CVE-2026-0990

Vulnerability: CVE-2026-0990 affects libxml2. An uncontrolled recursion bug in xmlCatalogXMLResolveURI is triggered when a delegate URI entry references itself, allowing a remote attacker to craft an XML catalog that causes infinite recursion and stack exhaustion, resulting in DoS via application...

CVE-2026-0989

CVE-2026-0989 concerns a flaw in the RelaxNG parser in libxml2 where external schema inclusions can cause unbounded recursion, leading to stack exhaustion and denial-of-service crashes. The connected documents confirm this issue across multiple distributions (e.g., Amazon Linux 2/ALAS advisories,...

CVE-2026-6732

CVE-2026-6732 affects libxml2 and is triggered when parsing an XSD-validated document that contains an internal entity reference, causing a type confusion error and a DoS via crashes. The vulnerability is tied to how libxml2 processes crafted XML Schema Definition inputs, with the impact describe...

CVE-2026-6653

CVE-2026-6653 affects GNOME libxml2, specifically the parser path libxml2’s xmlParseInternalSubset. The issue is a Use After Free in libxml2 versions 2.9.11 to 2.11.0, allowing a remote attacker to trigger a denial of service via carefully crafted XML input with improper entity resolution handlin...

CVE-2026-0992

CVE-2026-0992 in libxml2 describes an uncontrolled resource consumption vulnerability. A remote attacker can supply crafted XML catalogs containing repeated elements pointing to the same downstream catalog, causing the parser to redundantly traverse catalog chains. This leads to excessive CPU us...

CVE-2026-11979

CVE-2026-11979 affects libxml2 in the xmlcatalog utility when run in --shell mode. The usershell() function reads input into fixed-size stack buffers without proper bounds checking, allowing an overly long input line to overflow buffers (command, arg, argv) and cause stack memory corruption. Cons...