EUVD-2026-71823

In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, the XMLPARSENONET flag, if without it a custom resource loader accesses the internet and triggers XML external entity injection, SSRF, or ...

CVE-2026-86144

In libxml2 versions before 2.15.4 , the functions xmlXIncludeProcess and xmlXIncludeProcessTree in the xinclude module fail to propagate parseFlags (such as XML_PARSE_NONET) to subsequent XInclude processing. When an application uses a custom resource loader, this can allow network access even wh...