Skip to content
OpenAdvisories
High RHSA-2026:61247 2 CVEs

Red Hat Security Advisory: libxml2 security update

Published Aug 31, 2026 · Updated Oct 15, 2026

Ecosystem: Red Hat

Fixed packages 9

ReleasePackageFixed in
Red Hat · RHEL 9 enterprise_linux:9::appstream libxml2-debuginfo 0:2.9.13-14.el9_8.4
Red Hat · RHEL 9 enterprise_linux:9::appstream libxml2-debugsource 0:2.9.13-14.el9_8.4
Red Hat · RHEL 9 enterprise_linux:9::appstream libxml2-devel 0:2.9.13-14.el9_8.4
Red Hat · RHEL 9 enterprise_linux:9::appstream python3-libxml2-debuginfo 0:2.9.13-14.el9_8.4
Red Hat · RHEL 9 enterprise_linux:9::baseos libxml2 0:2.9.13-14.el9_8.4
Red Hat · RHEL 9 enterprise_linux:9::baseos libxml2-debuginfo 0:2.9.13-14.el9_8.4
Red Hat · RHEL 9 enterprise_linux:9::baseos libxml2-debugsource 0:2.9.13-14.el9_8.4
Red Hat · RHEL 9 enterprise_linux:9::baseos python3-libxml2 0:2.9.13-14.el9_8.4
Red Hat · RHEL 9 enterprise_linux:9::baseos python3-libxml2-debuginfo 0:2.9.13-14.el9_8.4

Vulnerabilities 2

  • High 7.0
    CVE-2026-6653

    libxml2: Use after free in xmlParseInternalSubset via improper entity resolution handling

    Use After Free in libxml2's xmlParseInternalSubset from GNOME libxml2 version 2.9.11 to 2.11.0 allows a remote attacker to cause a denial-of-service via maliciously crafted XML input with improper entity resolution handling.

    GNOME libxml2 libxml2 libxml2 Debian Ubuntu
  • Low 1.8
    CVE-2026-11979

    Stack-Based Buffer Overflow in libxml2

    libxml2 is vulnerable to multiple stack-based buffer overflows in the xmlcatalog utility when running in --shell mode. The usershell() function processes user input using fixed-size stack buffers without proper bounds checking. By supplying an overly long inp…

    xmlsoft libxml2 libxml2 libxml2 Debian Ubuntu

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2491354
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2494191
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_61247.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-6653
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-6653
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-6653
  • article
    https://bugs.launchpad.net/ubuntu/+source/libxml2/+bug/2141260
  • article
    https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1058
  • report
    https://access.redhat.com/security/cve/CVE-2026-11979
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-11979
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-11979
  • article
    https://cert.pl/en/posts/2026/06/CVE-2026-11979
  • article
    https://gitlab.gnome.org/GNOME/libxml2/-/commit/c2e233fc1b341685fc99621b2768b503f777a72e