CVE-2026-6732
Fixed in a distro release EPSS <1%CVSS 6.5
A flaw was found in libxml2. This vulnerability occurs when the library processes a specially crafted XML Schema Definition (XSD) validated document that includes an internal entity reference. An attacker could exploit this by providing a malicious document, leading to a type confusion error that causes the application to crash. This results in a denial of service (DoS), making the affected system or application unavailable.
Products: Red Hat Hardened Images, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat JBoss Core Services, Red Hat OpenShift Container Platform 4
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.21 | libxml2 | 2.13.9-r1 |
| Alpine 3.22 | libxml2 | 2.13.9-r1 |
| Alpine 3.23 | libxml2 | 2.13.9-r1 |
| Alpine 3.24 | libxml2 | 2.13.9-r2 |
| Debian 14 | libxml2 | 2.15.3+dfsg-1 |
| Red Hat hummingbird 1 | libxml2 | 0:2.15.3-0.1.hum1 |
| Red Hat hummingbird 1 | libxml2-16 | 0:2.15.3-0.1.hum1 |
| Red Hat hummingbird 1 | libxml2-devel | 0:2.15.3-0.1.hum1 |
| Red Hat hummingbird 1 | libxml2-static | 0:2.15.3-0.1.hum1 |
| Red Hat hummingbird 1 | python3-libxml2 | 0:2.15.3-0.1.hum1 |
| SUSE Linux Enterprise Server 16.0 | libxml2 | 2.13.8-160000.5.1 |
| SUSE Linux Enterprise Server 16.0 | libxml2-python | 2.13.8-160000.5.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | libxml2 | 2.13.8-160000.5.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | libxml2-python | 2.13.8-160000.5.1 |
| SUSE Linux Micro 6.2 | libxml2 | 2.13.8-160000.5.1 |
| SUSE Linux Micro 6.2 | libxml2-python | 2.13.8-160000.5.1 |
| Ubuntu 25.10 | libxml2 | 2.14.5+dfsg-0.2ubuntu0.2 |
| Ubuntu 26.04 LTS | libxml2 | 2.15.2+dfsg-0.1ubuntu0.1 |
| openSUSE Leap 16.0 | libxml2 | 2.13.8-160000.5.1 |
| openSUSE Leap 16.0 | libxml2-python | 2.13.8-160000.5.1 |