw passes negative length values to downstream write callbacks, creating an unsafe state that can lead to data corruption or compromise application confidentiality and integrity.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libxml2: libxml2: Data integrity issues due to integer overflow in write callbacks",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Moderate impact: This flaw in libxml2, a widely used XML parsing library, is due to an integer overflow in write callbacks. This can lead to negative lengths being passed to write operations, potentially causing data integrity issues in applications that process untrusted XML input and utilize affected write callbacks. The impact is limited to applications that specifically trigger this overflow condition.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
          "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.i686",
          "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.i686",
          "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
          "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.aarch64",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.i686",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.ppc64le",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.s390x",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.src",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.x86_64",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.aarch64",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.i686",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.ppc64le",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.s390x",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.x86_64",
          "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.aarch64",
          "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.ppc64le",
          "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.s390x",
          "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.x86_64",
          "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
          "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
          "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
          "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
          "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-86143"
        },
        {
          "category": "external",
          "summary": "RHBZ#2528987",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528987"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-86143",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-86143"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-86143",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86143"
        },
        {
          "category": "external",
          "summary": "https://github.com/GNOME/libxml2/commit/90f293ba74d28b1d570920382e707586f68ebf35",
          "url": "https://github.com/GNOME/libxml2/commit/90f293ba74d28b1d570920382e707586f68ebf35"
        },
        {
          "category": "external",
          "summary": "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4",
          "url": "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4"
        },
        {
          "category": "external",
          "summary": "https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1111",
          "url": "https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1111"
        }
      ],
      "release_date": "2026-09-05T04:31:21.187000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-24T20:47:38+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.i686",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.src",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.i686",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:71585"
        },
        {
          "category": "workaround",
          "details": "Cap process and cgroup memory so a process cannot build a \u22652 GiB libxml2 output backlog. Keep FORTIFY_SOURCE-built Red Hat binaries so some callback copies of the truncated length abort instead of corrupting memory",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.i686",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.src",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.i686",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.i686",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.src",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.i686",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "libxml2: libxml2: Data integrity issues due to integer overflow in write callbacks"
    },
    {
      "cve": "CVE-2026-86144",
      "cwe": {
        "id": "CWE-669",
        "name": "Incorrect Resource Transfer Between Spheres"
      },
      "discovery_date": "2026-09-05T04:50:58.626617+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2528992"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw in libxml2\u0027s XInclude processing (xmlXIncludeProcess and xmlXIncludeProcessTree) fails to propagate parser flags like XML_PARSE_NONET. This allows custom resource loaders to fetch external network resources, potentially enabling Server-Side Request Forgery (SSRF), XML External Entity (XXE) injection, or Denial of Service (DoS) attacks.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libxml2: libxml2: Information disclosure, SSRF, or denial of service due to improper parseFlags propagation.",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A Moderate-severity flaw in libxml2 XInclude processing allows custom resource loaders to bypass network restriction flags, enabling unintended external network connections that could cause SSRF, information disclosure, or Denial of Service (DoS). Exploitation requires local access alongside high attack complexity, limiting its immediate widespread impact.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
          "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.i686",
          "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.i686",
          "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
          "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.aarch64",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.i686",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.ppc64le",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.s390x",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.src",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.x86_64",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.aarch64",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.i686",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.ppc64le",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.s390x",
          "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.x86_64",
          "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.aarch64",
          "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.ppc64le",
          "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.s390x",
          "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.x86_64",
          "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
          "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
          "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
          "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
          "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-86144"
        },
        {
          "category": "external",
          "summary": "RHBZ#2528992",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528992"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-86144",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-86144"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-86144",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86144"
        },
        {
          "category": "external",
          "summary": "https://github.com/GNOME/libxml2/commit/b63cd517afecb76582dd9488c55e54ceaf50de61",
          "url": "https://github.com/GNOME/libxml2/commit/b63cd517afecb76582dd9488c55e54ceaf50de61"
        },
        {
          "category": "external",
          "summary": "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4",
          "url": "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4"
        }
      ],
      "release_date": "2026-09-05T04:34:43.972000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-24T20:47:38+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.i686",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.src",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.i686",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:71585"
        },
        {
          "category": "workaround",
          "details": "Do not expand untrusted XInclude; parse without XML_PARSE_XINCLUDE and do not call xmlXIncludeProcess / xmlXIncludeProcessTree. If XInclude is required, pass XML_PARSE_NONET (and XML_PARSE_NO_XXE where available) via xmlXIncludeProcessFlags, and restrict outbound fetches.",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.i686",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.src",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.i686",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 5.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libxml2-devel-0:2.9.13-14.el9_8.5.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
            "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.i686",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.src",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-0:2.9.13-14.el9_8.5.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.i686",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:libxml2-debugsource-0:2.9.13-14.el9_8.5.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-0:2.9.13-14.el9_8.5.x86_64",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x",
            "BaseOS-9.8.0.Z.MAIN.EUS:python3-libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "libxml2: libxml2: Information disclosure, SSRF, or denial of service due to improper parseFlags propagation."
    }
  ]
}

CVE-2026-74860 (GCVE-0-2026-74860)

Vulnerability from cvelistv5 – Published: 2026-09-08 11:27 – Updated: 2026-09-24 20:48

Title

Libxml2: double-free/uaf in libxml2 python bindings

Summary

Severity

8.5 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-08 12:08 UTC

CWE

CWE-763 - Release of Invalid Pointer or Reference

Assigner

redhat redhat root

References

6 references

URL	Tags
https://access.redhat.com/errata/RHSA-2026:64463	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:71585	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:71586	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:71641	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-74860	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2529697	issue-trackingx_refsource_REDHAT

Impacted products

11 products

Vendor	Product	Version
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:2.12.5-10.el10_2.4 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:2.9.7-21.el8_10.9 , < * (rpm) cpe:/a:redhat:enterprise_linux:8::appstream cpe:/o:redhat:enterprise_linux:8::baseos
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:2.9.13-14.el9_8.5 , < * (rpm) cpe:/a:redhat:enterprise_linux:9::appstream cpe:/o:redhat:enterprise_linux:9::baseos
Red Hat	Red Hat Hardened Images	Unaffected: 2.15.4-0.1.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat Hardened Images	cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4

Date Public

2026-03-08 09:20

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-74860",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-08T12:08:31.722346Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-08T12:11:11.416Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10.2"
          ],
          "defaultStatus": "affected",
          "packageName": "libxml2",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.12.5-10.el10_2.4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream",
            "cpe:/o:redhat:enterprise_linux:8::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libxml2",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.9.7-21.el8_10.9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream",
            "cpe:/o:redhat:enterprise_linux:8::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libxml2",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.9.7-21.el8_10.9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream",
            "cpe:/o:redhat:enterprise_linux:9::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libxml2",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.9.13-14.el9_8.5",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream",
            "cpe:/o:redhat:enterprise_linux:9::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libxml2",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.9.13-14.el9_8.5",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:hummingbird:1"
          ],
          "defaultStatus": "affected",
          "packageName": "libxml2-main",
          "product": "Red Hat Hardened Images",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2.15.4-0.1.hum1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "unaffected",
          "packageName": "podman",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:6"
          ],
          "defaultStatus": "affected",
          "packageName": "libxml2",
          "product": "Red Hat Enterprise Linux 6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7"
          ],
          "defaultStatus": "affected",
          "packageName": "libxml2",
          "product": "Red Hat Enterprise Linux 7",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "unaffected",
          "packageName": "container-tools:rhel8/podman",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "unaffected",
          "packageName": "podman",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:hummingbird:1"
          ],
          "defaultStatus": "unaffected",
          "packageName": "swift-lang",
          "product": "Red Hat Hardened Images",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "unaffected",
          "packageName": "openshift/ose-rhel-coreos-8",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "unaffected",
          "packageName": "openshift/ose-rhel-coreos-9",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "unaffected",
          "packageName": "podman",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        }
      ],
      "datePublic": "2026-03-08T09:20:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition (DTD) with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callback handler, where a string is freed twice. This flaw can lead to a denial of service (DoS) due to a reproducible crash in Python applications using the libxml2 SAX bindings."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Important"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-763",
              "description": "Release of Invalid Pointer or Reference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-24T20:48:03.623Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2026:64463",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:64463"
        },
        {
          "name": "RHSA-2026:71585",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:71585"
        },
        {
          "name": "RHSA-2026:71586",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:71586"
        },
        {
          "name": "RHSA-2026:71641",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:71641"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-74860"
        },
        {
          "name": "RHBZ#2529697",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2529697"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-08T07:16:42.486Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-03-08T09:20:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Libxml2: double-free/uaf in libxml2 python bindings",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-763: Release of Invalid Pointer or Reference"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-74860",
    "datePublished": "2026-09-08T11:27:45.158Z",
    "dateReserved": "2026-08-17T09:57:05.862Z",
    "dateUpdated": "2026-09-24T20:48:03.623Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-86138 (GCVE-0-2026-86138)

Vulnerability from cvelistv5 – Published: 2026-09-05 04:21 – Updated: 2026-09-08 18:04

Summary

In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based buffer overflow.

Severity

6.9 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-08 18:04 UTC

CWE

CWE-190 - Integer Overflow or Wraparound

Assigner

mitre mitre root

References

2 references

URL	Tags
https://github.com/GNOME/libxml2/compare/v2.15.3.…
https://github.com/GNOME/libxml2/commit/a4cba4b5b…

Impacted products

1 product

Vendor	Product	Version
xmlsoft	libxml2	Affected: 0 , < 2.15.4 (semver) cpe:2.3:a:xmlsoft:libxml2::::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-86138",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-08T18:04:19.094572Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-08T18:04:58.145Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "libxml2",
          "vendor": "xmlsoft",
          "versions": [
            {
              "lessThan": "2.15.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.15.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based buffer overflow."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "CWE-190 Integer Overflow or Wraparound",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-05T04:21:53.127Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4"
        },
        {
          "url": "https://github.com/GNOME/libxml2/commit/a4cba4b5b5a8c42e155ed42d2d2a44955465a2e4"
        }
      ],
      "x_generator": {
        "engine": "CVE-Request-form 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2026-86138",
    "datePublished": "2026-09-05T04:21:53.127Z",
    "dateReserved": "2026-09-05T04:21:52.780Z",
    "dateUpdated": "2026-09-08T18:04:58.145Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-86140 (GCVE-0-2026-86140)

Vulnerability from cvelistv5 – Published: 2026-09-05 04:26 – Updated: 2026-09-08 18:06

Summary

In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-based buffer overflow.

Severity

8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-08 18:06 UTC

CWE

CWE-121 - Stack-based Buffer Overflow

Assigner

mitre mitre root

References

2 references

URL	Tags
https://github.com/GNOME/libxml2/compare/v2.15.3.…
https://github.com/GNOME/libxml2/commit/d1686f91d…

Impacted products

1 product

Vendor	Product	Version
xmlsoft	libxml2	Affected: 0 , < 2.15.4 (semver) cpe:2.3:a:xmlsoft:libxml2::::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-86140",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-08T18:06:03.098551Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-08T18:06:15.447Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "libxml2",
          "vendor": "xmlsoft",
          "versions": [
            {
              "lessThan": "2.15.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.15.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-based buffer overflow."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-121",
              "description": "CWE-121 Stack-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-05T04:26:13.860Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4"
        },
        {
          "url": "https://github.com/GNOME/libxml2/commit/d1686f91dbda141a752200419d35639fd6b38340"
        }
      ],
      "x_generator": {
        "engine": "CVE-Request-form 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2026-86140",
    "datePublished": "2026-09-05T04:26:13.860Z",
    "dateReserved": "2026-09-05T04:26:13.510Z",
    "dateUpdated": "2026-09-08T18:06:15.447Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-86142 (GCVE-0-2026-86142)

Vulnerability from cvelistv5 – Published: 2026-09-05 04:29 – Updated: 2026-09-14 13:50

Summary

In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation.

Severity

6.9 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-14 13:26 UTC

CWE

CWE-122 - Heap-based Buffer Overflow

Assigner

mitre mitre root

References

3 references

URL	Tags
https://github.com/GNOME/libxml2/compare/v2.15.3.…
https://github.com/GNOME/libxml2/commit/6b3a736c0…
https://gitlab.gnome.org/GNOME/libxml2/-/work_ite…

Impacted products

1 product

Vendor	Product	Version
xmlsoft	libxml2	Affected: 0 , < 2.15.4 (semver) cpe:2.3:a:xmlsoft:libxml2::::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-86142",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-14T13:26:26.776763Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-14T13:50:49.902Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "libxml2",
          "vendor": "xmlsoft",
          "versions": [
            {
              "lessThan": "2.15.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.15.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-122",
              "description": "CWE-122 Heap-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-05T04:29:33.323Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4"
        },
        {
          "url": "https://github.com/GNOME/libxml2/commit/6b3a736c0edc74ceec3d82f5252499d7911b3a58"
        },
        {
          "url": "https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1113"
        }
      ],
      "x_generator": {
        "engine": "CVE-Request-form 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2026-86142",
    "datePublished": "2026-09-05T04:29:33.323Z",
    "dateReserved": "2026-09-05T04:29:32.967Z",
    "dateUpdated": "2026-09-14T13:50:49.902Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-86143 (GCVE-0-2026-86143)

Vulnerability from cvelistv5 – Published: 2026-09-05 04:31 – Updated: 2026-09-08 18:06

Summary

In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks, aka a lack of a check for integer overflow before calling writecallback. This has security relevance for many types of uses of that length value within a callback.

Severity

6.9 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-08 18:05 UTC

CWE

CWE-192 - Integer Coercion Error

Assigner

mitre mitre root

References

3 references

URL	Tags
https://github.com/GNOME/libxml2/compare/v2.15.3.…
https://github.com/GNOME/libxml2/commit/90f293ba7…
https://gitlab.gnome.org/GNOME/libxml2/-/work_ite…

Impacted products

1 product

Vendor	Product	Version
xmlsoft	libxml2	Affected: 0 , < 2.15.4 (semver) cpe:2.3:a:xmlsoft:libxml2::::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-86143",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-08T18:05:53.926972Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-08T18:06:25.507Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "libxml2",
          "vendor": "xmlsoft",
          "versions": [
            {
              "lessThan": "2.15.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.15.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks, aka a lack of a check for integer overflow before calling writecallback. This has security relevance for many types of uses of that length value within a callback."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-192",
              "description": "CWE-192 Integer Coercion Error",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-05T04:31:21.187Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4"
        },
        {
          "url": "https://github.com/GNOME/libxml2/commit/90f293ba74d28b1d570920382e707586f68ebf35"
        },
        {
          "url": "https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1111"
        }
      ],
      "x_generator": {
        "engine": "CVE-Request-form 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2026-86143",
    "datePublished": "2026-09-05T04:31:21.187Z",
    "dateReserved": "2026-09-05T04:31:20.849Z",
    "dateUpdated": "2026-09-08T18:06:25.507Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-86144 (GCVE-0-2026-86144)

Vulnerability from cvelistv5 – Published: 2026-09-05 04:34 – Updated: 2026-09-08 13:04

Summary

In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, the XML_PARSE_NONET flag, if (without it) a custom resource loader accesses the internet and triggers XML external entity injection, SSRF, or a denial of service (e.g., for an attacker-controlled internet resource that is intentionally slow).

Severity

5.6 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-08 13:04 UTC

CWE

CWE-669 - Incorrect Resource Transfer Between Spheres

Assigner

mitre mitre root

References

2 references

URL	Tags
https://github.com/GNOME/libxml2/compare/v2.15.3.…
https://github.com/GNOME/libxml2/commit/b63cd517a…

Impacted products

1 product

Vendor	Product	Version
xmlsoft	libxml2	Affected: 0 , < 2.15.4 (semver) cpe:2.3:a:xmlsoft:libxml2::::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-86144",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-08T13:04:43.439318Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-08T13:04:51.845Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "libxml2",
          "vendor": "xmlsoft",
          "versions": [
            {
              "lessThan": "2.15.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.15.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, the XML_PARSE_NONET flag, if (without it) a custom resource loader accesses the internet and triggers XML external entity injection, SSRF, or a denial of service (e.g., for an attacker-controlled internet resource that is intentionally slow)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 5.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-669",
              "description": "CWE-669 Incorrect Resource Transfer Between Spheres",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-05T04:34:43.972Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4"
        },
        {
          "url": "https://github.com/GNOME/libxml2/commit/b63cd517afecb76582dd9488c55e54ceaf50de61"
        }
      ],
      "x_generator": {
        "engine": "CVE-Request-form 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2026-86144",
    "datePublished": "2026-09-05T04:34:43.972Z",
    "dateReserved": "2026-09-05T04:34:43.632Z",
    "dateUpdated": "2026-09-08T13:04:51.845Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2026:71585

CVE-2026-74860 (GCVE-0-2026-74860)

CVE-2026-86138 (GCVE-0-2026-86138)

CVE-2026-86140 (GCVE-0-2026-86140)

CVE-2026-86142 (GCVE-0-2026-86142)

CVE-2026-86143 (GCVE-0-2026-86143)

CVE-2026-86144 (GCVE-0-2026-86144)

Tags

Sightings

Nomenclature

Related by attack behaviour