Log in Start free

Vulnerability · Published Sep 5, 2026 · Assigned by mitre

CVE-2026-86144

Medium 5.6

In plain English

A medium-severity security flaw in libxml2 from xmlsoft. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.6Medium
Exploit odds (30 days)0.2%top 91.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, the XML_PARSE_NONET flag, if (without it) a custom resource loader accesses the internet and triggers XML external entity injection, SSRF, or a denial of service (e.g., for an attacker-controlled internet resource that is intentionally slow).

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10libxml22.12.5-10.el10_2.4ALSA-2026:71586
AlmaLinux:8libxml22.9.7-21.el8_10.9ALSA-2026:71641
AlmaLinux:9libxml22.9.13-14.el9_8.5ALSA-2026:71585
AlmaLinux:10libxml2-devel2.12.5-10.el10_2.4ALSA-2026:71586
AlmaLinux:8libxml2-devel2.9.7-21.el8_10.9ALSA-2026:71641
AlmaLinux:9libxml2-devel2.9.13-14.el9_8.5ALSA-2026:71585
AlmaLinux:10libxml2-static2.12.5-10.el10_2.4ALSA-2026:71586
AlmaLinux:10python3-libxml22.12.5-10.el10_2.4ALSA-2026:71586
AlmaLinux:8python3-libxml22.9.7-21.el8_10.9ALSA-2026:71641
AlmaLinux:9python3-libxml22.9.13-14.el9_8.5ALSA-2026:71585
Debian:12libxml2no fix listedDEBIAN-CVE-2026-86144
Debian:13libxml2no fix listedDEBIAN-CVE-2026-86144
Debian:14libxml22.15.4+dfsg-1DEBIAN-CVE-2026-86144
Rocky Linux:10libxml20:2.12.5-10.el10_2.4RLSA-2026:71586
Rocky Linux:8libxml20:2.9.7-21.el8_10.9RLSA-2026:71641
Rocky Linux:9libxml20:2.9.13-14.el9_8.5RLSA-2026:71585
Ubuntu:22.04:LTSlibxml22.9.13+dfsg-1ubuntu0.14UBUNTU-CVE-2026-86144
Ubuntu:22.04:LTSlibxml22.9.13+dfsg-1ubuntu0.14USN-8910-1
Ubuntu:24.04:LTSlibxml22.9.14+dfsg-1.3ubuntu3.10USN-8910-1
Ubuntu:24.04:LTSlibxml22.9.14+dfsg-1.3ubuntu3.10UBUNTU-CVE-2026-86144
Ubuntu:26.04:LTSlibxml22.15.2+dfsg-0.1ubuntu0.3USN-8910-1
Ubuntu:26.04:LTSlibxml22.15.2+dfsg-0.1ubuntu0.3UBUNTU-CVE-2026-86144

Affected products (as reported)

VendorProductVersions
xmlsoft libxml2 0 – before 2.15.4

Weakness: CWE-669 · Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L

References