Skip to content
Fencer Intel
low 2.9

CVE-2026-0992 json

Libxml2: libxml2: denial of service via crafted xml catalogs

published 9mo ago modified 3d ago also EUVD-2026-2795 , JLSEC-2026-1239

cvss
2.9
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 40%
public exploits
0
none known

Summary

A flaw was found in the libxml2 library. This uncontrolled resource consumption vulnerability occurs when processing XML catalogs that contain repeated <nextCatalog> elements pointing to the same downstream catalog. A remote attacker can exploit this by supplying crafted catalogs, causing the parser to redundantly traverse catalog chains. This leads to excessive CPU consumption and degrades application availability, resulting in a denial-of-service condition.

Patch / fix

  • julia XML2_jll 2.15.3+0
  • Red Hat Red Hat Hardened Images 2.15.2-0.3.hum1
  • libxml2 Debian 12 2.9.14+dfsg-1.3~deb12u6
  • libxml2 Debian 13 2.12.7+dfsg+really2.9.14-2.1+deb13u3
  • libxml2 Debian 14 2.15.2+dfsg-0.1

debian advisories DEBIAN-CVE-2026-0992

  • libxml2 Ubuntu 22.04 LTS 2.9.13+dfsg-1ubuntu0.11
  • libxml2 Ubuntu 24.04 LTS 2.9.14+dfsg-1.3ubuntu3.7
  • libxml2 Ubuntu 25.10 2.14.5+dfsg-0.2ubuntu0.1
  • libxml2 Ubuntu Pro 14.04 LTS 2.9.1+dfsg1-3ubuntu4.13+esm11
  • libxml2 Ubuntu Pro 16.04 LTS 2.9.3+dfsg1-1ubuntu0.7+esm12
  • libxml2 Ubuntu Pro 18.04 LTS 2.9.4+dfsg1-6.1ubuntu1.9+esm7
  • libxml2 Ubuntu Pro 20.04 LTS 2.9.10+dfsg-5ubuntu0.20.04.10+esm4

ubuntu advisories UBUNTU-CVE-2026-0992

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • libxml2 hummingbird 1 2.15.2-0.3.hum1
  • libxml2-16 hummingbird 1 2.15.2-0.3.hum1
  • python3-libxml2 hummingbird 1 2.15.2-0.3.hum1

red hat advisories RHSA-2026:7519

  • libxml2 Linux Micro 6.0 2.11.6-12.1
  • libxslt Linux Micro 6.0 1.1.38-8.1
  • libxml2-python Linux Micro 6.0 2.11.6-12.1
  • libxml2 Linux Micro 6.1 2.11.6-slfo.1.1_8.1
  • libxslt Linux Micro 6.1 1.1.38-slfo.1.1_6.1
  • libxml2-python Linux Micro 6.1 2.11.6-slfo.1.1_8.1
  • libxslt SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 1.1.43-160000.4.1
  • libxml2 SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 2.13.8-160000.4.1

suse advisories SUSE-SU-2026:20707-1SUSE-SU-2026:20657-1SUSE-SU-2026:20631-1SUSE-SU-2026:20647-1SUSE-SU-2026:0782-1SUSE-SU-2026:0606-1

  • libxslt openSUSE Leap 16.0 1.1.43-160000.4.1
  • libxml2 openSUSE Leap 16.0 2.13.8-160000.4.1
  • libxml2-python openSUSE Leap 16.0 2.13.8-160000.4.1
  • libxml2 openSUSE Tumbleweed 2.14.5-4.1

opensuse advisories openSUSE-SU-2026:20312-1openSUSE-SU-2026:10213-1

  • libxml2 CBL-Mariner 2.0 2.10.4-10
  • libxml2 Azure Linux 3.0 2.11.5-9

azure linux advisories AZL-74778AZL-74783

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Is CVE-2026-0992 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-0992 updated cvss 2.9

libxml2: libxml2: Denial of Service via crafted XML catalogs

  • Red Hat Enterprise Linux 6 libxml2, libxml2-python Red Hat Enterprise Linux 7 libxml2, libxml2-python Red Hat Enterprise Linux 8 libxml2, python3-libxml2 Red Hat Enterprise Linux 9 libxml2, python3-libxml2 Red Hat Enterprise Linux 10 libxml2 Red Hat JBoss Core Services libxml2
    +1 more products
    Red Hat OpenShift Container Platform 4 openshift/ose-rhel-coreos-8, openshift/ose-rhel-coreos-9
    affected: workaround, no fix available “Fix deferred”
  • Red Hat OpenShift AI (RHOAI) rhoai/odh-core-bff-rhel9, rhoai/odh-dashboard-rhel9, rhoai/odh-mod-arch-maas-rhel9, rhoai/odh-mod-arch-automl-rhel9, rhoai/odh-mod-arch-gen-ai-rhel9, rhoai/odh-mod-arch-mlflow-rhel9, +6 more
    under investigation
  • Red Hat Hardened Images libxml2 2.15.2-0.3.hum1, libxml2-16 2.15.2-0.3.hum1, python3-libxml2 2.15.2-0.3.hum1
    fixed: vendor fix RHSA-2026:7519
  • Red Hat OpenShift AI (RHOAI) rhoai/odh-mlflow-rhel9, rhoai/odh-kube-rbac-proxy-rhel9, rhoai/odh-maas-controller-rhel9, rhoai/odh-mlflow-operator-rhel9, rhoai/odh-model-controller-rhel9, rhoai/odh-ogx-k8s-operator-rhel9, +14 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
9mo ago

Exploit prediction

0.46% chance of exploitation in the next 30 days, higher than 40% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • gitlab.gnome.org https://gitlab.gnome.org/GNOME/libxml2/-/issues/1019 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 2.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
OSV 3.1 2.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected packages

ecosystem package affected fixed in
julia XML2_jll
<2.15.3+0
2.15.3+0

Affected products

  • Red Hat Red Hat Hardened Images
  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 6
  • Red Hat Red Hat Enterprise Linux 7
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat JBoss Core Services
  • Red Hat Red Hat OpenShift AI (RHOAI)
  • Red Hat Red Hat OpenShift Container Platform 4

Classification

Weakness
  • CWE-400 Uncontrolled Resource Consumption

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.