RLSA-2026:98591: Important: librsvg2 security update
The librsvg2 packages provide a Scalable Vector Graphics (SVG) library based on the libart library.
Security Fix(es):
librsvg: Use-after-free when XML includes have duplicated entities (CVE-2026-96889,RUSTSEC-2026-0305)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/librsvg2-toolsto a version that resolves this vulnerability.Fixed in 0:2.57.1-9.el10_2.10 - Upgrade
Upgrade
rocky-linux/librsvg2-develto a version that resolves this vulnerability.Fixed in 0:2.57.1-9.el10_2.10 - Upgrade
Upgrade
rocky-linux/librsvg2-debugsourceto a version that resolves this vulnerability.Fixed in 0:2.57.1-9.el10_2.10 - Upgrade
Upgrade
rocky-linux/librsvg2-debuginfoto a version that resolves this vulnerability.Fixed in 0:2.57.1-9.el10_2.10 - Upgrade
Upgrade
rocky-linux/librsvg2to a version that resolves this vulnerability.Fixed in 0:2.57.1-9.el10_2.10 - Upgrade
Upgrade
rocky-linux/rsvg-pixbuf-loaderto a version that resolves this vulnerability.Fixed in 0:2.57.1-9.el10_2.10 - Upgrade
Upgrade
rocky-linux/rsvg-pixbuf-loader-debuginfoto a version that resolves this vulnerability.Fixed in 0:2.57.1-9.el10_2.10 - Upgrade
Upgrade
rocky-linux/librsvg2-tools-debuginfoto a version that resolves this vulnerability.Fixed in 0:2.57.1-9.el10_2.10
Event History
Frequently Asked Questions
Which Rocky Linux packages are covered by this update?
The update covers librsvg2, librsvg2-tools, librsvg2-devel, librsvg2-debugsource, librsvg2-debuginfo, rsvg-pixbuf-loader, and the related debuginfo packages listed in the advisory.
What condition triggers the vulnerability?
The issue is a use-after-free condition when XML includes contain duplicated entities.