Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Red Hat libxml2 may allow unauthorized data access

published 8 days ago

Summary

The libxml2 libraries supplied by Red Hat can be tricked into revealing information they shouldn't. This could let an attacker read sensitive data from your systems. Update the libxml2 packages to the latest versions as soon as possible to close the gap.

What to do

Update redhat libxml2-debuginfo to version 0:2.9.13-13.el9_4.2.
Update redhat libxml2-debugsource to version 0:2.9.13-13.el9_4.2.
Update redhat libxml2-devel to version 0:2.9.13-13.el9_4.2.
Update redhat python3-libxml2-debuginfo to version 0:2.9.13-13.el9_4.2.
Update redhat libxml2 to version 0:2.9.13-13.el9_4.2.
Update redhat python3-libxml2 to version 0:2.9.13-13.el9_4.2.

Affected software

Ecosystem	Vendor	Product	Affected versions
Red Hat:rhel_e4s:9.4::appstream	redhat	libxml2-debuginfo	< 0:2.9.13-13.el9_4.2 Fix: upgrade to 0:2.9.13-13.el9_4.2
Red Hat:rhel_e4s:9.4::appstream	redhat	libxml2-debugsource	< 0:2.9.13-13.el9_4.2 Fix: upgrade to 0:2.9.13-13.el9_4.2
Red Hat:rhel_e4s:9.4::appstream	redhat	libxml2-devel	< 0:2.9.13-13.el9_4.2 Fix: upgrade to 0:2.9.13-13.el9_4.2
Red Hat:rhel_e4s:9.4::appstream	redhat	python3-libxml2-debuginfo	< 0:2.9.13-13.el9_4.2 Fix: upgrade to 0:2.9.13-13.el9_4.2
Red Hat:rhel_e4s:9.4::baseos	redhat	libxml2	< 0:2.9.13-13.el9_4.2 Fix: upgrade to 0:2.9.13-13.el9_4.2
Red Hat:rhel_e4s:9.4::baseos	redhat	libxml2-debuginfo	< 0:2.9.13-13.el9_4.2 Fix: upgrade to 0:2.9.13-13.el9_4.2
Red Hat:rhel_e4s:9.4::baseos	redhat	libxml2-debugsource	< 0:2.9.13-13.el9_4.2 Fix: upgrade to 0:2.9.13-13.el9_4.2
Red Hat:rhel_e4s:9.4::baseos	redhat	python3-libxml2	< 0:2.9.13-13.el9_4.2 Fix: upgrade to 0:2.9.13-13.el9_4.2
Red Hat:rhel_e4s:9.4::baseos	redhat	python3-libxml2-debuginfo	< 0:2.9.13-13.el9_4.2 Fix: upgrade to 0:2.9.13-13.el9_4.2

Original advisory text

Red Hat Security Advisory: libxml2 security update

References

https://access.redhat.com/errata/RHSA-2026:79121 Vendor Advisory
https://access.redhat.com/security/updates/classification/#low Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2372952 Third Party Advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_79121.... Vendor Advisory
https://access.redhat.com/security/cve/CVE-2025-6170 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2025-6170 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-6170 Vendor Advisory
https://gitlab.gnome.org/GNOME/libxml2/-/issues/941 Third Party Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

2.5 Low

Timeline

Published10 Oct 2026

Updated10 Oct 2026

First seen10 Oct 2026

Sources

RHSA-2026:79121 · OSV

Track software like this

Free during beta