RLSA-2026:98468: Important: libxml2 security update
The libxml2 library is a development toolbox providing the implementation of various XML standards.
Security Fix(es):
libxml2: mingw-libxml2: libxml2: Denial of Service via crafted XML input due to use-after-free (CVE-2026-6653)
libxml2: libxml2: Arbitrary code execution in xmlcatalog utility via buffer overflow (CVE-2026-11979)
libxml2: libxml2: Arbitrary code execution via heap-based buffer overflow (CVE-2026-86138)
libxml2: libxml2: Data integrity issues due to integer overflow in write callbacks (CVE-2026-86143)
libxml2: libxml2: Arbitrary code execution via stack-based buffer overflow in xmlSnprintfElements (CVE-2026-86140)
libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation (CVE-2026-86142)
libxml2: libxml2: Information disclosure, SSRF, or denial of service due to improper parseFlags propagation. (CVE-2026-86144)
libxml2: double-free/UAF in libxml2 Python bindings (CVE-2026-74860)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/libxml2to a version that resolves this vulnerability.Fixed in 0:2.9.13-18.el9_9.1 - Upgrade
Upgrade
rocky-linux/libxml2-debuginfoto a version that resolves this vulnerability.Fixed in 0:2.9.13-18.el9_9.1 - Upgrade
Upgrade
rocky-linux/libxml2-debugsourceto a version that resolves this vulnerability.Fixed in 0:2.9.13-18.el9_9.1 - Upgrade
Upgrade
rocky-linux/libxml2-develto a version that resolves this vulnerability.Fixed in 0:2.9.13-18.el9_9.1 - Upgrade
Upgrade
rocky-linux/python3-libxml2to a version that resolves this vulnerability.Fixed in 0:2.9.13-18.el9_9.1 - Upgrade
Upgrade
rocky-linux/python3-libxml2-debuginfoto a version that resolves this vulnerability.Fixed in 0:2.9.13-18.el9_9.1
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Which installed packages are covered by this update?
The update covers rocky-linux/libxml2, libxml2-debuginfo, libxml2-debugsource, libxml2-devel, python3-libxml2, and python3-libxml2-debuginfo.
What kinds of impact are addressed?
The listed issues include arbitrary code execution, denial of service, data-integrity problems, information disclosure, and SSRF. The underlying flaw classes include buffer overflows, integer overflow, use-after-free, and double-free conditions.
Does exploitation require an existing authenticated account?
The advisory’s vector lists PR:L, indicating that low-level privileges are required. It also lists UI:N, indicating no user interaction is required.
What inputs or components are specifically implicated?
The issues include crafted XML input, the xmlcatalog utility, xmlSnprintfElements, xmlXPtrEval, write callbacks, parseFlags handling, and the libxml2 Python bindings.