Description
Use After Free in libxml2's xmlParseInternalSubset from GNOME libxml2 version 2.9.11 to 2.11.0 allows a remote attacker to cause a denial-of-service via maliciously crafted XML input with improper entity resolution handling.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| GNOME | libxml2 | 2.9.11 – < 2.11.0 | 2.11.0 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libxml2 | 2.14.5+dfsg-0.1 | — |
| Debian 13 | libxml2 | No fix yet | — |
| Debian 12 | libxml2 | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | libxml2 | 2.9.14+dfsg-1.3ubuntu3.8 | — |
| Ubuntu 22.04 LTS | libxml2 | 2.9.13+dfsg-1ubuntu0.12 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | libxml2 +2 | 2.9.13-14.el9_8.4 | RHSA-2026:61247 |
| RHEL 8 | libxml2 +2 | 2.9.7-21.el8_10.8 | RHSA-2026:69655 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | libxml2 +2 | 2.9.13-14.el9_8.4 | ALSA-2026:61247 |
| AlmaLinux 8 | libxml2 +2 | 2.9.7-21.el8_10.8 | ALSA-2026:69655 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 9 | libxml2 | 2.9.13-14.el9_8.4 | RLSA-2026:61247 |
| Rocky Linux 8 | libxml2 | 2.9.7-21.el8_10.8 | RLSA-2026:69655 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | libxml2 +3 | 2.10.4-1.amzn2023.0.19 | ALAS2023-2026-1911 |
| Amazon Linux 2 | libxml2 +3 | 2.9.1-6.amzn2.5.25 | ALAS2-2026-3785 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | libxml2 +2 | 2.9.7-21.el8_10.8 | ELSA-2026-69655 |
Advisories 15
- WID-SEC-2026-4090 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 11, 2026
- WID-SEC-2026-2037 libxml2: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Nov 11, 2026
- ALSA-2026:61247 Moderate: libxml2 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:69655 Moderate: libxml2 security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- NCSC-2026-0444 Kwetsbaarheden verholpen in Oracle Communications NCSC-NL (Netherlands) · Oct 21, 2026
- ICSA-26-293-05 Hitachi Energy RTU500 Product CISA ICS & IT advisories · Oct 20, 2026
- RHSA-2026:69655 Red Hat Security Advisory: libxml2 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2026:61247 Red Hat Security Advisory: libxml2 security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RLSA-2026:69655 Moderate: libxml2 security, bug fix, and enhancement update Rocky Linux Security Advisories · Sep 23, 2026
- ELSA-2026-69655 Moderate: libxml2 security, bug fix, and enhancement update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Sep 23, 2026
- WID-SEC-2026-3167 Hitachi Energy RTU500: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 2, 2026
- RLSA-2026:61247 Moderate: libxml2 security update Rocky Linux Security Advisories · Aug 31, 2026
- WID-SEC-2026-3038 Meinberg LANTIME: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 26, 2026
- ALAS2-2026-3785 Moderate: libxml2 security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Jul 7, 2026
- ALAS2023-2026-1911 Moderate: libxml2 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jul 7, 2026
References
- https://bugs.launchpad.net/ubuntu/+source/libxml2/+bug/2141260 issue-tracking
- https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1058 issue-tracking