Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-0989: A flaw was identified in the RelaxNG parser of libxml2 related to how external schema inclusions are handled. The parser does not enforce a limit on inclusion depth when resolving nested <include> directives. Specially crafted or overly complex schemas can cause excessive recursion during parsing. This may lead to stack exhaustion and application crashes, creating a denial-of-service risk.
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | libxml2 | 0:2.9.1-6.amzn2.5.23 |
| Amazon Linux · 2 | libxml2-debuginfo | 0:2.9.1-6.amzn2.5.23 |
| Amazon Linux · 2 | libxml2-devel | 0:2.9.1-6.amzn2.5.23 |
| Amazon Linux · 2 | libxml2-python | 0:2.9.1-6.amzn2.5.23 |
| Amazon Linux · 2 | libxml2-static | 0:2.9.1-6.amzn2.5.23 |
Vulnerabilities 1
-
Low 3.7
Libxml2: unbounded relaxng include recursion leading to stack overflow
A flaw was identified in the RelaxNG parser of libxml2 related to how external schema inclusions are handled. The parser does not enforce a limit on inclusion depth when resolving nested <include> directives. Specially crafted or overly complex schemas can ca…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-0989.html