Red Hat Security Advisory: libxml2 security, bug fix, and enhancement update

Fixed packages 18

Vulnerabilities 8

• High 8.5
  CVE-2026-74860

  Libxml2: double-free/uaf in libxml2 python bindings

  A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition (DTD) with enumerated attribute values. This triggers a double-fre…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 6 Linux Debian Ubuntu Azure Linux
  Sep 8, 2026
• High 8.0
  CVE-2026-86140

  In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-based buffer overflow.

  xmlsoft libxml2 libxml2 libxml2 Debian Ubuntu Azure Linux
  Sep 5, 2026
• High 7.0
  CVE-2026-6653

  libxml2: Use after free in xmlParseInternalSubset via improper entity resolution handling

  Use After Free in libxml2's xmlParseInternalSubset from GNOME libxml2 version 2.9.11 to 2.11.0 allows a remote attacker to cause a denial-of-service via maliciously crafted XML input with improper entity resolution handling.

  GNOME libxml2 libxml2 libxml2 Debian Ubuntu
  Jun 22, 2026
• Medium 6.9
  CVE-2026-86138

  In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based buffer overflow.

  xmlsoft libxml2 libxml2 libxml2 Debian Ubuntu Azure Linux
  Sep 5, 2026
• Medium 6.9
  CVE-2026-86142

  In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer …

  xmlsoft libxml2 libxml2 libxml2 Debian Ubuntu Azure Linux
  Sep 5, 2026
• Medium 6.9
  CVE-2026-86143

  In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to …

  xmlsoft libxml2 libxml2 libxml2 Debian Ubuntu Azure Linux
  Sep 5, 2026
• Medium 5.6
  CVE-2026-86144

  In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This h…

  xmlsoft libxml2 libxml2 libxml2 Debian Ubuntu Azure Linux
  Sep 5, 2026
• Low 1.8
  CVE-2026-11979

  Stack-Based Buffer Overflow in libxml2

  libxml2 is vulnerable to multiple stack-based buffer overflows in the xmlcatalog utility when running in --shell mode. The usershell() function processes user input using fixed-size stack buffers without proper bounds checking. By supplying an overly long inp…

  xmlsoft libxml2 libxml2 libxml2 Debian Ubuntu
  Jun 29, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2491354
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2494191
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2528986
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2528987
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2528989
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2528990
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2528992
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2529697
• article
  https://issues.redhat.com/browse/RHEL-277435
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_92589.json
• report
  https://access.redhat.com/security/cve/CVE-2026-6653
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-6653
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-6653
• article
  https://bugs.launchpad.net/ubuntu/+source/libxml2/+bug/2141260
• article
  https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1058
• report
  https://access.redhat.com/security/cve/CVE-2026-11979
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-11979
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-11979
• article
  https://cert.pl/en/posts/2026/06/CVE-2026-11979
• article
  https://gitlab.gnome.org/GNOME/libxml2/-/commit/c2e233fc1b341685fc99621b2768b503f777a72e
• report
  https://access.redhat.com/security/cve/CVE-2026-74860
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-74860
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-74860
• report
  https://access.redhat.com/security/cve/CVE-2026-86138
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-86138
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-86138
• article
  https://github.com/GNOME/libxml2/commit/a4cba4b5b5a8c42e155ed42d2d2a44955465a2e4
• article
  https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4
• report
  https://access.redhat.com/security/cve/CVE-2026-86140
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-86140
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-86140
• article
  https://github.com/GNOME/libxml2/commit/d1686f91dbda141a752200419d35639fd6b38340
• report
  https://access.redhat.com/security/cve/CVE-2026-86142
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-86142
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-86142
• article
  https://github.com/GNOME/libxml2/commit/6b3a736c0edc74ceec3d82f5252499d7911b3a58
• article
  https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1113
• report
  https://access.redhat.com/security/cve/CVE-2026-86143