libxml2: libxml2: Denial of Service due to NULL pointer dereference in xmlRegNewParserCtxt

A NULL pointer dereference in libxml2's xmlRegNewParserCtxt function allows a local attacker to cause a denial of service DoS. The flaw occurs when strlen is called on an unverified pointer following a failed xmlStrdup memory allocation, resulting in a process crash...

libxml2: double-free/UAF in libxml2 Python bindings

A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition DTD with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callbac...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: libxml2: libxml2-16-2.15.4-0.1.hum1 aarch64, x8664 libxml2-2.15.4-0.1.hum1 aarch64, x8664 libxml2-devel-2.15.4-0.1.hum1 aarch64, x8664 libxml2-static-2.15.4-0.1.hum1 aarch64, x8664...

CVE-2026-86142

In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation...

AZL-99705 CVE-2026-86143 affecting package libxml2 2.11.5-10

In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks, aka a lack of a check for integer overflow before calling writecallback. This has security relevance for many types of uses of that length value within a...

CVE-2026-86141

xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup failure, i.e., it does not calculate a string length after NULL checking...

CVE-2026-86143

In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks, aka a lack of a check for integer overflow before calling writecallback. This has security relevance for many types of uses of that length value within a...

AZL-99708 CVE-2026-86141 affecting package libxml2 2.11.5-10

xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup failure, i.e., it does not calculate a string length after NULL checking...

AZL-99702 CVE-2026-86144 affecting package libxml2 2.11.5-10

In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, the XMLPARSENONET flag, if without it a custom resource loader accesses the internet and triggers XML external entity injection, SSRF, or ...

AZL-99720 CVE-2026-86142 affecting package libxml2 2.11.5-10

In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation...

CVE-2026-86144

In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, the XMLPARSENONET flag, if without it a custom resource loader accesses the internet and triggers XML external entity injection, SSRF, or ...

AZL-99711 CVE-2026-86138 affecting package libxml2 2.11.5-10

In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based buffer overflow...

CVE-2026-86139

In libxml2 before 2.15.4, xmlURIEscapeStr in uri.c has an integer overflow...

AZL-99714 CVE-2026-86139 affecting package libxml2 2.11.5-10

In libxml2 before 2.15.4, xmlURIEscapeStr in uri.c has an integer overflow...

CVE-2026-86140

In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-based buffer overflow...

CVE-2026-86138

In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based buffer overflow...

AZL-99717 CVE-2026-86140 affecting package libxml2 2.11.5-10

In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-based buffer overflow...

AZL-99723 CVE-2026-86137 affecting package libxml2 2.11.5-10

In libxml2 before 2.15.4, xmlFAParsePosCharGroup has an out-of-bounds read, aka an out-of-bounds read in the NXT macro in xmlregexp...

CVE-2026-86137

In libxml2 before 2.15.4, xmlFAParsePosCharGroup has an out-of-bounds read, aka an out-of-bounds read in the NXT macro in xmlregexp...

CVE-2026-86138

In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based buffer overflow...