CVE-2026-86144

In libxml2 versions before 2.15.4 , the functions xmlXIncludeProcess and xmlXIncludeProcessTree in the xinclude module fail to propagate parseFlags (such as XML_PARSE_NONET) to subsequent XInclude processing. When an application uses a custom resource loader, this can allow network access even wh...