RLSA-2026:69655 Moderate: libxml2 security, bug fix, and enhancement update

The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fixes: libxml2: mingw-libxml2: libxml2: Denial of Service via crafted XML input due to use-after-free CVE-2026-6653 Bug Fixes and Enhancements: libxml2: CVE-2025-9714 fix Rocky Linux-11927...

MiracleLinux 8 : libxml2-2.9.7-21.el8_10.8 (AXSA:2026-1887:09)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1887:09 advisory. libxml2: mingw-libxml2: libxml2: Denial of Service via crafted XML input due to use-after-free CVE-2026-6653 Tenable has extracted the preceding description...

RockyLinux 8 : libxml2 (RLSA-2026:69655)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:69655 advisory. libxml2: mingw-libxml2: libxml2: Denial of Service via crafted XML input due to use-after-free CVE-2026-6653 Bug Fixes and Enhancements: libxml2: CVE-2025-9714 f...

AlmaLinux 8 : libxml2 (ALSA-2026:69655)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:69655 advisory. libxml2: mingw-libxml2: libxml2: Denial of Service via crafted XML input due to use-after-free CVE-2026-6653 Bug Fixes and Enhancements: libxml2: CVE-2025-9714 fi...

Moderate: Red Hat Security Advisory: libxml2 security, bug fix, and enhancement update

An update for libxml2 is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

RHEL 8 : libxml2 (RHSA-2026:69655)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:69655 advisory. The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fixes: libxml2: mingw-libxml2: libxml2:...

apr-util: Apache Portable Runtime Utility: Denial of Service via XML stack recursion attack

A flaw was found in Apache Portable Runtime Utility apr-util. A remote attacker could exploit a stack recursion vulnerability by providing specially crafted XML input to a library consumer that uses the aprxmlquoteelem function. This could lead to a denial of service DoS due to an application cra...

CVE-2026-86137

A flaw was found in libxml2. This out-of-bounds read vulnerability, specifically within the xmlFAParsePosCharGroup function, could allow an attacker to cause a denial of service. By processing specially crafted XML input, the affected component may attempt to read data beyond its allocated memory...

libxml2: libxml2: Denial of Service via out-of-bounds read in xmlFAParsePosCharGroup

A flaw was found in libxml2. This out-of-bounds read vulnerability, specifically within the xmlFAParsePosCharGroup function, could allow an attacker to cause a denial of service. By processing specially crafted XML input, the affected component may attempt to read data beyond its allocated memory...

CVE-2026-71979

A flaw was found in INDI indiserver. An unauthenticated remote attacker can exploit a stack buffer overflow vulnerability by sending specially crafted XML with oversized, mismatched tags. This can lead to an unbounded write operation, causing the daemon to crash and disrupting all active client a...

encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue

A flaw was found in the encoding/xml package of Go. The DecodeElement function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service DoS for t...

encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue

A flaw was found in the encoding/xml package of Go. The DecodeElement function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service DoS for t...

BIT-KEYCLOAK-2026-7307 Keycloak: keycloak: denial of service via specially crafted saml input

A flaw was found in Keycloak. A remote, unauthenticated attacker can send a specially crafted XML input to the Security Assertion Markup Language SAML endpoint. This malicious input can cause high CPU usage and worker thread starvation, leading to a Denial of Service DoS where the server becomes...

EulerOS Virtualization 2.13.1 : expat (EulerOS-SA-2026-3171)

According to the versions of the expat packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately...

apr-util: Apache Portable Runtime Utility: Denial of Service via XML stack recursion attack

A flaw was found in Apache Portable Runtime Utility apr-util. A remote attacker could exploit a stack recursion vulnerability by providing specially crafted XML input to a library consumer that uses the aprxmlquoteelem function. This could lead to a denial of service DoS due to an application cra...

USN-8652-1 libvirt vulnerabilities

It was discovered that libvirt incorrectly handled guest reboots in the libxl driver. An attacker in a guest could possibly use this issue to cause the libvirt daemon to crash, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS. CVE-2021-4147 Alexander Kuznetsov discovere...

JLSEC-2026-1223

In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input...

CVE-2026-18568

XML::Sig versions from 0.29 before 0.72 for Perl allow signature verification bypass because verify returns true when every signature was skipped before any cryptographic check. verify in lib/XML/Sig.pm counts the //dsig:Signature elements into $numsigs and iterates over them, but two paths reach...

XML External Entity (XXE) Injection

Overview Affected versions of this package are vulnerable to XML External Entity XXE Injection in the XmlDecoder file when XML input containing a DOCTYPE declaration is processed by an AsyncXMLInputFactory without security configuration, leaving DTD and entity handling enabled. An attacker can...

CentOS 9 : expat-2.5.0-7.el9

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the expat-2.5.0-7.el9 build changelog. - In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XM...