CVE-2026-86144: SSRF
In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, the XMLPARSENONET flag, if (without it) a custom resource loader accesses the internet and triggers XML external entity injection, SSRF, or a denial of service (e.g., for an attacker-controlled internet resource that is intentionally slow).
Affected Software
Event History
Frequently Asked Questions
Which applications are realistically exposed to this issue?
Applications using affected libxml2 versions and invoking xmlXIncludeProcess or xmlXIncludeProcessTree are exposed when they rely on parse flags such as XML_PARSE_NONET to constrain XInclude processing. The issue is especially relevant where a custom resource loader can access internet resources.
What does an attacker need to exploit it?
An attacker needs a path to cause XInclude processing of attacker-controlled XML or referenced resources. Exploitation can involve an attacker-controlled internet resource, including one designed to respond slowly and cause denial of service.
Are deployments protected by setting XML_PARSE_NONET?
Not for the affected XInclude processing functions: xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags before libxml2 2.15.4. As a result, a custom resource loader may still access the internet despite the intended XML_PARSE_NONET restriction.
What can be done if upgrading is not immediately possible?
Avoid processing untrusted XML through xmlXIncludeProcess or xmlXIncludeProcessTree, or prevent the custom resource loader from making internet requests. Restricting outbound network access also reduces exposure to SSRF and attacker-hosted slow resources.
How can teams determine whether they are affected?
Check whether the application uses libxml2 before 2.15.4 and calls xmlXIncludeProcess or xmlXIncludeProcessTree. Prioritize cases that set parse flags, particularly XML_PARSE_NONET, and use a custom resource loader capable of network access.