Summary
It was discovered that libxml2 incorrectly handled maliciously crafted SGML
catalog files. An attacker could possibly use this issue to cause libxml2
to consume excessive resources, leading to a denial of service.
(CVE-2025-8732)
It was discovered that libxml2 incorrectly handled recursive include
directories with the RelaxNG parser. An attacker could possibly use this
issue to cause libxml2 to consume excessive resources, leading to a denial
of service. (CVE-2026-0989)
Nick Wellnhofer discovered that libxml2 incorrectly parsed catalogs with
self-referencing URI delegates. An attacker could possibly use this issue
to cause libxml2 to consume excessive resources, leading to a denial of
service. (CVE-2026-0990)
Nick Wellnhofer discovered that libxml2 inefficiently parsed catalogs
linked with repeating nextCatalog elements. An attacker could possibly use
this issue to cause libxml2 to use excessive resources, leading to a denial
of service. (CVE-2026-0992)
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | libxml2 | 2.9.13+dfsg-1ubuntu0.11 |
| Ubuntu · 24.04 LTS 24.04:LTS | libxml2 | 2.9.14+dfsg-1.3ubuntu3.7 |
| Ubuntu · 25.10 | libxml2 | 2.14.5+dfsg-0.2ubuntu0.1 |
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | libxml2 | 2.9.1+dfsg1-3ubuntu4.13+esm11 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | libxml2 | 2.9.3+dfsg1-1ubuntu0.7+esm12 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | libxml2 | 2.9.4+dfsg1-6.1ubuntu1.9+esm7 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | libxml2 | 2.9.10+dfsg-5ubuntu0.20.04.10+esm4 |