Vulnerability · Published Jan 15, 2026 · Assigned by redhat
CVE-2026-0989Libxml2: unbounded relaxng include recursion leading to stack overflow
Low 3.7
In plain English
A low-severity security flaw in Red Hat Enterprise Linux 10 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A flaw was identified in the RelaxNG parser of libxml2 related to how external schema inclusions are handled. The parser does not enforce a limit on inclusion depth when resolving nested <include> directives. Specially crafted or overly complex schemas can cause excessive recursion during parsing. This may lead to stack exhaustion and application crashes, creating a denial-of-service risk.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | libxml2 | 2.9.14+dfsg-1.3~deb12u6 | DEBIAN-CVE-2026-0989 |
| Debian:13 | libxml2 | 2.12.7+dfsg+really2.9.14-2.1+deb13u3 | DEBIAN-CVE-2026-0989 |
| Debian:14 | libxml2 | 2.15.2+dfsg-0.1 | DEBIAN-CVE-2026-0989 |
| Ubuntu:22.04:LTS | libxml2 | 2.9.13+dfsg-1ubuntu0.11 | UBUNTU-CVE-2026-0989 |
| Ubuntu:24.04:LTS | libxml2 | 2.9.14+dfsg-1.3ubuntu3.7 | UBUNTU-CVE-2026-0989 |
| Ubuntu:25.10 | libxml2 | 2.14.5+dfsg-0.2ubuntu0.1 | UBUNTU-CVE-2026-0989 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Hardened Images | see references |
| Red Hat | Red Hat Enterprise Linux 10 | see references |
| Red Hat | Red Hat Enterprise Linux 6 | see references |
| Red Hat | Red Hat Enterprise Linux 7 | see references |
| Red Hat | Red Hat Enterprise Linux 8 | see references |
| Red Hat | Red Hat Enterprise Linux 9 | see references |
| Red Hat | Red Hat JBoss Core Services | see references |
| Red Hat | Red Hat OpenShift Container Platform 4 | see references |
| Red Hat | Red Hat OpenShift Container Platform 4 | see references |
Weakness: CWE-674 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
References
- RHSA-2026:7519 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2026-0989 vdb-entry, x_refsource_REDHAT
- RHBZ#2429933 issue-tracking, x_refsource_REDHAT
- https://gitlab.gnome.org/GNOME/libxml2/-/issues/998