AlmaLinux 8 : libxml2 (ALSA-2026:69655)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:69655 advisory. libxml2: mingw-libxml2: libxml2: Denial of Service via crafted XML input due to use-after-free CVE-2026-6653 Bug Fixes and Enhancements: libxml2: CVE-2025-9714 fi...

Moderate: Red Hat Security Advisory: libxml2 security, bug fix, and enhancement update

An update for libxml2 is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

libxml2: mingw-libxml2: libxml2: Denial of Service via crafted XML input due to use-after-free

A flaw was found in libxml2. A remote attacker can exploit a use-after-free vulnerability in the xmlParseInternalSubset function by providing maliciously crafted XML input. This improper handling of entity resolution can lead to a denial-of-service DoS, making the affected system or application...

RHEL 8 : libxml2 (RHSA-2026:69655)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:69655 advisory. The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fixes: libxml2: mingw-libxml2: libxml2:...

ALSA-2026:69655 Moderate: libxml2 security, bug fix, and enhancement update

The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fixes: libxml2: mingw-libxml2: libxml2: Denial of Service via crafted XML input due to use-after-free CVE-2026-6653 Bug Fixes and Enhancements: libxml2: CVE-2025-9714 fix AlmaLinux-119279...

Security Bulletin: IBM Tivoli Monitoring's libexpat library is affected by a security vulnerability.

Summary A vulnerable version of libexpat library which is included as part of IBM Tivoli Monitoring ITM have been remediated. Vulnerability Details CVEID:CVE-2026-41080 DESCRIPTION: libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document...

ROS-20260915-73-0041

The vulnerability of XML components in Google Chrome and Microsoft Edge browsers is related to data type conversion errors. Exploiting this vulnerability can allow an attacker to gain access to confidential data through a specially created XML file...

Astra Linux – Vulnerability in netcdf

A issue was discovered in libezxml.a in ezXML 0.8.6. The function ezxmlinternaldtd performs incorrect memory handling during the parsing of crafted XML files, resulting in a one-byte constant being written beyond the bounds of the memory area...

Astra Linux – Vulnerability in netcdf

A issue was discovered in libezxml.a in ezXML 0.8.6. The function ezxmldecode performs incorrect memory handling during the parsing of crafted XML files, resulting in a heap-based buffer overflow...

Astra Linux – Vulnerability in qt4-x11, qtbase-opensource-src

In Qt versions prior to 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2, there may be an application crash in QXmlStreamReader due to a crafted XML string, causing a situation where a prefix is greater than a certain length...

Astra Linux – Vulnerability in tinyxml

In TinyXML versions up to 2.6.2, there is an infinite loop in the TiXmlParsingData::Stamp method within tinyxmlparser.cpp, specifically due to the TIXMLUTFLEAD0 case. This issue can be triggered by a specially crafted XML message and leads to a denial of service...

Astra Linux – Vulnerability in libxslt

Type confusion in xsltNumberFormatGetMultipleLevel prior to libxslt 1.1.33 could allow attackers to potentially exploit heap corruption via crafted XML data...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: qt5-qtbase (UTSA-2023-002403)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-002403 advisory. In Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2, there can be an application crash in QXmlStreamReader via a crafted XML string that...

CVE-2026-18061

Improper restriction of XML external entity references in the RemoteQueryCachePlugin in AWS Advanced JDBC Wrapper 3.3.0 through 4.2.0 might allow an actor with write access to the shared cache infrastructure to disclose sensitive files from application hosts that read cached query results,...

CVE-2026-18061 Improper Restriction of XML External Entity References in AWS Advanced JDBC Wrapper RemoteQueryCachePlugin

Improper restriction of XML external entity references in the RemoteQueryCachePlugin in AWS Advanced JDBC Wrapper 3.3.0 through 4.2.0 might allow an actor with write access to the shared cache infrastructure to disclose sensitive files from application hosts that read cached query results,...

CVE-2026-18061 Improper Restriction of XML External Entity References in AWS Advanced JDBC Wrapper RemoteQueryCachePlugin

Improper restriction of XML external entity references in the RemoteQueryCachePlugin in AWS Advanced JDBC Wrapper 3.3.0 through 4.2.0 might allow an actor with write access to the shared cache infrastructure to disclose sensitive files from application hosts that read cached query results,...

encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue

A flaw was found in the encoding/xml package of Go. The DecodeElement function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service DoS for t...

encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue

A flaw was found in the encoding/xml package of Go. The DecodeElement function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service DoS for t...

CVE-2026-86137

A flaw was found in libxml2. This out-of-bounds read vulnerability, specifically within the xmlFAParsePosCharGroup function, could allow an attacker to cause a denial of service. By processing specially crafted XML input, the affected component may attempt to read data beyond its allocated memory...

libexpat: libexpat: Denial of Service via hash flooding attack with crafted XML

A flaw was found in libexpat. This vulnerability arises from the software misinterpreting a return code, leading to insufficient randomness entropy for hash functions. A remote attacker could exploit this by sending specially crafted XML content, triggering hash flooding attacks. This can result ...