CVE-2026-0989

Name
CVE-2026-0989
Description
A flaw was identified in the RelaxNG parser of libxml2 related to how external schema inclusions are handled. The parser does not enforce a limit on inclusion depth when resolving nested <include> directives. Specially crafted or overly complex schemas can cause excessive recursion during parsing. This may lead to stack exhaustion and application crashes, creating a denial-of-service risk.
NVD Severity
unknown
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
vdb-entry https://access.redhat.com/security/cve/CVE-2026-0989
issue-tracking https://bugzilla.redhat.com/show_bug.cgi?id=2429933
secalert@redhat.com https://gitlab.gnome.org/GNOME/libxml2/-/issues/998
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:7519

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:* libxml2 >= None < 2.15.2

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
libxml2 edge-main 2.13.9-r2 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.13.9-r1 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.13.9-r0 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.13.8-r0 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.13.7-r1 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.13.7-r0 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.13.6-r0 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.13.4-r3 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.13.4-r2 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.13.4-r1 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.13.4-r0 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.12.8-r0 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.12.7-r0 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.12.6-r2 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.12.6-r0 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.12.5-r0 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.12.4-r0 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.12.3-r0 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.11.6-r0 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.11.5-r0 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.11.4-r0 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.11.3-r1 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.11.3-r0 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.11.2-r0 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.11.1-r0 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.11.0-r3 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.11.0-r2 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.11.0-r1 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.11.0-r0 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.10.4-r2 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.10.4-r1 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.10.4-r0 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.10.3-r2 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.10.3-r1 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.10.3-r0 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.10.2-r1 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.10.2-r0 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.10.1-r0 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.10.0-r0 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.9.14-r1 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.9.14-r0 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.9.13-r0 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.9.11-r0 None possibly vulnerable
libxml2 edge-main 2.9.10-r7 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.9.10-r5 None possibly vulnerable
libxml2 edge-main 2.9.10-r4 None possibly vulnerable
libxml2 edge-main 2.9.8-r3 None possibly vulnerable
libxml2 edge-main 2.9.8-r1 None possibly vulnerable
libxml2 edge-main 2.9.4-r4 None possibly vulnerable
libxml2 edge-main 2.9.4-r2 None possibly vulnerable
libxml2 edge-main 2.9.4-r1 None possibly vulnerable
libxml2 3.24-main 2.13.9-r2 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 3.23-main 2.13.9-r1 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 3.23-main 2.13.9-r0 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 3.22-main 2.13.9-r1 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 3.22-main 2.13.9-r0 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 3.22-main 2.13.8-r0 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 3.22-main 2.13.6-r0 None possibly vulnerable
libxml2 3.22-main 2.12.7-r0 None possibly vulnerable
libxml2 3.22-main 2.12.5-r0 None possibly vulnerable
libxml2 3.22-main 2.10.4-r0 None possibly vulnerable
libxml2 3.22-main 2.10.3-r0 None possibly vulnerable
libxml2 3.22-main 2.10.0-r0 None possibly vulnerable
libxml2 3.22-main 2.9.14-r0 None possibly vulnerable
libxml2 3.22-main 2.9.13-r0 None possibly vulnerable
libxml2 3.22-main 2.9.11-r0 None possibly vulnerable
libxml2 3.22-main 2.9.10-r5 None possibly vulnerable
libxml2 3.22-main 2.9.10-r4 None possibly vulnerable
libxml2 3.22-main 2.9.8-r3 None possibly vulnerable
libxml2 3.22-main 2.9.8-r1 None possibly vulnerable
libxml2 3.22-main 2.9.4-r4 None possibly vulnerable
libxml2 3.22-main 2.9.4-r2 None possibly vulnerable
libxml2 3.22-main 2.9.4-r1 None possibly vulnerable
libxml2 3.21-main 2.13.9-r1 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 3.21-main 2.13.9-r0 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 3.21-main 2.13.4-r6 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 3.21-main 2.13.4-r5 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 3.21-main 2.13.4-r4 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 3.21-main 2.13.4-r3 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 3.21-main 2.12.7-r0 None possibly vulnerable
libxml2 3.21-main 2.12.5-r0 None possibly vulnerable
libxml2 3.21-main 2.10.4-r0 None possibly vulnerable
libxml2 3.21-main 2.10.3-r0 None possibly vulnerable
libxml2 3.21-main 2.10.0-r0 None possibly vulnerable
libxml2 3.21-main 2.9.14-r0 None possibly vulnerable
libxml2 3.21-main 2.9.13-r0 None possibly vulnerable
libxml2 3.21-main 2.9.11-r0 None possibly vulnerable
libxml2 3.21-main 2.9.10-r5 None possibly vulnerable
libxml2 3.21-main 2.9.10-r4 None possibly vulnerable
libxml2 3.21-main 2.9.8-r3 None possibly vulnerable
libxml2 3.21-main 2.9.8-r1 None possibly vulnerable
libxml2 3.21-main 2.9.4-r4 None possibly vulnerable
libxml2 3.21-main 2.9.4-r2 None possibly vulnerable
libxml2 3.21-main 2.9.4-r1 None possibly vulnerable
libxml2 3.20-main 2.12.10-r0 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 3.20-main 2.12.7-r3 None possibly vulnerable
libxml2 3.20-main 2.12.7-r2 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 3.20-main 2.12.7-r1 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 3.20-main 2.12.7-r0 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 3.20-main 2.12.5-r0 None possibly vulnerable
libxml2 3.20-main 2.10.4-r0 None possibly vulnerable
libxml2 3.20-main 2.10.3-r0 None possibly vulnerable
libxml2 3.20-main 2.10.0-r0 None possibly vulnerable
libxml2 3.20-main 2.9.14-r0 None possibly vulnerable
libxml2 3.20-main 2.9.13-r0 None possibly vulnerable
libxml2 3.20-main 2.9.11-r0 None possibly vulnerable
libxml2 3.20-main 2.9.10-r5 None possibly vulnerable
libxml2 3.20-main 2.9.10-r4 None possibly vulnerable
libxml2 3.20-main 2.9.8-r3 None possibly vulnerable
libxml2 3.20-main 2.9.8-r1 None possibly vulnerable
libxml2 3.20-main 2.9.4-r4 None possibly vulnerable
libxml2 3.20-main 2.9.4-r2 None possibly vulnerable
libxml2 3.20-main 2.9.4-r1 None possibly vulnerable
libxml2 3.19-main 2.11.8-r3 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 3.19-main 2.11.8-r2 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 3.19-main 2.11.8-r1 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 3.19-main 2.11.8-r0 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 3.19-main 2.11.7-r0 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 3.19-main 2.11.6-r0 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 3.19-main 2.10.4-r0 None possibly vulnerable
libxml2 3.19-main 2.10.3-r0 None possibly vulnerable
libxml2 3.19-main 2.10.0-r0 None possibly vulnerable
libxml2 3.19-main 2.9.14-r0 None possibly vulnerable
libxml2 3.19-main 2.9.13-r0 None possibly vulnerable
libxml2 3.19-main 2.9.11-r0 None possibly vulnerable
libxml2 3.19-main 2.9.10-r5 None possibly vulnerable
libxml2 3.19-main 2.9.10-r4 None possibly vulnerable
libxml2 3.19-main 2.9.8-r3 None possibly vulnerable
libxml2 3.19-main 2.9.8-r1 None possibly vulnerable
libxml2 3.19-main 2.9.4-r4 None possibly vulnerable
libxml2 3.19-main 2.9.4-r2 None possibly vulnerable
libxml2 3.19-main 2.9.4-r1 None possibly vulnerable