Vulnerability-Lookup

SUSE-SU-2026:0606-1

Vulnerability from csaf_suse - Published: 2026-02-24 11:19 - Updated: 2026-02-24 11:19

Summary

Security update for libxml2

Notes

Title of the patch

Security update for libxml2

Description of the patch

This update for libxml2 fixes the following issues: - CVE-2026-0990: Fixed a call stack overflow leading to application crash due to infinite recursion in `xmlCatalogXMLResolveURI`. (bsc#1256807, bsc#1256811) - CVE-2026-0992: Fixed an excessive resource consumption when processing XML catalogs due to exponential behavior. (bsc#1256809, bsc#1256812) - CVE-2026-1757: Fixed a memory leak in the `xmllint` interactive shell. (bsc#1257594, bsc#1257595) - CVE-2025-10911: Fixed a use-after-free with key data stored cross-RVT. (bsc#1250553) - CVE-2026-0989: Fixe a call stack exhaustion leading to application crash due to RelaxNG parser not limiting the recursion depth. (bsc#1256805, bsc#1256810)

Patchnames

SUSE-2026-606,SUSE-SLE-Micro-5.3-2026-606,SUSE-SLE-Micro-5.4-2026-606

CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for libxml2",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for libxml2 fixes the following issues:\n\n- CVE-2026-0990: Fixed a call stack overflow leading to application crash due to infinite recursion in `xmlCatalogXMLResolveURI`. (bsc#1256807, bsc#1256811)\n- CVE-2026-0992: Fixed an excessive resource consumption when processing XML catalogs due to exponential behavior. (bsc#1256809, bsc#1256812)\n- CVE-2026-1757: Fixed a memory leak in the `xmllint` interactive shell. (bsc#1257594, bsc#1257595)\n- CVE-2025-10911: Fixed a use-after-free with key data stored cross-RVT. (bsc#1250553)\n- CVE-2026-0989: Fixe a call stack exhaustion leading to application crash due to RelaxNG parser not limiting the recursion depth. (bsc#1256805, bsc#1256810)\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-2026-606,SUSE-SLE-Micro-5.3-2026-606,SUSE-SLE-Micro-5.4-2026-606",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_0606-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2026:0606-1",
        "url": "https://www.suse.com/support/update/announcement/2026/suse-su-20260606-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2026:0606-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-February/024370.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1250553",
        "url": "https://bugzilla.suse.com/1250553"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1256804",
        "url": "https://bugzilla.suse.com/1256804"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1256805",
        "url": "https://bugzilla.suse.com/1256805"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1256807",
        "url": "https://bugzilla.suse.com/1256807"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1256808",
        "url": "https://bugzilla.suse.com/1256808"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1256809",
        "url": "https://bugzilla.suse.com/1256809"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1256810",
        "url": "https://bugzilla.suse.com/1256810"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1256811",
        "url": "https://bugzilla.suse.com/1256811"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1256812",
        "url": "https://bugzilla.suse.com/1256812"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1257593",
        "url": "https://bugzilla.suse.com/1257593"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1257594",
        "url": "https://bugzilla.suse.com/1257594"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1257595",
        "url": "https://bugzilla.suse.com/1257595"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-10911 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-10911/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-0989 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-0989/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-0990 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-0990/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-0992 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-0992/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-1757 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-1757/"
      }
    ],
    "title": "Security update for libxml2",
    "tracking": {
      "current_release_date": "2026-02-24T11:19:39Z",
      "generator": {
        "date": "2026-02-24T11:19:39Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2026:0606-1",
      "initial_release_date": "2026-02-24T11:19:39Z",
      "revision_history": [
        {
          "date": "2026-02-24T11:19:39Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libxml2-2-2.9.14-150400.5.55.1.aarch64",
                "product": {
                  "name": "libxml2-2-2.9.14-150400.5.55.1.aarch64",
                  "product_id": "libxml2-2-2.9.14-150400.5.55.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "libxml2-devel-2.9.14-150400.5.55.1.aarch64",
                "product": {
                  "name": "libxml2-devel-2.9.14-150400.5.55.1.aarch64",
                  "product_id": "libxml2-devel-2.9.14-150400.5.55.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "libxml2-tools-2.9.14-150400.5.55.1.aarch64",
                "product": {
                  "name": "libxml2-tools-2.9.14-150400.5.55.1.aarch64",
                  "product_id": "libxml2-tools-2.9.14-150400.5.55.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "python3-libxml2-2.9.14-150400.5.55.1.aarch64",
                "product": {
                  "name": "python3-libxml2-2.9.14-150400.5.55.1.aarch64",
                  "product_id": "python3-libxml2-2.9.14-150400.5.55.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "python311-libxml2-2.9.14-150400.5.55.1.aarch64",
                "product": {
                  "name": "python311-libxml2-2.9.14-150400.5.55.1.aarch64",
                  "product_id": "python311-libxml2-2.9.14-150400.5.55.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libxml2-2-64bit-2.9.14-150400.5.55.1.aarch64_ilp32",
                "product": {
                  "name": "libxml2-2-64bit-2.9.14-150400.5.55.1.aarch64_ilp32",
                  "product_id": "libxml2-2-64bit-2.9.14-150400.5.55.1.aarch64_ilp32"
                }
              },
              {
                "category": "product_version",
                "name": "libxml2-devel-64bit-2.9.14-150400.5.55.1.aarch64_ilp32",
                "product": {
                  "name": "libxml2-devel-64bit-2.9.14-150400.5.55.1.aarch64_ilp32",
                  "product_id": "libxml2-devel-64bit-2.9.14-150400.5.55.1.aarch64_ilp32"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64_ilp32"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libxml2-2-2.9.14-150400.5.55.1.i586",
                "product": {
                  "name": "libxml2-2-2.9.14-150400.5.55.1.i586",
                  "product_id": "libxml2-2-2.9.14-150400.5.55.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "libxml2-devel-2.9.14-150400.5.55.1.i586",
                "product": {
                  "name": "libxml2-devel-2.9.14-150400.5.55.1.i586",
                  "product_id": "libxml2-devel-2.9.14-150400.5.55.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "libxml2-tools-2.9.14-150400.5.55.1.i586",
                "product": {
                  "name": "libxml2-tools-2.9.14-150400.5.55.1.i586",
                  "product_id": "libxml2-tools-2.9.14-150400.5.55.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "python3-libxml2-2.9.14-150400.5.55.1.i586",
                "product": {
                  "name": "python3-libxml2-2.9.14-150400.5.55.1.i586",
                  "product_id": "python3-libxml2-2.9.14-150400.5.55.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "python311-libxml2-2.9.14-150400.5.55.1.i586",
                "product": {
                  "name": "python311-libxml2-2.9.14-150400.5.55.1.i586",
                  "product_id": "python311-libxml2-2.9.14-150400.5.55.1.i586"
                }
              }
            ],
            "category": "architecture",
            "name": "i586"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libxml2-doc-2.9.14-150400.5.55.1.noarch",
                "product": {
                  "name": "libxml2-doc-2.9.14-150400.5.55.1.noarch",
                  "product_id": "libxml2-doc-2.9.14-150400.5.55.1.noarch"
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libxml2-2-2.9.14-150400.5.55.1.ppc64le",
                "product": {
                  "name": "libxml2-2-2.9.14-150400.5.55.1.ppc64le",
                  "product_id": "libxml2-2-2.9.14-150400.5.55.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "libxml2-devel-2.9.14-150400.5.55.1.ppc64le",
                "product": {
                  "name": "libxml2-devel-2.9.14-150400.5.55.1.ppc64le",
                  "product_id": "libxml2-devel-2.9.14-150400.5.55.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "libxml2-tools-2.9.14-150400.5.55.1.ppc64le",
                "product": {
                  "name": "libxml2-tools-2.9.14-150400.5.55.1.ppc64le",
                  "product_id": "libxml2-tools-2.9.14-150400.5.55.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "python3-libxml2-2.9.14-150400.5.55.1.ppc64le",
                "product": {
                  "name": "python3-libxml2-2.9.14-150400.5.55.1.ppc64le",
                  "product_id": "python3-libxml2-2.9.14-150400.5.55.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "python311-libxml2-2.9.14-150400.5.55.1.ppc64le",
                "product": {
                  "name": "python311-libxml2-2.9.14-150400.5.55.1.ppc64le",
                  "product_id": "python311-libxml2-2.9.14-150400.5.55.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libxml2-2-2.9.14-150400.5.55.1.s390x",
                "product": {
                  "name": "libxml2-2-2.9.14-150400.5.55.1.s390x",
                  "product_id": "libxml2-2-2.9.14-150400.5.55.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "libxml2-devel-2.9.14-150400.5.55.1.s390x",
                "product": {
                  "name": "libxml2-devel-2.9.14-150400.5.55.1.s390x",
                  "product_id": "libxml2-devel-2.9.14-150400.5.55.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "libxml2-tools-2.9.14-150400.5.55.1.s390x",
                "product": {
                  "name": "libxml2-tools-2.9.14-150400.5.55.1.s390x",
                  "product_id": "libxml2-tools-2.9.14-150400.5.55.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "python3-libxml2-2.9.14-150400.5.55.1.s390x",
                "product": {
                  "name": "python3-libxml2-2.9.14-150400.5.55.1.s390x",
                  "product_id": "python3-libxml2-2.9.14-150400.5.55.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "python311-libxml2-2.9.14-150400.5.55.1.s390x",
                "product": {
                  "name": "python311-libxml2-2.9.14-150400.5.55.1.s390x",
                  "product_id": "python311-libxml2-2.9.14-150400.5.55.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libxml2-2-2.9.14-150400.5.55.1.x86_64",
                "product": {
                  "name": "libxml2-2-2.9.14-150400.5.55.1.x86_64",
                  "product_id": "libxml2-2-2.9.14-150400.5.55.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libxml2-2-32bit-2.9.14-150400.5.55.1.x86_64",
                "product": {
                  "name": "libxml2-2-32bit-2.9.14-150400.5.55.1.x86_64",
                  "product_id": "libxml2-2-32bit-2.9.14-150400.5.55.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libxml2-devel-2.9.14-150400.5.55.1.x86_64",
                "product": {
                  "name": "libxml2-devel-2.9.14-150400.5.55.1.x86_64",
                  "product_id": "libxml2-devel-2.9.14-150400.5.55.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libxml2-devel-32bit-2.9.14-150400.5.55.1.x86_64",
                "product": {
                  "name": "libxml2-devel-32bit-2.9.14-150400.5.55.1.x86_64",
                  "product_id": "libxml2-devel-32bit-2.9.14-150400.5.55.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libxml2-tools-2.9.14-150400.5.55.1.x86_64",
                "product": {
                  "name": "libxml2-tools-2.9.14-150400.5.55.1.x86_64",
                  "product_id": "libxml2-tools-2.9.14-150400.5.55.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "python3-libxml2-2.9.14-150400.5.55.1.x86_64",
                "product": {
                  "name": "python3-libxml2-2.9.14-150400.5.55.1.x86_64",
                  "product_id": "python3-libxml2-2.9.14-150400.5.55.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "python311-libxml2-2.9.14-150400.5.55.1.x86_64",
                "product": {
                  "name": "python311-libxml2-2.9.14-150400.5.55.1.x86_64",
                  "product_id": "python311-libxml2-2.9.14-150400.5.55.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Micro 5.3",
                "product": {
                  "name": "SUSE Linux Enterprise Micro 5.3",
                  "product_id": "SUSE Linux Enterprise Micro 5.3",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle-micro:5.3"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Micro 5.4",
                "product": {
                  "name": "SUSE Linux Enterprise Micro 5.4",
                  "product_id": "SUSE Linux Enterprise Micro 5.4",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle-micro:5.4"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxml2-2-2.9.14-150400.5.55.1.aarch64 as component of SUSE Linux Enterprise Micro 5.3",
          "product_id": "SUSE Linux Enterprise Micro 5.3:libxml2-2-2.9.14-150400.5.55.1.aarch64"
        },
        "product_reference": "libxml2-2-2.9.14-150400.5.55.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxml2-2-2.9.14-150400.5.55.1.s390x as component of SUSE Linux Enterprise Micro 5.3",
          "product_id": "SUSE Linux Enterprise Micro 5.3:libxml2-2-2.9.14-150400.5.55.1.s390x"
        },
        "product_reference": "libxml2-2-2.9.14-150400.5.55.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxml2-2-2.9.14-150400.5.55.1.x86_64 as component of SUSE Linux Enterprise Micro 5.3",
          "product_id": "SUSE Linux Enterprise Micro 5.3:libxml2-2-2.9.14-150400.5.55.1.x86_64"
        },
        "product_reference": "libxml2-2-2.9.14-150400.5.55.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxml2-tools-2.9.14-150400.5.55.1.aarch64 as component of SUSE Linux Enterprise Micro 5.3",
          "product_id": "SUSE Linux Enterprise Micro 5.3:libxml2-tools-2.9.14-150400.5.55.1.aarch64"
        },
        "product_reference": "libxml2-tools-2.9.14-150400.5.55.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxml2-tools-2.9.14-150400.5.55.1.s390x as component of SUSE Linux Enterprise Micro 5.3",
          "product_id": "SUSE Linux Enterprise Micro 5.3:libxml2-tools-2.9.14-150400.5.55.1.s390x"
        },
        "product_reference": "libxml2-tools-2.9.14-150400.5.55.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxml2-tools-2.9.14-150400.5.55.1.x86_64 as component of SUSE Linux Enterprise Micro 5.3",
          "product_id": "SUSE Linux Enterprise Micro 5.3:libxml2-tools-2.9.14-150400.5.55.1.x86_64"
        },
        "product_reference": "libxml2-tools-2.9.14-150400.5.55.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3-libxml2-2.9.14-150400.5.55.1.aarch64 as component of SUSE Linux Enterprise Micro 5.3",
          "product_id": "SUSE Linux Enterprise Micro 5.3:python3-libxml2-2.9.14-150400.5.55.1.aarch64"
        },
        "product_reference": "python3-libxml2-2.9.14-150400.5.55.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3-libxml2-2.9.14-150400.5.55.1.s390x as component of SUSE Linux Enterprise Micro 5.3",
          "product_id": "SUSE Linux Enterprise Micro 5.3:python3-libxml2-2.9.14-150400.5.55.1.s390x"
        },
        "product_reference": "python3-libxml2-2.9.14-150400.5.55.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3-libxml2-2.9.14-150400.5.55.1.x86_64 as component of SUSE Linux Enterprise Micro 5.3",
          "product_id": "SUSE Linux Enterprise Micro 5.3:python3-libxml2-2.9.14-150400.5.55.1.x86_64"
        },
        "product_reference": "python3-libxml2-2.9.14-150400.5.55.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxml2-2-2.9.14-150400.5.55.1.aarch64 as component of SUSE Linux Enterprise Micro 5.4",
          "product_id": "SUSE Linux Enterprise Micro 5.4:libxml2-2-2.9.14-150400.5.55.1.aarch64"
        },
        "product_reference": "libxml2-2-2.9.14-150400.5.55.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxml2-2-2.9.14-150400.5.55.1.s390x as component of SUSE Linux Enterprise Micro 5.4",
          "product_id": "SUSE Linux Enterprise Micro 5.4:libxml2-2-2.9.14-150400.5.55.1.s390x"
        },
        "product_reference": "libxml2-2-2.9.14-150400.5.55.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxml2-2-2.9.14-150400.5.55.1.x86_64 as component of SUSE Linux Enterprise Micro 5.4",
          "product_id": "SUSE Linux Enterprise Micro 5.4:libxml2-2-2.9.14-150400.5.55.1.x86_64"
        },
        "product_reference": "libxml2-2-2.9.14-150400.5.55.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxml2-tools-2.9.14-150400.5.55.1.aarch64 as component of SUSE Linux Enterprise Micro 5.4",
          "product_id": "SUSE Linux Enterprise Micro 5.4:libxml2-tools-2.9.14-150400.5.55.1.aarch64"
        },
        "product_reference": "libxml2-tools-2.9.14-150400.5.55.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxml2-tools-2.9.14-150400.5.55.1.s390x as component of SUSE Linux Enterprise Micro 5.4",
          "product_id": "SUSE Linux Enterprise Micro 5.4:libxml2-tools-2.9.14-150400.5.55.1.s390x"
        },
        "product_reference": "libxml2-tools-2.9.14-150400.5.55.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxml2-tools-2.9.14-150400.5.55.1.x86_64 as component of SUSE Linux Enterprise Micro 5.4",
          "product_id": "SUSE Linux Enterprise Micro 5.4:libxml2-tools-2.9.14-150400.5.55.1.x86_64"
        },
        "product_reference": "libxml2-tools-2.9.14-150400.5.55.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3-libxml2-2.9.14-150400.5.55.1.aarch64 as component of SUSE Linux Enterprise Micro 5.4",
          "product_id": "SUSE Linux Enterprise Micro 5.4:python3-libxml2-2.9.14-150400.5.55.1.aarch64"
        },
        "product_reference": "python3-libxml2-2.9.14-150400.5.55.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3-libxml2-2.9.14-150400.5.55.1.s390x as component of SUSE Linux Enterprise Micro 5.4",
          "product_id": "SUSE Linux Enterprise Micro 5.4:python3-libxml2-2.9.14-150400.5.55.1.s390x"
        },
        "product_reference": "python3-libxml2-2.9.14-150400.5.55.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3-libxml2-2.9.14-150400.5.55.1.x86_64 as component of SUSE Linux Enterprise Micro 5.4",
          "product_id": "SUSE Linux Enterprise Micro 5.4:python3-libxml2-2.9.14-150400.5.55.1.x86_64"
        },
        "product_reference": "python3-libxml2-2.9.14-150400.5.55.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Micro 5.4"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-10911",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-10911"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A use-after-free vulnerability was found in libxslt while parsing xsl nodes that may lead to the dereference of expired pointers and application crash.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Micro 5.3:libxml2-2-2.9.14-150400.5.55.1.aarch64",
          "SUSE Linux Enterprise Micro 5.3:libxml2-2-2.9.14-150400.5.55.1.s390x",
          "SUSE Linux Enterprise Micro 5.3:libxml2-2-2.9.14-150400.5.55.1.x86_64",
          "SUSE Linux Enterprise Micro 5.3:libxml2-tools-2.9.14-150400.5.55.1.aarch64",
          "SUSE Linux Enterprise Micro 5.3:libxml2-tools-2.9.14-150400.5.55.1.s390x",
          "SUSE Linux Enterprise Micro 5.3:libxml2-tools-2.9.14-150400.5.55.1.x86_64",
          "SUSE Linux Enterprise Micro 5.3:python3-libxml2-2.9.14-150400.5.55.1.aarch64",
          "SUSE Linux Enterprise Micro 5.3:python3-libxml2-2.9.14-150400.5.55.1.s390x",
          "SUSE Linux Enterprise Micro 5.3:python3-libxml2-2.9.14-150400.5.55.1.x86_64",
          "SUSE Linux Enterprise Micro 5.4:libxml2-2-2.9.14-150400.5.55.1.aarch64",
          "SUSE Linux Enterprise Micro 5.4:libxml2-2-2.9.14-150400.5.55.1.s390x",
          "SUSE Linux Enterprise Micro 5.4:libxml2-2-2.9.14-150400.5.55.1.x86_64",
          "SUSE Linux Enterprise Micro 5.4:libxml2-tools-2.9.14-150400.5.55.1.aarch64",
          "SUSE Linux Enterprise Micro 5.4:libxml2-tools-2.9.14-150400.5.55.1.s390x",
          "SUSE Linux Enterprise Micro 5.4:libxml2-tools-2.9.14-150400.5.55.1.x86_64",
          "SUSE Linux Enterprise Micro 5.4:python3-libxml2-2.9.14-150400.5.55.1.aarch64",
          "SUSE Linux Enterprise Micro 5.4:python3-libxml2-2.9.14-150400.5.55.1.s390x",
          "SUSE Linux Enterprise Micro 5.4:python3-libxml2-2.9.14-150400.5.55.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-10911",
          "url": "https://www.suse.com/security/cve/CVE-2025-10911"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1250553 for CVE-2025-10911",
          "url": "https://bugzilla.suse.com/1250553"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Micro 5.3:libxml2-2-2.9.14-150400.5.55.1.aarch64",
            "SUSE Linux Enterprise Micro 5.3:libxml2-2-2.9.14-150400.5.55.1.s390x",
            "SUSE Linux Enterprise Micro 5.3:libxml2-2-2.9.14-150400.5.55.1.x86_64",
            "SUSE Linux Enterprise Micro 5.3:libxml2-tools-2.9.14-150400.5.55.1.aarch64",
            "SUSE Linux Enterprise Micro 5.3:libxml2-tools-2.9.14-150400.5.55.1.s390x",
            "SUSE Linux Enterprise Micro 5.3:libxml2-tools-2.9.14-150400.5.55.1.x86_64",
            "SUSE Linux Enterprise Micro 5.3:python3-libxml2-2.9.14-150400.5.55.1.aarch64",
            "SUSE Linux Enterprise Micro 5.3:python3-libxml2-2.9.14-150400.5.55.1.s390x",
            "SUSE Linux Enterprise Micro 5.3:python3-libxml2-2.9.14-150400.5.55.1.x86_64",
            "SUSE Linux Enterprise Micro 5.4:libxml2-2-2.9.14-150400.5.55.1.aarch64",
            "SUSE Linux Enterprise Micro 5.4:libxml2-2-2.9.14-150400.5.55.1.s390x",
            "SUSE Linux Enterprise Micro 5.4:libxml2-2-2.9.14-150400.5.55.1.x86_64",
            "SUSE Linux Enterprise Micro 5.4:libxml2-tools-2.9.14-150400.5.55.1.aarch64",
            "SUSE Linux Enterprise Micro 5.4:libxml2-tools-2.9.14-150400.5.55.1.s390x",
            "SUSE Linux Enterprise Micro 5.4:libxml2-tools-2.9.14-150400.5.55.1.x86_64",
            "SUSE Linux Enterprise Micro 5.4:python3-libxml2-2.9.14-150400.5.55.1.aarch64",
            "SUSE Linux Enterprise Micro 5.4:python3-libxml2-2.9.14-150400.5.55.1.s390x",
            "SUSE Linux Enterprise Micro 5.4:python3-libxml2-2.9.14-150400.5.55.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Micro 5.3:libxml2-2-2.9.14-150400.5.55.1.aarch64",
            "SUSE Linux Enterprise Micro 5.3:libxml2-2-2.9.14-150400.5.55.1.s390x",
            "SUSE Linux Enterprise Micro 5.3:libxml2-2-2.9.14-150400.5.55.1.x86_64",
            "SUSE Linux Enterprise Micro 5.3:libxml2-tools-2.9.14-150400.5.55.1.aarch64",
            "SUSE Linux Enterprise Micro 5.3:libxml2-tools-2.9.14-150400.5.55.1.s390x",
            "SUSE Linux Enterprise Micro 5.3:libxml2-tools-2.9.14-150400.5.55.1.x86_64",
            "SUSE Linux Enterprise Micro 5.3:python3-libxml2-2.9.14-150400.5.55.1.aarch64",
            "SUSE Linux Enterprise Micro 5.3:python3-libxml2-2.9.14-150400.5.55.1.s390x",
            "SUSE Linux Enterprise Micro 5.3:python3-libxml2-2.9.14-150400.5.55.1.x86_64",
            "SUSE Linux Enterprise Micro 5.4:libxml2-2-2.9.14-150400.5.55.1.aarch64",
            "SUSE Linux Enterprise Micro 5.4:libxml2-2-2.9.14-150400.5.55.1.s390x",
            "SUSE Linux Enterprise Micro 5.4:libxml2-2-2.9.14-150400.5.55.1.x86_64",
            "SUSE Linux Enterprise Micro 5.4:libxml2-tools-2.9.14-150400.5.55.1.aarch64",
            "SUSE Linux Enterprise Micro 5.4:libxml2-tools-2.9.14-150400.5.55.1.s390x",
            "SUSE Linux Enterprise Micro 5.4:libxml2-tools-2.9.14-150400.5.55.1.x86_64",
            "SUSE Linux Enterprise Micro 5.4:python3-libxml2-2.9.14-150400.5.55.1.aarch64",
            "SUSE Linux Enterprise Micro 5.4:python3-libxml2-2.9.14-150400.5.55.1.s390x",
            "SUSE Linux Enterprise Micro 5.4:python3-libxml2-2.9.14-150400.5.55.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-02-24T11:19:39Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-10911"
    },
    {
      "cve": "CVE-2026-0989",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-0989"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was identified in the RelaxNG parser of libxml2 related to how external schema inclusions are handled. The parser does not enforce a limit on inclusion depth when resolving nested \u003cinclude\u003e directives. Specially crafted or overly complex schemas can cause excessive recursion during parsing. This may lead to stack exhaustion and application crashes, creating a denial-of-service risk.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Micro 5.3:libxml2-2-2.9.14-150400.5.55.1.aarch64",
          "SUSE Linux Enterprise Micro 5.3:libxml2-2-2.9.14-150400.5.55.1.s390x",
          "SUSE Linux Enterprise Micro 5.3:libxml2-2-2.9.14-150400.5.55.1.x86_64",
          "SUSE Linux Enterprise Micro 5.3:libxml2-tools-2.9.14-150400.5.55.1.aarch64",
          "SUSE Linux Enterprise Micro 5.3:libxml2-tools-2.9.14-150400.5.55.1.s390x",
          "SUSE Linux Enterprise Micro 5.3:libxml2-tools-2.9.14-150400.5.55.1.x86_64",
          "SUSE Linux Enterprise Micro 5.3:python3-libxml2-2.9.14-150400.5.55.1.aarch64",
          "SUSE Linux Enterprise Micro 5.3:python3-libxml2-2.9.14-150400.5.55.1.s390x",
          "SUSE Linux Enterprise Micro 5.3:python3-libxml2-2.9.14-150400.5.55.1.x86_64",
          "SUSE Linux Enterprise Micro 5.4:libxml2-2-2.9.14-150400.5.55.1.aarch64",
          "SUSE Linux Enterprise Micro 5.4:libxml2-2-2.9.14-150400.5.55.1.s390x",
          "SUSE Linux Enterprise Micro 5.4:libxml2-2-2.9.14-150400.5.55.1.x86_64",
          "SUSE Linux Enterprise Micro 5.4:libxml2-tools-2.9.14-150400.5.55.1.aarch64",
          "SUSE Linux Enterprise Micro 5.4:libxml2-tools-2.9.14-150400.5.55.1.s390x",
          "SUSE Linux Enterprise Micro 5.4:libxml2-tools-2.9.14-150400.5.55.1.x86_64",
          "SUSE Linux Enterprise Micro 5.4:python3-libxml2-2.9.14-150400.5.55.1.aarch64",
          "SUSE Linux Enterprise Micro 5.4:python3-libxml2-2.9.14-150400.5.55.1.s390x",
          "SUSE Linux Enterprise Micro 5.4:python3-libxml2-2.9.14-150400.5.55.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-0989",
          "url": "https://www.suse.com/security/cve/CVE-2026-0989"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1256804 for CVE-2026-0989",
          "url": "https://bugzilla.suse.com/1256804"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Micro 5.3:libxml2-2-2.9.14-150400.5.55.1.aarch64",
            "SUSE Linux Enterprise Micro 5.3:libxml2-2-2.9.14-150400.5.55.1.s390x",
            "SUSE Linux Enterprise Micro 5.3:libxml2-2-2.9.14-150400.5.55.1.x86_64",
            "SUSE Linux Enterprise Micro 5.3:libxml2-tools-2.9.14-150400.5.55.1.aarch64",
            "SUSE Linux Enterprise Micro 5.3:libxml2-tools-2.9.14-150400.5.55.1.s390x",
            "SUSE Linux Enterprise Micro 5.3:libxml2-tools-2.9.14-150400.5.55.1.x86_64",
            "SUSE Linux Enterprise Micro 5.3:python3-libxml2-2.9.14-150400.5.55.1.aarch64",
            "SUSE Linux Enterprise Micro 5.3:python3-libxml2-2.9.14-150400.5.55.1.s390x",
            "SUSE Linux Enterprise Micro 5.3:python3-libxml2-2.9.14-150400.5.55.1.x86_64",
            "SUSE Linux Enterprise Micro 5.4:libxml2-2-2.9.14-150400.5.55.1.aarch64",
            "SUSE Linux Enterprise Micro 5.4:libxml2-2-2.9.14-150400.5.55.1.s390x",
            "SUSE Linux Enterprise Micro 5.4:libxml2-2-2.9.14-150400.5.55.1.x86_64",
            "SUSE Linux Enterprise Micro 5.4:libxml2-tools-2.9.14-150400.5.55.1.aarch64",
            "SUSE Linux Enterprise Micro 5.4:libxml2-tools-2.9.14-150400.5.55.1.s390x",
            "SUSE Linux Enterprise Micro 5.4:libxml2-tools-2.9.14-150400.5.55.1.x86_64",
            "SUSE Linux Enterprise Micro 5.4:python3-libxml2-2.9.14-150400.5.55.1.aarch64",
            "SUSE Linux Enterprise Micro 5.4:python3-libxml2-2.9.14-150400.5.55.1.s390x",
            "SUSE Linux Enterprise Micro 5.4:python3-libxml2-2.9.14-150400.5.55.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Micro 5.3:libxml2-2-2.9.14-150400.5.55.1.aarch64",
            "SUSE Linux Enterprise Micro 5.3:libxml2-2-2.9.14-150400.5.55.1.s390x",
            "SUSE Linux Enterprise Micro 5.3:libxml2-2-2.9.14-150400.5.55.1.x86_64",
            "SUSE Linux Enterprise Micro 5.3:libxml2-tools-2.9.14-150400.5.55.1.aarch64",
            "SUSE Linux Enterprise Micro 5.3:libxml2-tools-2.9.14-150400.5.55.1.s390x",
            "SUSE Linux Enterprise Micro 5.3:libxml2-tools-2.9.14-150400.5.55.1.x86_64",
            "SUSE Linux Enterprise Micro 5.3:python3-libxml2-2.9.14-150400.5.55.1.aarch64",
            "SUSE Linux Enterprise Micro 5.3:python3-libxml2-2.9.14-150400.5.55.1.s390x",
            "SUSE Linux Enterprise Micro 5.3:python3-libxml2-2.9.14-150400.5.55.1.x86_64",
            "SUSE Linux Enterprise Micro 5.4:libxml2-2-2.9.14-150400.5.55.1.aarch64",
            "SUSE Linux Enterprise Micro 5.4:libxml2-2-2.9.14-150400.5.55.1.s390x",
            "SUSE Linux Enterprise Micro 5.4:libxml2-2-2.9.14-150400.5.55.1.x86_64",
            "SUSE Linux Enterprise Micro 5.4:libxml2-tools-2.9.14-150400.5.55.1.aarch64",
            "SUSE Linux Enterprise Micro 5.4:libxml2-tools-2.9.14-150400.5.55.1.s390x",
            "SUSE Linux Enterprise Micro 5.4:libxml2-tools-2.9.14-150400.5.55.1.x86_64",
            "SUSE Linux Enterprise Micro 5.4:python3-libxml2-2.9.14-150400.5.55.1.aarch64",
            "SUSE Linux Enterprise Micro 5.4:python3-libxml2-2.9.14-150400.5.55.1.s390x",
            "SUSE Linux Enterprise Micro 5.4:python3-libxml2-2.9.14-150400.5.55.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-02-24T11:19:39Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-0989"
    },
    {
      "cve": "CVE-2026-0990",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-0990"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was found in libxml2, an XML parsing library. This uncontrolled recursion vulnerability occurs in the xmlCatalogXMLResolveURI function when an XML catalog contains a delegate URI entry that references itself. A remote attacker could exploit this configuration-dependent issue by providing a specially crafted XML catalog, leading to infinite recursion and call stack exhaustion. This ultimately results in a segmentation fault, causing a Denial of Service (DoS) by crashing affected applications.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Micro 5.3:libxml2-2-2.9.14-150400.5.55.1.aarch64",
          "SUSE Linux Enterprise Micro 5.3:libxml2-2-2.9.14-150400.5.55.1.s390x",
          "SUSE Linux Enterprise Micro 5.3:libxml2-2-2.9.14-150400.5.55.1.x86_64",
          "SUSE Linux Enterprise Micro 5.3:libxml2-tools-2.9.14-150400.5.55.1.aarch64",
          "SUSE Linux Enterprise Micro 5.3:libxml2-tools-2.9.14-150400.5.55.1.s390x",
          "SUSE Linux Enterprise Micro 5.3:libxml2-tools-2.9.14-150400.5.55.1.x86_64",
          "SUSE Linux Enterprise Micro 5.3:python3-libxml2-2.9.14-150400.5.55.1.aarch64",
          "SUSE Linux Enterprise Micro 5.3:python3-libxml2-2.9.14-150400.5.55.1.s390x",
          "SUSE Linux Enterprise Micro 5.3:python3-libxml2-2.9.14-150400.5.55.1.x86_64",
          "SUSE Linux Enterprise Micro 5.4:libxml2-2-2.9.14-150400.5.55.1.aarch64",
          "SUSE Linux Enterprise Micro 5.4:libxml2-2-2.9.14-150400.5.55.1.s390x",
          "SUSE Linux Enterprise Micro 5.4:libxml2-2-2.9.14-150400.5.55.1.x86_64",
          "SUSE Linux Enterprise Micro 5.4:libxml2-tools-2.9.14-150400.5.55.1.aarch64",
          "SUSE Linux Enterprise Micro 5.4:libxml2-tools-2.9.14-150400.5.55.1.s390x",
          "SUSE Linux Enterprise Micro 5.4:libxml2-tools-2.9.14-150400.5.55.1.x86_64",
          "SUSE Linux Enterprise Micro 5.4:python3-libxml2-2.9.14-150400.5.55.1.aarch64",
          "SUSE Linux Enterprise Micro 5.4:python3-libxml2-2.9.14-150400.5.55.1.s390x",
          "SUSE Linux Enterprise Micro 5.4:python3-libxml2-2.9.14-150400.5.55.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-0990",
          "url": "https://www.suse.com/security/cve/CVE-2026-0990"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1256806 for CVE-2026-0990",
          "url": "https://bugzilla.suse.com/1256806"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Micro 5.3:libxml2-2-2.9.14-150400.5.55.1.aarch64",
            "SUSE Linux Enterprise Micro 5.3:libxml2-2-2.9.14-150400.5.55.1.s390x",
            "SUSE Linux Enterprise Micro 5.3:libxml2-2-2.9.14-150400.5.55.1.x86_64",
            "SUSE Linux Enterprise Micro 5.3:libxml2-tools-2.9.14-150400.5.55.1.aarch64",
            "SUSE Linux Enterprise Micro 5.3:libxml2-tools-2.9.14-150400.5.55.1.s390x",
            "SUSE Linux Enterprise Micro 5.3:libxml2-tools-2.9.14-150400.5.55.1.x86_64",
            "SUSE Linux Enterprise Micro 5.3:python3-libxml2-2.9.14-150400.5.55.1.aarch64",
            "SUSE Linux Enterprise Micro 5.3:python3-libxml2-2.9.14-150400.5.55.1.s390x",
            "SUSE Linux Enterprise Micro 5.3:python3-libxml2-2.9.14-150400.5.55.1.x86_64",
            "SUSE Linux Enterprise Micro 5.4:libxml2-2-2.9.14-150400.5.55.1.aarch64",
            "SUSE Linux Enterprise Micro 5.4:libxml2-2-2.9.14-150400.5.55.1.s390x",
            "SUSE Linux Enterprise Micro 5.4:libxml2-2-2.9.14-150400.5.55.1.x86_64",
            "SUSE Linux Enterprise Micro 5.4:libxml2-tools-2.9.14-150400.5.55.1.aarch64",
            "SUSE Linux Enterprise Micro 5.4:libxml2-tools-2.9.14-150400.5.55.1.s390x",
            "SUSE Linux Enterprise Micro 5.4:libxml2-tools-2.9.14-150400.5.55.1.x86_64",
            "SUSE Linux Enterprise Micro 5.4:python3-libxml2-2.9.14-150400.5.55.1.aarch64",
            "SUSE Linux Enterprise Micro 5.4:python3-libxml2-2.9.14-150400.5.55.1.s390x",
            "SUSE Linux Enterprise Micro 5.4:python3-libxml2-2.9.14-150400.5.55.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Micro 5.3:libxml2-2-2.9.14-150400.5.55.1.aarch64",
            "SUSE Linux Enterprise Micro 5.3:libxml2-2-2.9.14-150400.5.55.1.s390x",
            "SUSE Linux Enterprise Micro 5.3:libxml2-2-2.9.14-150400.5.55.1.x86_64",
            "SUSE Linux Enterprise Micro 5.3:libxml2-tools-2.9.14-150400.5.55.1.aarch64",
            "SUSE Linux Enterprise Micro 5.3:libxml2-tools-2.9.14-150400.5.55.1.s390x",
            "SUSE Linux Enterprise Micro 5.3:libxml2-tools-2.9.14-150400.5.55.1.x86_64",
            "SUSE Linux Enterprise Micro 5.3:python3-libxml2-2.9.14-150400.5.55.1.aarch64",
            "SUSE Linux Enterprise Micro 5.3:python3-libxml2-2.9.14-150400.5.55.1.s390x",
            "SUSE Linux Enterprise Micro 5.3:python3-libxml2-2.9.14-150400.5.55.1.x86_64",
            "SUSE Linux Enterprise Micro 5.4:libxml2-2-2.9.14-150400.5.55.1.aarch64",
            "SUSE Linux Enterprise Micro 5.4:libxml2-2-2.9.14-150400.5.55.1.s390x",
            "SUSE Linux Enterprise Micro 5.4:libxml2-2-2.9.14-150400.5.55.1.x86_64",
            "SUSE Linux Enterprise Micro 5.4:libxml2-tools-2.9.14-150400.5.55.1.aarch64",
            "SUSE Linux Enterprise Micro 5.4:libxml2-tools-2.9.14-150400.5.55.1.s390x",
            "SUSE Linux Enterprise Micro 5.4:libxml2-tools-2.9.14-150400.5.55.1.x86_64",
            "SUSE Linux Enterprise Micro 5.4:python3-libxml2-2.9.14-150400.5.55.1.aarch64",
            "SUSE Linux Enterprise Micro 5.4:python3-libxml2-2.9.14-150400.5.55.1.s390x",
            "SUSE Linux Enterprise Micro 5.4:python3-libxml2-2.9.14-150400.5.55.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-02-24T11:19:39Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-0990"
    },
    {
      "cve": "CVE-2026-0992",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-0992"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was found in the libxml2 library. This uncontrolled resource consumption vulnerability occurs when processing XML catalogs that contain repeated \u003cnextCatalog\u003e elements pointing to the same downstream catalog. A remote attacker can exploit this by supplying crafted catalogs, causing the parser to redundantly traverse catalog chains. This leads to excessive CPU consumption and degrades application availability, resulting in a denial-of-service condition.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Micro 5.3:libxml2-2-2.9.14-150400.5.55.1.aarch64",
          "SUSE Linux Enterprise Micro 5.3:libxml2-2-2.9.14-150400.5.55.1.s390x",
          "SUSE Linux Enterprise Micro 5.3:libxml2-2-2.9.14-150400.5.55.1.x86_64",
          "SUSE Linux Enterprise Micro 5.3:libxml2-tools-2.9.14-150400.5.55.1.aarch64",
          "SUSE Linux Enterprise Micro 5.3:libxml2-tools-2.9.14-150400.5.55.1.s390x",
          "SUSE Linux Enterprise Micro 5.3:libxml2-tools-2.9.14-150400.5.55.1.x86_64",
          "SUSE Linux Enterprise Micro 5.3:python3-libxml2-2.9.14-150400.5.55.1.aarch64",
          "SUSE Linux Enterprise Micro 5.3:python3-libxml2-2.9.14-150400.5.55.1.s390x",
          "SUSE Linux Enterprise Micro 5.3:python3-libxml2-2.9.14-150400.5.55.1.x86_64",
          "SUSE Linux Enterprise Micro 5.4:libxml2-2-2.9.14-150400.5.55.1.aarch64",
          "SUSE Linux Enterprise Micro 5.4:libxml2-2-2.9.14-150400.5.55.1.s390x",
          "SUSE Linux Enterprise Micro 5.4:libxml2-2-2.9.14-150400.5.55.1.x86_64",
          "SUSE Linux Enterprise Micro 5.4:libxml2-tools-2.9.14-150400.5.55.1.aarch64",
          "SUSE Linux Enterprise Micro 5.4:libxml2-tools-2.9.14-150400.5.55.1.s390x",
          "SUSE Linux Enterprise Micro 5.4:libxml2-tools-2.9.14-150400.5.55.1.x86_64",
          "SUSE Linux Enterprise Micro 5.4:python3-libxml2-2.9.14-150400.5.55.1.aarch64",
          "SUSE Linux Enterprise Micro 5.4:python3-libxml2-2.9.14-150400.5.55.1.s390x",
          "SUSE Linux Enterprise Micro 5.4:python3-libxml2-2.9.14-150400.5.55.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-0992",
          "url": "https://www.suse.com/security/cve/CVE-2026-0992"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1256808 for CVE-2026-0992",
          "url": "https://bugzilla.suse.com/1256808"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Micro 5.3:libxml2-2-2.9.14-150400.5.55.1.aarch64",
            "SUSE Linux Enterprise Micro 5.3:libxml2-2-2.9.14-150400.5.55.1.s390x",
            "SUSE Linux Enterprise Micro 5.3:libxml2-2-2.9.14-150400.5.55.1.x86_64",
            "SUSE Linux Enterprise Micro 5.3:libxml2-tools-2.9.14-150400.5.55.1.aarch64",
            "SUSE Linux Enterprise Micro 5.3:libxml2-tools-2.9.14-150400.5.55.1.s390x",
            "SUSE Linux Enterprise Micro 5.3:libxml2-tools-2.9.14-150400.5.55.1.x86_64",
            "SUSE Linux Enterprise Micro 5.3:python3-libxml2-2.9.14-150400.5.55.1.aarch64",
            "SUSE Linux Enterprise Micro 5.3:python3-libxml2-2.9.14-150400.5.55.1.s390x",
            "SUSE Linux Enterprise Micro 5.3:python3-libxml2-2.9.14-150400.5.55.1.x86_64",
            "SUSE Linux Enterprise Micro 5.4:libxml2-2-2.9.14-150400.5.55.1.aarch64",
            "SUSE Linux Enterprise Micro 5.4:libxml2-2-2.9.14-150400.5.55.1.s390x",
            "SUSE Linux Enterprise Micro 5.4:libxml2-2-2.9.14-150400.5.55.1.x86_64",
            "SUSE Linux Enterprise Micro 5.4:libxml2-tools-2.9.14-150400.5.55.1.aarch64",
            "SUSE Linux Enterprise Micro 5.4:libxml2-tools-2.9.14-150400.5.55.1.s390x",
            "SUSE Linux Enterprise Micro 5.4:libxml2-tools-2.9.14-150400.5.55.1.x86_64",
            "SUSE Linux Enterprise Micro 5.4:python3-libxml2-2.9.14-150400.5.55.1.aarch64",
            "SUSE Linux Enterprise Micro 5.4:python3-libxml2-2.9.14-150400.5.55.1.s390x",
            "SUSE Linux Enterprise Micro 5.4:python3-libxml2-2.9.14-150400.5.55.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Micro 5.3:libxml2-2-2.9.14-150400.5.55.1.aarch64",
            "SUSE Linux Enterprise Micro 5.3:libxml2-2-2.9.14-150400.5.55.1.s390x",
            "SUSE Linux Enterprise Micro 5.3:libxml2-2-2.9.14-150400.5.55.1.x86_64",
            "SUSE Linux Enterprise Micro 5.3:libxml2-tools-2.9.14-150400.5.55.1.aarch64",
            "SUSE Linux Enterprise Micro 5.3:libxml2-tools-2.9.14-150400.5.55.1.s390x",
            "SUSE Linux Enterprise Micro 5.3:libxml2-tools-2.9.14-150400.5.55.1.x86_64",
            "SUSE Linux Enterprise Micro 5.3:python3-libxml2-2.9.14-150400.5.55.1.aarch64",
            "SUSE Linux Enterprise Micro 5.3:python3-libxml2-2.9.14-150400.5.55.1.s390x",
            "SUSE Linux Enterprise Micro 5.3:python3-libxml2-2.9.14-150400.5.55.1.x86_64",
            "SUSE Linux Enterprise Micro 5.4:libxml2-2-2.9.14-150400.5.55.1.aarch64",
            "SUSE Linux Enterprise Micro 5.4:libxml2-2-2.9.14-150400.5.55.1.s390x",
            "SUSE Linux Enterprise Micro 5.4:libxml2-2-2.9.14-150400.5.55.1.x86_64",
            "SUSE Linux Enterprise Micro 5.4:libxml2-tools-2.9.14-150400.5.55.1.aarch64",
            "SUSE Linux Enterprise Micro 5.4:libxml2-tools-2.9.14-150400.5.55.1.s390x",
            "SUSE Linux Enterprise Micro 5.4:libxml2-tools-2.9.14-150400.5.55.1.x86_64",
            "SUSE Linux Enterprise Micro 5.4:python3-libxml2-2.9.14-150400.5.55.1.aarch64",
            "SUSE Linux Enterprise Micro 5.4:python3-libxml2-2.9.14-150400.5.55.1.s390x",
            "SUSE Linux Enterprise Micro 5.4:python3-libxml2-2.9.14-150400.5.55.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-02-24T11:19:39Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-0992"
    },
    {
      "cve": "CVE-2026-1757",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-1757"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was identified in the interactive shell of the xmllint utility, part of the libxml2 project, where memory allocated for user input is not properly released under certain conditions. When a user submits input consisting only of whitespace, the program skips command execution but fails to free the allocated buffer. Repeating this action causes memory to continuously accumulate. Over time, this can exhaust system memory and terminate the xmllint process, creating a denial-of-service condition on the local system.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Micro 5.3:libxml2-2-2.9.14-150400.5.55.1.aarch64",
          "SUSE Linux Enterprise Micro 5.3:libxml2-2-2.9.14-150400.5.55.1.s390x",
          "SUSE Linux Enterprise Micro 5.3:libxml2-2-2.9.14-150400.5.55.1.x86_64",
          "SUSE Linux Enterprise Micro 5.3:libxml2-tools-2.9.14-150400.5.55.1.aarch64",
          "SUSE Linux Enterprise Micro 5.3:libxml2-tools-2.9.14-150400.5.55.1.s390x",
          "SUSE Linux Enterprise Micro 5.3:libxml2-tools-2.9.14-150400.5.55.1.x86_64",
          "SUSE Linux Enterprise Micro 5.3:python3-libxml2-2.9.14-150400.5.55.1.aarch64",
          "SUSE Linux Enterprise Micro 5.3:python3-libxml2-2.9.14-150400.5.55.1.s390x",
          "SUSE Linux Enterprise Micro 5.3:python3-libxml2-2.9.14-150400.5.55.1.x86_64",
          "SUSE Linux Enterprise Micro 5.4:libxml2-2-2.9.14-150400.5.55.1.aarch64",
          "SUSE Linux Enterprise Micro 5.4:libxml2-2-2.9.14-150400.5.55.1.s390x",
          "SUSE Linux Enterprise Micro 5.4:libxml2-2-2.9.14-150400.5.55.1.x86_64",
          "SUSE Linux Enterprise Micro 5.4:libxml2-tools-2.9.14-150400.5.55.1.aarch64",
          "SUSE Linux Enterprise Micro 5.4:libxml2-tools-2.9.14-150400.5.55.1.s390x",
          "SUSE Linux Enterprise Micro 5.4:libxml2-tools-2.9.14-150400.5.55.1.x86_64",
          "SUSE Linux Enterprise Micro 5.4:python3-libxml2-2.9.14-150400.5.55.1.aarch64",
          "SUSE Linux Enterprise Micro 5.4:python3-libxml2-2.9.14-150400.5.55.1.s390x",
          "SUSE Linux Enterprise Micro 5.4:python3-libxml2-2.9.14-150400.5.55.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-1757",
          "url": "https://www.suse.com/security/cve/CVE-2026-1757"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1257593 for CVE-2026-1757",
          "url": "https://bugzilla.suse.com/1257593"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Micro 5.3:libxml2-2-2.9.14-150400.5.55.1.aarch64",
            "SUSE Linux Enterprise Micro 5.3:libxml2-2-2.9.14-150400.5.55.1.s390x",
            "SUSE Linux Enterprise Micro 5.3:libxml2-2-2.9.14-150400.5.55.1.x86_64",
            "SUSE Linux Enterprise Micro 5.3:libxml2-tools-2.9.14-150400.5.55.1.aarch64",
            "SUSE Linux Enterprise Micro 5.3:libxml2-tools-2.9.14-150400.5.55.1.s390x",
            "SUSE Linux Enterprise Micro 5.3:libxml2-tools-2.9.14-150400.5.55.1.x86_64",
            "SUSE Linux Enterprise Micro 5.3:python3-libxml2-2.9.14-150400.5.55.1.aarch64",
            "SUSE Linux Enterprise Micro 5.3:python3-libxml2-2.9.14-150400.5.55.1.s390x",
            "SUSE Linux Enterprise Micro 5.3:python3-libxml2-2.9.14-150400.5.55.1.x86_64",
            "SUSE Linux Enterprise Micro 5.4:libxml2-2-2.9.14-150400.5.55.1.aarch64",
            "SUSE Linux Enterprise Micro 5.4:libxml2-2-2.9.14-150400.5.55.1.s390x",
            "SUSE Linux Enterprise Micro 5.4:libxml2-2-2.9.14-150400.5.55.1.x86_64",
            "SUSE Linux Enterprise Micro 5.4:libxml2-tools-2.9.14-150400.5.55.1.aarch64",
            "SUSE Linux Enterprise Micro 5.4:libxml2-tools-2.9.14-150400.5.55.1.s390x",
            "SUSE Linux Enterprise Micro 5.4:libxml2-tools-2.9.14-150400.5.55.1.x86_64",
            "SUSE Linux Enterprise Micro 5.4:python3-libxml2-2.9.14-150400.5.55.1.aarch64",
            "SUSE Linux Enterprise Micro 5.4:python3-libxml2-2.9.14-150400.5.55.1.s390x",
            "SUSE Linux Enterprise Micro 5.4:python3-libxml2-2.9.14-150400.5.55.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Micro 5.3:libxml2-2-2.9.14-150400.5.55.1.aarch64",
            "SUSE Linux Enterprise Micro 5.3:libxml2-2-2.9.14-150400.5.55.1.s390x",
            "SUSE Linux Enterprise Micro 5.3:libxml2-2-2.9.14-150400.5.55.1.x86_64",
            "SUSE Linux Enterprise Micro 5.3:libxml2-tools-2.9.14-150400.5.55.1.aarch64",
            "SUSE Linux Enterprise Micro 5.3:libxml2-tools-2.9.14-150400.5.55.1.s390x",
            "SUSE Linux Enterprise Micro 5.3:libxml2-tools-2.9.14-150400.5.55.1.x86_64",
            "SUSE Linux Enterprise Micro 5.3:python3-libxml2-2.9.14-150400.5.55.1.aarch64",
            "SUSE Linux Enterprise Micro 5.3:python3-libxml2-2.9.14-150400.5.55.1.s390x",
            "SUSE Linux Enterprise Micro 5.3:python3-libxml2-2.9.14-150400.5.55.1.x86_64",
            "SUSE Linux Enterprise Micro 5.4:libxml2-2-2.9.14-150400.5.55.1.aarch64",
            "SUSE Linux Enterprise Micro 5.4:libxml2-2-2.9.14-150400.5.55.1.s390x",
            "SUSE Linux Enterprise Micro 5.4:libxml2-2-2.9.14-150400.5.55.1.x86_64",
            "SUSE Linux Enterprise Micro 5.4:libxml2-tools-2.9.14-150400.5.55.1.aarch64",
            "SUSE Linux Enterprise Micro 5.4:libxml2-tools-2.9.14-150400.5.55.1.s390x",
            "SUSE Linux Enterprise Micro 5.4:libxml2-tools-2.9.14-150400.5.55.1.x86_64",
            "SUSE Linux Enterprise Micro 5.4:python3-libxml2-2.9.14-150400.5.55.1.aarch64",
            "SUSE Linux Enterprise Micro 5.4:python3-libxml2-2.9.14-150400.5.55.1.s390x",
            "SUSE Linux Enterprise Micro 5.4:python3-libxml2-2.9.14-150400.5.55.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-02-24T11:19:39Z",
          "details": "low"
        }
      ],
      "title": "CVE-2026-1757"
    }
  ]
}

CVE-2025-10911 (GCVE-0-2025-10911)

Vulnerability from cvelistv5 – Published: 2025-09-25 15:13 – Updated: 2025-11-20 20:00

Title

Libxslt: use-after-free with key data stored cross-rvt

Summary

A use-after-free vulnerability was found in libxslt while parsing xsl nodes that may lead to the dereference of expired pointers and application crash.

Severity ?

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CWE

CWE-825 - Expired Pointer Dereference

Assigner

redhat

References

URL

Tags

	https://access.redhat.com/security/cve/CVE-2025-10911	vdb-entryx_refsource_REDHAT
	https://bugzilla.redhat.com/show_bug.cgi?id=2397838	issue-trackingx_refsource_REDHAT
	https://gitlab.gnome.org/GNOME/libxslt/-/issues/144
	https://gitlab.gnome.org/GNOME/libxslt/-/merge_re…

Impacted products

Vendor

Product

Version

Affected: 0 , ≤ 1.1.43 (semver)

Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-10911",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-29T15:48:55.245495Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-29T15:49:06.055Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://gitlab.gnome.org/GNOME/libxslt",
          "defaultStatus": "unaffected",
          "packageName": "libxslt",
          "versions": [
            {
              "lessThanOrEqual": "1.1.43",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "affected",
          "packageName": "libxslt",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:6"
          ],
          "defaultStatus": "affected",
          "packageName": "libxslt",
          "product": "Red Hat Enterprise Linux 6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7"
          ],
          "defaultStatus": "affected",
          "packageName": "libxslt",
          "product": "Red Hat Enterprise Linux 7",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "affected",
          "packageName": "libxslt",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "affected",
          "packageName": "libxslt",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected",
          "packageName": "rhcos",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        }
      ],
      "datePublic": "2025-08-04T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A use-after-free vulnerability was found in libxslt while parsing xsl nodes that may lead to the dereference of expired pointers and application crash."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-825",
              "description": "Expired Pointer Dereference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-11-20T20:00:59.261Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2025-10911"
        },
        {
          "name": "RHBZ#2397838",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397838"
        },
        {
          "url": "https://gitlab.gnome.org/GNOME/libxslt/-/issues/144"
        },
        {
          "url": "https://gitlab.gnome.org/GNOME/libxslt/-/merge_requests/77"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2025-09-24T12:46:50.095Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2025-08-04T00:00:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Libxslt: use-after-free with key data stored cross-rvt",
      "x_redhatCweChain": "CWE-825: Expired Pointer Dereference"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2025-10911",
    "datePublished": "2025-09-25T15:13:14.210Z",
    "dateReserved": "2025-09-24T12:45:24.913Z",
    "dateUpdated": "2025-11-20T20:00:59.261Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-0989 (GCVE-0-2026-0989)

Vulnerability from cvelistv5 – Published: 2026-01-15 14:20 – Updated: 2026-01-15 16:39

Title

Libxml2: unbounded relaxng include recursion leading to stack overflow

Summary

A flaw was identified in the RelaxNG parser of libxml2 related to how external schema inclusions are handled. The parser does not enforce a limit on inclusion depth when resolving nested <include> directives. Specially crafted or overly complex schemas can cause excessive recursion during parsing. This may lead to stack exhaustion and application crashes, creating a denial-of-service risk.

Severity ?

3.7 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

CWE

CWE-674 - Uncontrolled Recursion

Assigner

redhat

References

URL

Tags

	https://access.redhat.com/security/cve/CVE-2026-0989	vdb-entryx_refsource_REDHAT
	https://bugzilla.redhat.com/show_bug.cgi?id=2429933	issue-trackingx_refsource_REDHAT

Impacted products

Vendor

Product

Version

Red Hat

Red Hat Enterprise Linux 10

cpe:/o:redhat:enterprise_linux:10

Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat JBoss Core Services	cpe:/a:redhat:jboss_core_services:1
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4

Credits

Red Hat would like to thank lanbigking for reporting this issue.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-0989",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-15T16:31:12.583434Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-15T16:39:34.311Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "affected",
          "packageName": "libxml2",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:6"
          ],
          "defaultStatus": "affected",
          "packageName": "libxml2",
          "product": "Red Hat Enterprise Linux 6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7"
          ],
          "defaultStatus": "affected",
          "packageName": "libxml2",
          "product": "Red Hat Enterprise Linux 7",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "affected",
          "packageName": "libxml2",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "affected",
          "packageName": "libxml2",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
          "cpes": [
            "cpe:/a:redhat:jboss_core_services:1"
          ],
          "defaultStatus": "affected",
          "packageName": "libxml2",
          "product": "Red Hat JBoss Core Services",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected",
          "packageName": "rhcos",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank lanbigking for reporting this issue."
        }
      ],
      "datePublic": "2026-01-15T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was identified in the RelaxNG parser of libxml2 related to how external schema inclusions are handled. The parser does not enforce a limit on inclusion depth when resolving nested \u003cinclude\u003e directives. Specially crafted or overly complex schemas can cause excessive recursion during parsing. This may lead to stack exhaustion and application crashes, creating a denial-of-service risk."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Low"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-674",
              "description": "Uncontrolled Recursion",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-15T14:20:23.274Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-0989"
        },
        {
          "name": "RHBZ#2429933",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2429933"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-01-15T12:36:12.129Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-01-15T00:00:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Libxml2: unbounded relaxng include recursion leading to stack overflow",
      "workarounds": [
        {
          "lang": "en",
          "value": "To mitigate this issue, restrict applications using libxml2 from processing untrusted RelaxNG schema files. Implement strict input validation and sanitization for all RelaxNG schema inputs to prevent the parsing of maliciously crafted, deeply nested include directives."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-674: Uncontrolled Recursion"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-0989",
    "datePublished": "2026-01-15T14:20:23.274Z",
    "dateReserved": "2026-01-15T12:38:51.419Z",
    "dateUpdated": "2026-01-15T16:39:34.311Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-0992 (GCVE-0-2026-0992)

Vulnerability from cvelistv5 – Published: 2026-01-15 14:20 – Updated: 2026-01-15 16:39

Title

Libxml2: libxml2: denial of service via crafted xml catalogs

Summary

A flaw was found in the libxml2 library. This uncontrolled resource consumption vulnerability occurs when processing XML catalogs that contain repeated <nextCatalog> elements pointing to the same downstream catalog. A remote attacker can exploit this by supplying crafted catalogs, causing the parser to redundantly traverse catalog chains. This leads to excessive CPU consumption and degrades application availability, resulting in a denial-of-service condition.

Severity ?

2.9 (Low)


                        
                          CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

CWE

CWE-400 - Uncontrolled Resource Consumption

Assigner

redhat

References

URL

Tags

	https://access.redhat.com/security/cve/CVE-2026-0992	vdb-entryx_refsource_REDHAT
	https://bugzilla.redhat.com/show_bug.cgi?id=2429975	issue-trackingx_refsource_REDHAT

Impacted products

Vendor

Product

Version

Red Hat

Red Hat Enterprise Linux 10

cpe:/o:redhat:enterprise_linux:10

Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat JBoss Core Services	cpe:/a:redhat:jboss_core_services:1
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4

Credits

Red Hat would like to thank Nick Wellnhofer for reporting this issue.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-0992",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-15T16:31:06.823175Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-15T16:39:47.982Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "affected",
          "packageName": "libxml2",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:6"
          ],
          "defaultStatus": "affected",
          "packageName": "libxml2",
          "product": "Red Hat Enterprise Linux 6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7"
          ],
          "defaultStatus": "affected",
          "packageName": "libxml2",
          "product": "Red Hat Enterprise Linux 7",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "affected",
          "packageName": "libxml2",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "affected",
          "packageName": "libxml2",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
          "cpes": [
            "cpe:/a:redhat:jboss_core_services:1"
          ],
          "defaultStatus": "affected",
          "packageName": "libxml2",
          "product": "Red Hat JBoss Core Services",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected",
          "packageName": "rhcos",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank Nick Wellnhofer for reporting this issue."
        }
      ],
      "datePublic": "2026-01-15T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in the libxml2 library. This uncontrolled resource consumption vulnerability occurs when processing XML catalogs that contain repeated \u003cnextCatalog\u003e elements pointing to the same downstream catalog. A remote attacker can exploit this by supplying crafted catalogs, causing the parser to redundantly traverse catalog chains. This leads to excessive CPU consumption and degrades application availability, resulting in a denial-of-service condition."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Low"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 2.9,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-15T14:20:24.934Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-0992"
        },
        {
          "name": "RHBZ#2429975",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2429975"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-01-15T13:29:32.742Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-01-15T00:00:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Libxml2: libxml2: denial of service via crafted xml catalogs",
      "workarounds": [
        {
          "lang": "en",
          "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-400: Uncontrolled Resource Consumption"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-0992",
    "datePublished": "2026-01-15T14:20:24.934Z",
    "dateReserved": "2026-01-15T13:34:08.872Z",
    "dateUpdated": "2026-01-15T16:39:47.982Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-1757 (GCVE-0-2026-1757)

Vulnerability from cvelistv5 – Published: 2026-02-02 12:38 – Updated: 2026-02-17 19:36

Title

Libxml2: memory leak leading to local denial of service in xmllint interactive shell

Summary

A flaw was identified in the interactive shell of the xmllint utility, part of the libxml2 project, where memory allocated for user input is not properly released under certain conditions. When a user submits input consisting only of whitespace, the program skips command execution but fails to free the allocated buffer. Repeating this action causes memory to continuously accumulate. Over time, this can exhaust system memory and terminate the xmllint process, creating a denial-of-service condition on the local system.

Severity ?

6.2 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-401 - Missing Release of Memory after Effective Lifetime

Assigner

redhat

References

URL

Tags

	https://access.redhat.com/security/cve/CVE-2026-1757	vdb-entryx_refsource_REDHAT
	https://bugzilla.redhat.com/show_bug.cgi?id=2435940	issue-trackingx_refsource_REDHAT

Impacted products

Vendor

Product

Version

Red Hat

Red Hat Enterprise Linux 10

cpe:/o:redhat:enterprise_linux:10

Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat Hardened Images	cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat JBoss Core Services	cpe:/a:redhat:jboss_core_services:1
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4

Credits

Red Hat would like to thank lanbigking for reporting this issue.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-1757",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-02T17:35:15.061136Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-02T17:35:36.990Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "affected",
          "packageName": "libxml2",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:6"
          ],
          "defaultStatus": "unknown",
          "packageName": "libxml2",
          "product": "Red Hat Enterprise Linux 6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7"
          ],
          "defaultStatus": "affected",
          "packageName": "libxml2",
          "product": "Red Hat Enterprise Linux 7",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "affected",
          "packageName": "libxml2",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "affected",
          "packageName": "libxml2",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:hummingbird:1"
          ],
          "defaultStatus": "affected",
          "packageName": "libxml2",
          "product": "Red Hat Hardened Images",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
          "cpes": [
            "cpe:/a:redhat:jboss_core_services:1"
          ],
          "defaultStatus": "affected",
          "packageName": "libxml2",
          "product": "Red Hat JBoss Core Services",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected",
          "packageName": "rhcos",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank lanbigking for reporting this issue."
        }
      ],
      "datePublic": "2026-02-02T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was identified in the interactive shell of the xmllint utility, part of the libxml2 project, where memory allocated for user input is not properly released under certain conditions. When a user submits input consisting only of whitespace, the program skips command execution but fails to free the allocated buffer. Repeating this action causes memory to continuously accumulate. Over time, this can exhaust system memory and terminate the xmllint process, creating a denial-of-service condition on the local system."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-401",
              "description": "Missing Release of Memory after Effective Lifetime",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-17T19:36:54.189Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-1757"
        },
        {
          "name": "RHBZ#2435940",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2435940"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-02-02T00:00:00.000Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-02-02T00:00:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Libxml2: memory leak leading to local denial of service in xmllint interactive shell",
      "workarounds": [
        {
          "lang": "en",
          "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-401: Missing Release of Memory after Effective Lifetime"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-1757",
    "datePublished": "2026-02-02T12:38:14.588Z",
    "dateReserved": "2026-02-02T11:43:42.248Z",
    "dateUpdated": "2026-02-17T19:36:54.189Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-0990 (GCVE-0-2026-0990)

Vulnerability from cvelistv5 – Published: 2026-01-15 14:20 – Updated: 2026-01-15 16:39

Title

Libxml2: libxml2: denial of service via uncontrolled recursion in xml catalog processing

Summary

A flaw was found in libxml2, an XML parsing library. This uncontrolled recursion vulnerability occurs in the xmlCatalogXMLResolveURI function when an XML catalog contains a delegate URI entry that references itself. A remote attacker could exploit this configuration-dependent issue by providing a specially crafted XML catalog, leading to infinite recursion and call stack exhaustion. This ultimately results in a segmentation fault, causing a Denial of Service (DoS) by crashing affected applications.

Severity ?

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-674 - Uncontrolled Recursion

Assigner

redhat

References

URL

Tags

	https://access.redhat.com/security/cve/CVE-2026-0990	vdb-entryx_refsource_REDHAT
	https://bugzilla.redhat.com/show_bug.cgi?id=2429959	issue-trackingx_refsource_REDHAT

Impacted products

Vendor

Product

Version

Red Hat

Red Hat Enterprise Linux 10

cpe:/o:redhat:enterprise_linux:10

Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat JBoss Core Services	cpe:/a:redhat:jboss_core_services:1
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4

Credits

Red Hat would like to thank Nick Wellnhofer for reporting this issue.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-0990",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-15T16:31:20.247968Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-15T16:39:20.891Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "affected",
          "packageName": "libxml2",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:6"
          ],
          "defaultStatus": "affected",
          "packageName": "libxml2",
          "product": "Red Hat Enterprise Linux 6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7"
          ],
          "defaultStatus": "affected",
          "packageName": "libxml2",
          "product": "Red Hat Enterprise Linux 7",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "affected",
          "packageName": "libxml2",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "affected",
          "packageName": "libxml2",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
          "cpes": [
            "cpe:/a:redhat:jboss_core_services:1"
          ],
          "defaultStatus": "affected",
          "packageName": "libxml2",
          "product": "Red Hat JBoss Core Services",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected",
          "packageName": "rhcos",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank Nick Wellnhofer for reporting this issue."
        }
      ],
      "datePublic": "2026-01-15T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in libxml2, an XML parsing library. This uncontrolled recursion vulnerability occurs in the xmlCatalogXMLResolveURI function when an XML catalog contains a delegate URI entry that references itself. A remote attacker could exploit this configuration-dependent issue by providing a specially crafted XML catalog, leading to infinite recursion and call stack exhaustion. This ultimately results in a segmentation fault, causing a Denial of Service (DoS) by crashing affected applications."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-674",
              "description": "Uncontrolled Recursion",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-15T14:20:06.515Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-0990"
        },
        {
          "name": "RHBZ#2429959",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2429959"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-01-15T13:15:23.187Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-01-15T00:00:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Libxml2: libxml2: denial of service via uncontrolled recursion in xml catalog processing",
      "workarounds": [
        {
          "lang": "en",
          "value": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-674: Uncontrolled Recursion"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-0990",
    "datePublished": "2026-01-15T14:20:06.515Z",
    "dateReserved": "2026-01-15T13:15:10.756Z",
    "dateUpdated": "2026-01-15T16:39:20.891Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

SUSE-SU-2026:0606-1

CVE-2025-10911 (GCVE-0-2025-10911)

CVE-2026-0989 (GCVE-0-2026-0989)

CVE-2026-0992 (GCVE-0-2026-0992)

CVE-2026-1757 (GCVE-0-2026-1757)

CVE-2026-0990 (GCVE-0-2026-0990)

Tags

Sightings

Nomenclature