libxml2 security update

2.12.5-10.4 - Fix CVE-2026-86144 RHEL-256302 - Fix CVE-2026-86140 RHEL-256024 - Fix CVE-2026-74860 RHEL-255957 - Fix CVE-2026-86142 RHEL-256368 - Fix CVE-2026-86143 RHEL-256896 - Fix CVE-2026-86138 RHEL-256948...

libxml2 security update

2.9.13-14.5 - Fix CVE-2026-86144 RHEL-256304 - Fix CVE-2026-86140 RHEL-256027 - Fix CVE-2026-74860 RHEL-256120 - Fix CVE-2026-86142 RHEL-256365 - Fix CVE-2026-86143 RHEL-256901 - Fix CVE-2026-86138 RHEL-256953...

DEBIAN-CVE-2026-86144

In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, the XMLPARSENONET flag, if without it a custom resource loader accesses the internet and triggers XML external entity injection, SSRF, or ...