Description
A flaw was identified in the interactive shell of the xmllint utility, part of the libxml2 project, where memory allocated for user input is not properly released under certain conditions. When a user submits input consisting only of whitespace, the program skips command execution but fails to free the allocated buffer. Repeating this action causes memory to continuously accumulate. Over time, this can exhaust system memory and terminate the xmllint process, creating a denial-of-service condition on the local system.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat Hardened Images | — | — |
| Red Hat | Red Hat Enterprise Linux 10 | — | — |
| Red Hat | Red Hat Enterprise Linux 6 | — | — |
| Red Hat | Red Hat Enterprise Linux 7 | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Red Hat JBoss Core Services | — | — |
| Red Hat | Red Hat OpenShift AI (RHOAI) | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libxml2 | 2.15.2+dfsg-0.1 | — |
| Debian 13 | libxml2 | 2.12.7+dfsg+really2.9.14-2.1+deb13u3 | — |
| Debian 12 | libxml2 | 2.9.14+dfsg-1.3~deb12u6 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | libxml2 | 2.15.2+dfsg-0.1ubuntu0.1 | USN-8460-1 |
| Ubuntu 25.10 | libxml2 | 2.14.5+dfsg-0.2ubuntu0.2 | USN-8460-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | libxml2 +4 | 2.15.2-0.3.hum1 | RHSA-2026:7519 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | libxml2 +1 | 2.12.10-150700.4.11.1 | SUSE-SU-2026:0605-1 |
| SLES 12 SP5 | libxml2 +1 | 2.9.4-46.99.1 | SUSE-SU-2026:0782-1 |
| SLES 3 | libxml2-python | 2.12.10-150700.4.11.1 | SUSE-SU-2026:0605-1 |
Show 9 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | libxml2 +1 | 2.13.8-160000.4.1 | SUSE-SU-2026:20631-1 |
| SLES for SAP 16.0 | libxslt | 1.1.43-160000.4.1 | SUSE-SU-2026:20631-1 |
| SLES 16.0 | libxml2 +1 | 2.13.8-160000.4.1 | SUSE-SU-2026:20631-1 |
| SLES 16.0 | libxslt | 1.1.43-160000.4.1 | SUSE-SU-2026:20631-1 |
| SLE Micro 6.2 | libxml2 +1 | 2.13.8-160000.4.1 | SUSE-SU-2026:20647-1 |
| SLE Micro 6.2 | libxslt | 1.1.43-160000.4.1 | SUSE-SU-2026:20647-1 |
| SLE Micro 6.1 | libxml2 +1 | 2.11.6-slfo.1.1_8.1 | SUSE-SU-2026:20657-1 |
| SLE Micro 6.1 | libxslt | 1.1.38-slfo.1.1_6.1 | SUSE-SU-2026:20657-1 |
| SLE Micro 6.0 | libxml2 +1 | 2.11.6-12.1 | SUSE-SU-2026:20707-1 |
| SLE Micro 6.0 | libxslt | 1.1.38-8.1 | SUSE-SU-2026:20707-1 |
| SLE Micro 5.5 | libxml2 +1 | 2.10.3-150500.5.38.1 | SUSE-SU-2026:0570-1 |
| SLE Micro 5.4 | libxml2 +1 | 2.9.14-150400.5.55.1 | SUSE-SU-2026:0606-1 |
| SLE Micro 5.3 | libxml2 +1 | 2.9.14-150400.5.55.1 | SUSE-SU-2026:0606-1 |
| SLE Micro 5.2 | libxml2 +1 | 2.9.7-150000.3.94.1 | SUSE-SU-2026:0568-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | libxml2 | 2.14.5-3.1 | openSUSE-SU-2026:10167-1 |
| openSUSE Leap 16.0 | libxml2 +1 | 2.13.8-160000.4.1 | openSUSE-SU-2026:20312-1 |
| openSUSE Leap 16.0 | libxslt | 1.1.43-160000.4.1 | openSUSE-SU-2026:20312-1 |
| openSUSE Leap 15.6 | libxml2 +1 | 2.10.3-150500.5.38.1 | SUSE-SU-2026:0570-1 |
| openSUSE Leap 15.6 | python-libxml2-python | 2.9.7-150000.3.94.1 | SUSE-SU-2026:0568-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | libxml2 +3 | 2.10.4-1.amzn2023.0.18 | ALAS2023-2026-1446 |
| Amazon Linux 2 | libxml2 +3 | 2.9.1-6.amzn2.5.24 | ALAS2-2026-3178 |
Advisories 16
- RHSA-2026:7519 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- USN-8460-1 libxml2 vulnerabilities Ubuntu Security Notices (USN) · Jun 23, 2026
- WID-SEC-2026-0284 libxml2 (xmllint): Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Jun 7, 2026
- openSUSE-SU-2026:10167-1 libxml2-16-2.14.5-3.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2026:20707-1 Security update for libxslt, libxml2 SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2026:20647-1 Security update for libxml2, libxslt SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2026:20657-1 Security update for libxslt, libxml2 SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2026:20631-1 Security update for libxml2, libxslt SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2026:0605-1 Security update for libxml2 SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2026:0606-1 Security update for libxml2 SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2026:0568-1 Security update for libxml2 SUSE / openSUSE Security Updates · Mar 23, 2026
- openSUSE-SU-2026:20312-1 Security update for libxml2, libxslt SUSE / openSUSE Security Updates · Mar 5, 2026
- ALAS2-2026-3178 Low: libxml2 security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Mar 5, 2026
- ALAS2023-2026-1446 Low: libxml2 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Mar 5, 2026
- SUSE-SU-2026:0782-1 Security update for libxml2 SUSE / openSUSE Security Updates · Mar 4, 2026
- SUSE-SU-2026:0570-1 Security update for libxml2 SUSE / openSUSE Security Updates · Feb 18, 2026
References
- RHSA-2026:7519 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-1757 vdb-entry
- RHBZ#2435940 issue-tracking
- https://gitlab.gnome.org/GNOME/libxml2/-/issues/1009