Executive brief
A vulnerability has been identified in libxml2, a widely used library for processing XML data. The flaw allows an attacker to crash applications that use this library by providing a specially crafted XML file or catalog that triggers an infinite loop. This results in a denial-of-service (DoS) condition, potentially disrupting business operations and service availability.
Technical details
An uncontrolled recursion vulnerability exists in libxml2's xmlCatalogXMLResolveURI function. The issue is triggered when an XML catalog contains a delegate URI entry that references the catalog itself, leading to infinite recursion and stack exhaustion. An attacker can exploit this by providing a crafted XML catalog or using OASIS catalog processing instructions (enabled by default in versions prior to 2.14) to force the library to resolve a cyclic reference. This results in a segmentation fault and application crash. Red Hat has released updates for several products, including Red Hat Hardened Images (fixed in version 2.15.2-0.3.hum1).
Affected products
- GNOME libxml2
- Red Hat Red Hat Enterprise Linux 6
- Red Hat Red Hat Enterprise Linux 7
- Red Hat Red Hat Enterprise Linux 8
- Red Hat Red Hat Enterprise Linux 9
- Red Hat Red Hat Enterprise Linux 10
- Red Hat Red Hat Hardened Images < 2.15.2-0.3.hum1
- Red Hat Red Hat JBoss Core Services
- Red Hat Red Hat OpenShift Container Platform 4
Timeline
- 2026-01-15: disclosed: Vulnerability reported and published in NVD
- 2026-04-10: patched: Red Hat issued security advisory RHSA-2026:7519
References
- https://catalog.redhat.com/software/containers/
- https://access.redhat.com/downloads/content/package-browser/
- https://access.redhat.com/jbossnetwork/restricted/listSoftware.html
- https://access.redhat.com/errata/RHSA-2026:7519
- https://access.redhat.com/security/cve/CVE-2026-0990
- https://bugzilla.redhat.com/show_bug.cgi?id=2429959
- https://gitlab.gnome.org/GNOME/libxml2/-/issues/1018