Patchwire CVEs, their patch status, and feeds to follow them

CVE-2026-0989

Fixed in a distro release EPSS <1%CVSS 3.7

A flaw was identified in the RelaxNG parser of libxml2 related to how external schema inclusions are handled. The parser does not enforce a limit on inclusion depth when resolving nested <include> directives. Specially crafted or overly complex schemas can cause excessive recursion during parsing. This may lead to stack exhaustion and application crashes, creating a denial-of-service risk.

Published 2026-01-15 · CVE record · OSV

Products: Red Hat Hardened Images, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat JBoss Core Services, Red Hat OpenShift Container Platform 4

Distro releases

ReleasePackageFixed in
Amazon Linux 2libxml22.9.1-6.amzn2.5.23
Amazon Linux 2libxml2-devel2.9.1-6.amzn2.5.23
Amazon Linux 2libxml2-python2.9.1-6.amzn2.5.23
Amazon Linux 2libxml2-static2.9.1-6.amzn2.5.23
Amazon Linux 2023libxml22.10.4-1.amzn2023.0.17
Amazon Linux 2023libxml2-devel2.10.4-1.amzn2023.0.17
Amazon Linux 2023libxml2-static2.10.4-1.amzn2023.0.17
Amazon Linux 2023python3-libxml22.10.4-1.amzn2023.0.17
Debian 12libxml22.9.14+dfsg-1.3~deb12u6
Debian 13libxml22.12.7+dfsg+really2.9.14-2.1+deb13u3
Debian 14libxml22.15.2+dfsg-0.1
Red Hat hummingbird 1libxml20:2.15.2-0.3.hum1
Red Hat hummingbird 1libxml2-160:2.15.2-0.3.hum1
Red Hat hummingbird 1libxml2-devel0:2.15.2-0.3.hum1
Red Hat hummingbird 1libxml2-static0:2.15.2-0.3.hum1
Red Hat hummingbird 1python3-libxml20:2.15.2-0.3.hum1
SUSE Linux Enterprise Micro 5.2libxml22.9.7-150000.3.91.1
SUSE Linux Enterprise Micro 5.2python-libxml2-python2.9.7-150000.3.91.1
SUSE Linux Enterprise Micro 5.3libxml22.9.14-150400.5.55.1
SUSE Linux Enterprise Micro 5.3libxml2-python2.9.14-150400.5.55.1
SUSE Linux Enterprise Micro 5.4libxml22.9.14-150400.5.55.1
SUSE Linux Enterprise Micro 5.4libxml2-python2.9.14-150400.5.55.1
SUSE Linux Enterprise Micro 5.5libxml22.10.3-150500.5.35.1
SUSE Linux Enterprise Micro 5.5libxml2-python2.10.3-150500.5.35.1
SUSE Linux Enterprise Module for Basesystem 15 SP7libxml22.12.10-150700.4.11.1
SUSE Linux Enterprise Module for Basesystem 15 SP7libxml2-python2.12.10-150700.4.11.1
SUSE Linux Enterprise Module for Python 3 15 SP7libxml2-python2.12.10-150700.4.11.1
SUSE Linux Enterprise Server 16.0libxml22.13.8-160000.3.1
SUSE Linux Enterprise Server 16.0libxml2-python2.13.8-160000.3.1
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5libxml22.9.4-46.96.1
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5python-libxml22.9.4-46.96.1
SUSE Linux Enterprise Server for SAP applications 16.0libxml22.13.8-160000.3.1
SUSE Linux Enterprise Server for SAP applications 16.0libxml2-python2.13.8-160000.3.1
SUSE Linux Micro 6.0libxml22.11.6-12.1
SUSE Linux Micro 6.0libxml22.11.6-11.1
SUSE Linux Micro 6.0libxml2-python2.11.6-12.1
SUSE Linux Micro 6.0libxslt1.1.38-8.1
SUSE Linux Micro 6.1libxml22.11.6-slfo.1.1_8.1
SUSE Linux Micro 6.1libxml22.11.6-slfo.1.1_7.1
SUSE Linux Micro 6.1libxml2-python2.11.6-slfo.1.1_8.1
SUSE Linux Micro 6.1libxslt1.1.38-slfo.1.1_6.1
SUSE Linux Micro 6.2libxml22.13.8-160000.3.1
SUSE Linux Micro 6.2libxml2-python2.13.8-160000.3.1
Ubuntu 22.04 LTSlibxml22.9.13+dfsg-1ubuntu0.11
Ubuntu 24.04 LTSlibxml22.9.14+dfsg-1.3ubuntu3.7
Ubuntu 25.10libxml22.14.5+dfsg-0.2ubuntu0.1
Ubuntu Pro 14.04 LTSlibxml22.9.1+dfsg1-3ubuntu4.13+esm11
Ubuntu Pro 16.04 LTSlibxml22.9.3+dfsg1-1ubuntu0.7+esm12
Ubuntu Pro 18.04 LTSlibxml22.9.4+dfsg1-6.1ubuntu1.9+esm7
Ubuntu Pro 20.04 LTSlibxml22.9.10+dfsg-5ubuntu0.20.04.10+esm4
openSUSE Leap 15.6libxml22.10.3-150500.5.35.1
openSUSE Leap 15.6libxml2-python2.10.3-150500.5.35.1
openSUSE Leap 15.6python-libxml2-python2.9.7-150000.3.91.1
openSUSE Leap 16.0libxml22.13.8-160000.3.1
openSUSE Leap 16.0libxml2-python2.13.8-160000.3.1
openSUSE Tumbleweedlibxml22.14.5-2.1