CVE-2026-86144

In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, the XMLPARSENONET flag, if without it a custom resource loader accesses the internet and triggers XML external entity injection, SSRF, or ...

CVE-2026-86144

In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, the XMLPARSENONET flag, if without it a custom resource loader accesses the internet and triggers XML external entity injection, SSRF, or ...

CVE-2026-86144

In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, the XMLPARSENONET flag, if without it a custom resource loader accesses the internet and triggers XML external entity injection, SSRF, or ...

CVE-2026-86144

libxml2 versions before 2.15.4 contain a flaw in the XInclude processing functions xmlXIncludeProcess and xmlXIncludeProcessTree , which fail to propagate parser flags such as XML_PARSE_NONET . When a custom resource loader is used, this allows network access during XInclude expansion, potentiall...

CVE-2026-86144

In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, the XMLPARSENONET flag, if without it a custom resource loader accesses the internet and triggers XML external entity injection, SSRF, or ...

Linux Distros Unpatched Vulnerability : CVE-2026-86144

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, t...

CVE-2026-86144: Incorrect Resource Transfer Between Spheres

In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, the XMLPARSENONET flag, if without it a custom resource loader accesses the internet and triggers XML external entity injection, SSRF, or ...

PT-2026-86305

Name of the Vulnerable Software and Affected Versions libxml2 versions prior to 2.15.4 Description The xinclude component fails to propagate parseFlags within the xmlXIncludeProcess and xmlXIncludeProcessTree functions. This failure affects the XML PARSE NONET flag, which is intended to prevent...

Linux Distros Unpatched Vulnerability : CVE-2024-58378

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Nokogiri before 1.15.6 and 1.16.x before 1.16.2 CRuby, when using the packaged libxml2 is affected by a use-after-free vulnerability in libxml2 CVE-2024-25062 i...

Use After Free

Overview nokogiri is a gem for parsing HTML, XML, SAX, and Reader. Affected versions of this package are vulnerable to Use After Free in the xmlTextReader process when DTD validation and XInclude expansion are enabled. An attacker can execute arbitrary code or cause a denial of service by...

CVE-2024-58378

Rejected reason: This CVE ID has been rejected as a duplicate...

CVE-2024-58378

Rejected reason: This CVE ID has been rejected as a duplicate...

UBUNTU-CVE-2024-58378

Nokogiri before 1.15.6 and 1.16.x before 1.16.2 CRuby, when using the packaged libxml2 is affected by a use-after-free vulnerability in libxml2 CVE-2024-25062 in the xmlTextReader module, which underlies Nokogiri::XML::Reader. When using the XML Reader interface with DTD validation and XInclude...

CVE-2024-58378

...

EUVD-2024-55732

Nokogiri before 1.15.6 and 1.16.x before 1.16.2 CRuby, when using the packaged libxml2 is affected by a use-after-free vulnerability in libxml2 CVE-2024-25062 in the xmlTextReader module, which underlies Nokogiri::XML::Reader. When using the XML Reader interface with DTD validation and XInclude...

CVE-2024-58378

Removed by vendor...

CVE-2024-58378

...

CVE-2024-58378

CVE-2024-58378 was rejected by NVD as a duplicate, but connected advisories provide concrete details. Nokogiri before 1.15.6 and 1.16.x before 1.16.2 (CRuby using packaged libxml2 ) is vulnerable to a use-after-free in the xmlTextReader module (xmlValidatePopElement), underlying Nokogiri::XML::Re...

CVE-2024-58378 Nokogiri before 1.16.2 Use-After-Free via xmlTextReader

Nokogiri before 1.15.6 and 1.16.x before 1.16.2 CRuby, when using the packaged libxml2 is affected by a use-after-free vulnerability in libxml2 CVE-2024-25062 in the xmlTextReader module, which underlies Nokogiri::XML::Reader. When using the XML Reader interface with DTD validation and XInclude...

PYSEC-2026-1608 MaterialX Lack of MTLX Import Depth Limit Leads to DoS (Denial-Of-Service) Via Stack Exhaustion

Summary Nested imports of MaterialX files can lead to a crash via stack memory exhaustion, due to the lack of a limit on the "import chain" depth. Details The MaterialX specification supports importing other files by using XInclude tags. When parsing file imports, recursion is used to process...