Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-0989: A flaw was identified in the RelaxNG parser of libxml2 related to how external schema inclusions are handled. The parser does not enforce a limit on inclusion depth when resolving nested <include> directives. Specially crafted or overly complex schemas can cause excessive recursion during parsing. This may lead to stack exhaustion and application crashes, creating a denial-of-service risk.
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | libxml2 | 0:2.10.4-1.amzn2023.0.17 |
| Amazon Linux · 2023 | libxml2-debuginfo | 0:2.10.4-1.amzn2023.0.17 |
| Amazon Linux · 2023 | libxml2-debugsource | 0:2.10.4-1.amzn2023.0.17 |
| Amazon Linux · 2023 | libxml2-devel | 0:2.10.4-1.amzn2023.0.17 |
| Amazon Linux · 2023 | libxml2-static | 0:2.10.4-1.amzn2023.0.17 |
| Amazon Linux · 2023 | python3-libxml2 | 0:2.10.4-1.amzn2023.0.17 |
| Amazon Linux · 2023 | python3-libxml2-debuginfo | 0:2.10.4-1.amzn2023.0.17 |
Vulnerabilities 1
-
Low 3.7
Libxml2: unbounded relaxng include recursion leading to stack overflow
A flaw was identified in the RelaxNG parser of libxml2 related to how external schema inclusions are handled. The parser does not enforce a limit on inclusion depth when resolving nested <include> directives. Specially crafted or overly complex schemas can ca…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-0989.html