Description
A flaw was found in the interactive shell of the xmllint command-line tool, used for parsing XML files. When a user inputs an overly long command, the program does not check the input size properly, which can cause it to crash. This issue might allow attackers to run harmful code in rare configurations without modern protections.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | libxml2 | < 2.14.5 | 2.14.5 |
| Red Hat | Red Hat Enterprise Linux 10 | — | — |
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On | — | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On | — | — |
| Red Hat | Red Hat Enterprise Linux 8.8 Telecommunications Update Service | — | — |
| Red Hat | Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9.6 Extended Update Support | — | — |
| Red Hat | Cert Manager support for Red Hat OpenShift release 1.17 | — | — |
| Red Hat | Cert Manager support for Red Hat OpenShift release 1.18 | — | — |
| Red Hat | Cert Manager support for Red Hat OpenShift release 1.20 | — | — |
| Red Hat | Red Hat AI Inference Server 3.2 | — | — |
| Red Hat | Red Hat AI Inference Server 3.5 | — | — |
| Red Hat | Red Hat Discovery 2 | — | — |
| Red Hat | Red Hat Enterprise Linux AI 3.5 | — | — |
| Red Hat | Red Hat Hardened Images | — | — |
| Red Hat | Red Hat Insights proxy 1.5 | — | — |
| Red Hat | Red Hat OpenShift AI 3.0 | — | — |
| Red Hat | Red Hat OpenShift AI 3.2 | — | — |
| Red Hat | Red Hat OpenShift AI 3.3 | — | — |
| Red Hat | Red Hat OpenShift AI 3.4 | — | — |
| Red Hat | Red Hat OpenShift AI 3.5 | — | — |
| Red Hat | Red Hat Update Infrastructure 5 | — | — |
| Red Hat | Red Hat Enterprise Linux 6 | — | — |
| Red Hat | Red Hat Enterprise Linux 7 | — | — |
| Red Hat | Red Hat JBoss Core Services | — | — |
| Red Hat | Red Hat OpenShift AI (RHOAI) | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libxml2 | 2.12.7+dfsg+really2.9.14-2.1 | — |
| Debian 13 | libxml2 | 2.12.7+dfsg+really2.9.14-2.1 | — |
| Debian 12 | libxml2 | 2.9.14+dfsg-1.3~deb12u3 | — |
| Debian 11 | libxml2 | 2.9.10+dfsg-6.7+deb11u8 | DLA-4251-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | libxml2 | 2.9.14+dfsg-1.3ubuntu3.4 | USN-7694-1 |
| Ubuntu 22.04 LTS | libxml2 | 2.9.13+dfsg-1ubuntu0.8 | USN-7694-1 |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | libxml2 | 2.9.10+dfsg-5ubuntu0.20.04.10+esm1 | USN-7694-1 |
| Ubuntu Pro 18.04 LTS | libxml2 | 2.9.4+dfsg1-6.1ubuntu1.9+esm4 | USN-7694-1 |
| Ubuntu Pro 16.04 LTS | libxml2 | 2.9.3+dfsg1-1ubuntu0.7+esm9 | USN-7694-1 |
| Ubuntu Pro 14.04 LTS | libxml2 | 2.9.1+dfsg1-3ubuntu4.13+esm8 | USN-7694-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | libxml2 +3 | 2.12.5-10.el10_2.2 | RHSA-2026:39304 |
| RHEL 9 | libxml2 +2 | 2.9.13-14.el9_8.2 | RHSA-2026:39317 |
| RHEL 8 | libxml2 +2 | 2.9.7-21.el8_10.6 | RHSA-2026:36734 |
Show 9 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10.0 EUS | libxml2 +3 | 2.12.5-9.el10_0.2 | RHSA-2026:70596 |
| RHEL 9.6 EUS | libxml2 +2 | 2.9.13-12.el9_6.3 | RHSA-2026:70639 |
| RHEL 9.4 E4S | libxml2 +2 | 2.9.13-13.el9_4.2 | RHSA-2026:79121 |
| RHEL 9.2 E4S | libxml2 +2 | 2.9.13-3.el9_2.12 | RHSA-2026:79118 |
| RHEL 8.8 TUS | libxml2 +2 | 2.9.7-16.el8_8.15 | RHSA-2026:79119 |
| RHEL 8.8 E4S | libxml2 +2 | 2.9.7-16.el8_8.15 | RHSA-2026:79119 |
| RHEL 8.6 EUS Long Life | libxml2 +2 | 2.9.7-13.el8_6.15 | RHSA-2026:79120 |
| RHEL 8.6 AUS | libxml2 +2 | 2.9.7-13.el8_6.15 | RHSA-2026:79120 |
| Red Hat Hardened Images 1 | libxml2 +4 | 2.15.2-0.3.hum1 | RHSA-2026:7519 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | libxml2 +3 | 2.12.5-10.el10_2.2 | ALSA-2026:39304 |
| AlmaLinux 9 | libxml2 +2 | 2.9.13-14.el9_8.2 | ALSA-2026:39317 |
| AlmaLinux 8 | libxml2 +2 | 2.9.7-21.el8_10.6 | ALSA-2026:36734 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | libxml2 | 2.12.5-10.el10_2.2 | RLSA-2026:39304 |
| Rocky Linux 9 | libxml2 | 2.9.13-14.el9_8.2 | RLSA-2026:39317 |
| Rocky Linux 8 | libxml2 | 2.9.7-21.el8_10.6 | RLSA-2026:36734 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | libxml2 +1 | 2.12.10-150700.4.3.1 | SUSE-SU-2025:02260-1 |
| SLES 15 SP6 | libxml2 +1 | 2.10.3-150500.5.29.1 | SUSE-SU-2025:02314-1 |
| SLES 15 SP5 | libxml2 +1 | 2.10.3-150500.5.29.1 | SUSE-SU-2025:02314-1 |
| SLES 15 SP4 | libxml2 +1 | 2.9.14-150400.5.44.1 | SUSE-SU-2025:02355-1 |
| SLES 15 SP3 | libxml2 +1 | 2.9.7-150000.3.82.1 | SUSE-SU-2025:02275-1 |
Show 18 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP5 | libxml2 +1 | 2.9.4-46.87.1 | SUSE-SU-2025:02294-1 |
| SLES 3 | libxml2-python | 2.10.3-150500.5.29.1 | SUSE-SU-2025:02314-1, SUSE-SU-2025:02260-1 |
| SLES for SAP 15 SP5 | libxml2 +1 | 2.10.3-150500.5.29.1 | SUSE-SU-2025:02314-1 |
| SLES for SAP 15 SP4 | libxml2 +1 | 2.9.14-150400.5.44.1 | SUSE-SU-2025:02355-1 |
| SLES for SAP 15 SP3 | libxml2 +1 | 2.9.7-150000.3.82.1 | SUSE-SU-2025:02275-1 |
| SLE Micro 6.1 | libxml2 | 2.11.6-slfo.1.1_6.1 | SUSE-SU-2025:20607-1 |
| SLE Micro 6.0 | libxml2 | 2.11.6-10.1 | SUSE-SU-2025:20564-1 |
| SLE Micro 5.5 | libxml2 +1 | 2.10.3-150500.5.29.1 | SUSE-SU-2025:02314-1 |
| SLE Micro 5.4 | libxml2 +1 | 2.9.14-150400.5.44.1 | SUSE-SU-2025:02355-1 |
| SLE Micro 5.3 | libxml2 +1 | 2.9.14-150400.5.44.1 | SUSE-SU-2025:02355-1 |
| SLE Micro 5.2 | libxml2 +1 | 2.9.7-150000.3.82.1 | SUSE-SU-2025:02275-1 |
| SLE Micro 5.1 | libxml2 | 2.9.7-150000.3.82.1 | SUSE-SU-2025:02275-1 |
| SLE HPC 15 SP5 | libxml2 +1 | 2.10.3-150500.5.29.1 | SUSE-SU-2025:02314-1 |
| SLE HPC 15 SP4 | libxml2 +1 | 2.9.14-150400.5.44.1 | SUSE-SU-2025:02355-1 |
| SLE HPC 15 SP3 | libxml2 +1 | 2.9.7-150000.3.82.1 | SUSE-SU-2025:02275-1 |
| SUSE Manager Server 4.3 | libxml2 +1 | 2.9.14-150400.5.44.1 | SUSE-SU-2025:02355-1 |
| SUSE Manager Proxy 4.3 | libxml2 +1 | 2.9.14-150400.5.44.1 | SUSE-SU-2025:02355-1 |
| SUSE Enterprise Storage 7.1 | libxml2 +1 | 2.9.7-150000.3.82.1 | SUSE-SU-2025:02275-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | libxml2 | 2.13.8-2.1 | openSUSE-SU-2025:15321-1 |
| openSUSE Leap 15.6 | libxml2 +1 | 2.10.3-150500.5.29.1 | SUSE-SU-2025:02314-1 |
| openSUSE Leap 15.6 | python-libxml2-python | 2.9.7-150000.3.82.1 | SUSE-SU-2025:02275-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | libxml2 | 2.13.9-r0 | — |
| Alpine v3.23 | libxml2 | 2.13.9-r0 | — |
| Alpine v3.22 | libxml2 | 2.13.9-r0 | — |
| Alpine v3.21 | libxml2 | 2.13.9-r0 | — |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | libxml2 | 2.11.5-6 | — |
| Azure Linux 2 (CBL-Mariner) | libxml2 | 2.10.4-8 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | libxml2 +3 | 2.12.5-10.el10_2.2 | ELSA-2026-39304 |
| Oracle Linux 9 | libxml2 +2 | 2.9.13-14.el9_8.2 | ELSA-2026-39317 |
| Oracle Linux 8 | libxml2 +2 | 2.9.7-21.el8_10.6 | ELSA-2026-36734 |
Advisories 36
- WID-SEC-2026-2189 Dell PowerProtect Data Domain: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 2, 2026
- WID-SEC-2025-1325 libxml2: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Oct 29, 2026
- ALSA-2026:39317 Low: libxml2 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:39304 Low: libxml2 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:36734 Low: libxml2 security update AlmaLinux Security Advisories · Oct 29, 2026
- WID-SEC-2026-2919 IBM App Connect Enterprise: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 27, 2026
- RHSA-2026:79120 Red Hat Security Advisory: libxml2 security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2026:79121 Red Hat Security Advisory: libxml2 security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2026:79119 Red Hat Security Advisory: libxml2 security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2026:79118 Red Hat Security Advisory: libxml2 security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2026:7519 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2026:70639 Red Hat Security Advisory: libxml2 security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2026:70596 Red Hat Security Advisory: libxml2 security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2026:39317 Red Hat Security Advisory: libxml2 security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2026:39304 Red Hat Security Advisory: libxml2 security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2026:36734 Red Hat Security Advisory: libxml2 security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- WID-SEC-2026-3043 IBM QRadar SIEM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 17, 2026
- WID-SEC-2026-1118 Dell PowerProtect Data Domain OS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 5, 2026
- ELSA-2026-39304 Low: libxml2 security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Jul 16, 2026
- RLSA-2026:39317 Low: libxml2 security update Rocky Linux Security Advisories · Jul 15, 2026
- RLSA-2026:39304 Low: libxml2 security update Rocky Linux Security Advisories · Jul 15, 2026
- ELSA-2026-39317 Low: libxml2 security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Jul 14, 2026
- RLSA-2026:36734 Low: libxml2 security update Rocky Linux Security Advisories · Jul 9, 2026
- ELSA-2026-36734 Low: libxml2 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Jul 8, 2026
- ICSA-26-188-05 Siemens SINEC OS CISA ICS & IT advisories · Jul 7, 2026
- USN-7694-1 libxml2 vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
- SSA-253495 SSA-253495: Multiple Vulnerabilities in SINEC OS before V4.0 Siemens ProductCERT · Jun 2, 2026
- openSUSE-SU-2025:15321-1 libxml2-2-2.13.8-2.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:02275-1 Security update for libxml2 SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:20607-1 Security update for libxml2 SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:02314-1 Security update for libxml2 SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:20564-1 Security update for libxml2 SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:02355-1 Security update for libxml2 SUSE / openSUSE Security Updates · Mar 23, 2026
- DLA-4251-1 libxml2 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2025:02260-1 Security update for libxml2 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:02294-1 Security update for libxml2 SUSE / openSUSE Security Updates · Feb 4, 2026
References
- RHSA-2026:36734 vendor-advisory
- RHSA-2026:39304 vendor-advisory
- RHSA-2026:39317 vendor-advisory
- RHSA-2026:44481 vendor-advisory
- RHSA-2026:46836 vendor-advisory
- RHSA-2026:53371 vendor-advisory
- RHSA-2026:58981 vendor-advisory
- RHSA-2026:70596 vendor-advisory
- RHSA-2026:70639 vendor-advisory
- RHSA-2026:72394 vendor-advisory
- RHSA-2026:72395 vendor-advisory
- RHSA-2026:72399 vendor-advisory
- RHSA-2026:72470 vendor-advisory
- RHSA-2026:72475 vendor-advisory
- RHSA-2026:72476 vendor-advisory
- RHSA-2026:72502 vendor-advisory
- RHSA-2026:73859 vendor-advisory
- RHSA-2026:73909 vendor-advisory
- RHSA-2026:73929 vendor-advisory
- RHSA-2026:73930 vendor-advisory
- RHSA-2026:73959 vendor-advisory
- RHSA-2026:73960 vendor-advisory
- RHSA-2026:73961 vendor-advisory
- RHSA-2026:73962 vendor-advisory
- RHSA-2026:74359 vendor-advisory
- RHSA-2026:74360 vendor-advisory
- RHSA-2026:74361 vendor-advisory
- RHSA-2026:74362 vendor-advisory
- RHSA-2026:74363 vendor-advisory
- RHSA-2026:74364 vendor-advisory
- RHSA-2026:74365 vendor-advisory
- RHSA-2026:74450 vendor-advisory
- RHSA-2026:74458 vendor-advisory
- RHSA-2026:74459 vendor-advisory
- RHSA-2026:74460 vendor-advisory
- RHSA-2026:74461 vendor-advisory
- RHSA-2026:74462 vendor-advisory
- RHSA-2026:74463 vendor-advisory
- RHSA-2026:74674 vendor-advisory
- RHSA-2026:74677 vendor-advisory
- RHSA-2026:74678 vendor-advisory
- RHSA-2026:74679 vendor-advisory
- RHSA-2026:74681 vendor-advisory
- RHSA-2026:74683 vendor-advisory
- RHSA-2026:74685 vendor-advisory
- RHSA-2026:74687 vendor-advisory
- RHSA-2026:74688 vendor-advisory
- RHSA-2026:74771 vendor-advisory
- RHSA-2026:7519 vendor-advisory
- RHSA-2026:75652 vendor-advisory
- RHSA-2026:75654 vendor-advisory
- RHSA-2026:75655 vendor-advisory
- RHSA-2026:75657 vendor-advisory
- RHSA-2026:75658 vendor-advisory
- RHSA-2026:75659 vendor-advisory
- RHSA-2026:75660 vendor-advisory
- RHSA-2026:76042 vendor-advisory
- RHSA-2026:79118 vendor-advisory
- RHSA-2026:79119 vendor-advisory
- RHSA-2026:79120 vendor-advisory