CVE-2026-6732

Name
CVE-2026-6732
Description
A flaw was found in libxml2. This vulnerability occurs when the library processes a specially crafted XML Schema Definition (XSD) validated document that includes an internal entity reference. An attacker could exploit this by providing a malicious document, leading to a type confusion error that causes the application to crash. This results in a denial of service (DoS), making the affected system or application unavailable.
NVD Severity
unknown
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
secalert@redhat.com https://access.redhat.com/security/cve/CVE-2026-6732
secalert@redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=2461300
secalert@redhat.com https://gitlab.gnome.org/GNOME/libxml2/-/issues/1097
secalert@redhat.com https://gitlab.gnome.org/GNOME/libxml2/-/merge_requests/411
secalert@redhat.com https://access.redhat.com/errata/RHSA-2026:11503

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:redhat:hardened_images:-:*:*:*:*:*:*:* hardened_images == None == -
cpe:2.3:a:redhat:jboss_core_services:-:*:*:*:*:*:*:* jboss_core_services == None == -
cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:* openshift_container_platform == None == 4.0
cpe:2.3:a:xmlsoft:libxml2:-:*:*:*:*:*:*:* libxml2 == None == -
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* enterprise_linux == None == 6.0
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* enterprise_linux == None == 7.0
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* enterprise_linux == None == 8.0
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* enterprise_linux == None == 9.0
cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:* enterprise_linux == None == 10.0
cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:* libxml2 >= 2.13.0 < 2.15.3

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
qt6-qtwebengine edge-community 6.11.0-r9 Bart Ribbers <bribbers@disroot.org> fixed
qt6-qtwebengine 3.23-community 6.10.3-r3 Bart Ribbers <bribbers@disroot.org> fixed
libxml2 edge-main 2.13.9-r2 Carlo Landmeter <clandmeter@alpinelinux.org> fixed
libxml2 edge-main 2.13.9-r1 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.13.9-r0 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.13.8-r0 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.13.7-r1 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.13.7-r0 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.13.6-r0 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.13.4-r3 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.13.4-r2 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.13.4-r1 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.13.4-r0 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 3.24-main 2.13.9-r2 Carlo Landmeter <clandmeter@alpinelinux.org> fixed
libxml2 3.23-main 2.13.9-r1 Carlo Landmeter <clandmeter@alpinelinux.org> fixed
libxml2 3.23-main 2.13.9-r0 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 3.22-main 2.13.9-r1 Carlo Landmeter <clandmeter@alpinelinux.org> fixed
libxml2 3.22-main 2.13.9-r0 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 3.22-main 2.13.8-r0 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 3.22-main 2.13.6-r0 None possibly vulnerable
libxml2 3.21-main 2.13.9-r1 Carlo Landmeter <clandmeter@alpinelinux.org> fixed
libxml2 3.21-main 2.13.9-r0 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 3.21-main 2.13.4-r6 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 3.21-main 2.13.4-r5 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 3.21-main 2.13.4-r4 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 3.21-main 2.13.4-r3 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable