Description
A flaw was found in libxml2. A local user or an attacker providing a specially crafted XML catalog can trigger a NULL pointer dereference during XML catalog parsing. This occurs when a `nextCatalog` element lacks its mandatory `catalog` attribute, leading to the application crashing and causing a Denial of Service (DoS).
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat Hardened Images | — | — |
| Red Hat | Red Hat Enterprise Linux 10 | — | — |
| Red Hat | Red Hat Enterprise Linux 6 | — | — |
| Red Hat | Red Hat Enterprise Linux 7 | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 5 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libxml2 | 2.15.4+dfsg-1 | — |
| Debian 13 | libxml2 | No fix yet | — |
| Debian 12 | libxml2 | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | libxml2 | 2.15.2+dfsg-0.1ubuntu0.3 | USN-8910-1 |
| Ubuntu 24.04 LTS | libxml2 | 2.9.14+dfsg-1.3ubuntu3.10 | USN-8910-1 |
| Ubuntu 22.04 LTS | libxml2 | 2.9.13+dfsg-1ubuntu0.14 | USN-8910-1 |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | libxml2 | 2.9.10+dfsg-5ubuntu0.20.04.10+esm6 | USN-8910-1 |
| Ubuntu Pro 18.04 LTS | libxml2 | 2.9.4+dfsg1-6.1ubuntu1.9+esm9 | USN-8910-1 |
| Ubuntu Pro 16.04 LTS | libxml2 | 2.9.3+dfsg1-1ubuntu0.7+esm14 | USN-8910-1 |
| Ubuntu Pro 14.04 LTS | libxml2 | 2.9.1+dfsg1-3ubuntu4.13+esm13 | USN-8910-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | libxml2 +4 | 2.15.3-0.1.3.hum1 | RHSA-2026:57604 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | libxml2 +3 | 2.10.4-1.amzn2023.0.22 | ALAS2023-2026-3341 |
| Amazon Linux 2 | libxml2 +3 | 2.9.1-6.amzn2.5.28 | ALAS2-2026-4059 |
Advisories 5
- RHSA-2026:57604 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- ALAS2023-2026-3341 Moderate: libxml2 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Nov 2, 2026
- ALAS2-2026-4059 Moderate: libxml2 security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Nov 2, 2026
- WID-SEC-2026-3445 libxml2: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Nov 1, 2026
- USN-8910-1 libxml2 vulnerabilities Ubuntu Security Notices (USN) · Oct 9, 2026