Skip to content
OpenAdvisories
Medium ELSA-2026-69655 1 CVE

Moderate: libxml2 security, bug fix, and enhancement update (Oracle Linux 8)

Published Sep 23, 2026 · Updated Sep 23, 2026

Ecosystem: Oracle Linux

Summary

[2.9.7-21.8]
- Lower xpath recursion limits (RHEL-249282)

[2.9.7-21.8]
- Fix CVE-2026-6653 (RHEL-215616)

Fixed packages 3

ReleasePackageFixed in
Oracle Linux · 8 libxml2 0:2.9.7-21.el8_10.8
Oracle Linux · 8 libxml2-devel 0:2.9.7-21.el8_10.8
Oracle Linux · 8 python3-libxml2 0:2.9.7-21.el8_10.8

Vulnerabilities 1

  • High 7.0
    CVE-2026-6653

    libxml2: Use after free in xmlParseInternalSubset via improper entity resolution handling

    Use After Free in libxml2's xmlParseInternalSubset from GNOME libxml2 version 2.9.11 to 2.11.0 allows a remote attacker to cause a denial-of-service via maliciously crafted XML input with improper entity resolution handling.

    GNOME libxml2 libxml2 libxml2 Debian Ubuntu