Vulnerability · Published Jan 15, 2026 · Assigned by redhat
CVE-2026-0992Libxml2: libxml2: denial of service via crafted xml catalogs
Low 2.9
In plain English
A low-severity uncontrolled resource consumption in Red Hat Enterprise Linux 10 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A flaw was found in the libxml2 library. This uncontrolled resource consumption vulnerability occurs when processing XML catalogs that contain repeated <nextCatalog> elements pointing to the same downstream catalog. A remote attacker can exploit this by supplying crafted catalogs, causing the parser to redundantly traverse catalog chains. This leads to excessive CPU consumption and degrades application availability, resulting in a denial-of-service condition.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | libxml2 | 2.9.14+dfsg-1.3~deb12u6 | DEBIAN-CVE-2026-0992 |
| Debian:13 | libxml2 | 2.12.7+dfsg+really2.9.14-2.1+deb13u3 | DEBIAN-CVE-2026-0992 |
| Debian:14 | libxml2 | 2.15.2+dfsg-0.1 | DEBIAN-CVE-2026-0992 |
| Ubuntu:22.04:LTS | libxml2 | 2.9.13+dfsg-1ubuntu0.11 | UBUNTU-CVE-2026-0992 |
| Ubuntu:24.04:LTS | libxml2 | 2.9.14+dfsg-1.3ubuntu3.7 | UBUNTU-CVE-2026-0992 |
| Ubuntu:25.10 | libxml2 | 2.14.5+dfsg-0.2ubuntu0.1 | UBUNTU-CVE-2026-0992 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Hardened Images | see references |
| Red Hat | Red Hat Enterprise Linux 10 | see references |
| Red Hat | Red Hat Enterprise Linux 6 | see references |
| Red Hat | Red Hat Enterprise Linux 7 | see references |
| Red Hat | Red Hat Enterprise Linux 8 | see references |
| Red Hat | Red Hat Enterprise Linux 9 | see references |
| Red Hat | Red Hat JBoss Core Services | see references |
| Red Hat | Red Hat OpenShift Container Platform 4 | see references |
| Red Hat | Red Hat OpenShift Container Platform 4 | see references |
Weakness: CWE-400 · Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
References
- RHSA-2026:7519 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2026-0992 vdb-entry, x_refsource_REDHAT
- RHBZ#2429975 issue-tracking, x_refsource_REDHAT
- https://gitlab.gnome.org/GNOME/libxml2/-/issues/1019