Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Red Hat libxml2 can be made to crash or run code

published 8 days ago

Summary

The libxml2 library used in Red Hat systems can mishandle specially crafted XML data, which could let an attacker cause the program to stop working or execute unwanted actions. This affects the libxml2 packages and related development/debug files. Apply the latest Red Hat update for libxml2 as soon as possible to protect your systems.

What to do

Update redhat libxml2-debuginfo to version 0:2.9.7-16.el8_8.15.
Update redhat libxml2-debugsource to version 0:2.9.7-16.el8_8.15.
Update redhat libxml2-devel to version 0:2.9.7-16.el8_8.15.
Update redhat python3-libxml2-debuginfo to version 0:2.9.7-16.el8_8.15.
Update redhat libxml2 to version 0:2.9.7-16.el8_8.15.
Update redhat python3-libxml2 to version 0:2.9.7-16.el8_8.15.

Affected software

Ecosystem	Vendor	Product	Affected versions
Red Hat:rhel_e4s:8.8::appstream	redhat	libxml2-debuginfo	< 0:2.9.7-16.el8_8.15 Fix: upgrade to 0:2.9.7-16.el8_8.15
Red Hat:rhel_e4s:8.8::appstream	redhat	libxml2-debugsource	< 0:2.9.7-16.el8_8.15 Fix: upgrade to 0:2.9.7-16.el8_8.15
Red Hat:rhel_e4s:8.8::appstream	redhat	libxml2-devel	< 0:2.9.7-16.el8_8.15 Fix: upgrade to 0:2.9.7-16.el8_8.15
Red Hat:rhel_e4s:8.8::appstream	redhat	python3-libxml2-debuginfo	< 0:2.9.7-16.el8_8.15 Fix: upgrade to 0:2.9.7-16.el8_8.15
Red Hat:rhel_tus:8.8::appstream	redhat	libxml2-debuginfo	< 0:2.9.7-16.el8_8.15 Fix: upgrade to 0:2.9.7-16.el8_8.15
Red Hat:rhel_tus:8.8::appstream	redhat	libxml2-debugsource	< 0:2.9.7-16.el8_8.15 Fix: upgrade to 0:2.9.7-16.el8_8.15
Red Hat:rhel_tus:8.8::appstream	redhat	libxml2-devel	< 0:2.9.7-16.el8_8.15 Fix: upgrade to 0:2.9.7-16.el8_8.15
Red Hat:rhel_tus:8.8::appstream	redhat	python3-libxml2-debuginfo	< 0:2.9.7-16.el8_8.15 Fix: upgrade to 0:2.9.7-16.el8_8.15
Red Hat:rhel_e4s:8.8::baseos	redhat	libxml2	< 0:2.9.7-16.el8_8.15 Fix: upgrade to 0:2.9.7-16.el8_8.15
Red Hat:rhel_e4s:8.8::baseos	redhat	libxml2-debuginfo	< 0:2.9.7-16.el8_8.15 Fix: upgrade to 0:2.9.7-16.el8_8.15
Red Hat:rhel_e4s:8.8::baseos	redhat	libxml2-debugsource	< 0:2.9.7-16.el8_8.15 Fix: upgrade to 0:2.9.7-16.el8_8.15
Red Hat:rhel_e4s:8.8::baseos	redhat	python3-libxml2	< 0:2.9.7-16.el8_8.15 Fix: upgrade to 0:2.9.7-16.el8_8.15
Red Hat:rhel_e4s:8.8::baseos	redhat	python3-libxml2-debuginfo	< 0:2.9.7-16.el8_8.15 Fix: upgrade to 0:2.9.7-16.el8_8.15
Red Hat:rhel_tus:8.8::baseos	redhat	libxml2	< 0:2.9.7-16.el8_8.15 Fix: upgrade to 0:2.9.7-16.el8_8.15
Red Hat:rhel_tus:8.8::baseos	redhat	libxml2-debuginfo	< 0:2.9.7-16.el8_8.15 Fix: upgrade to 0:2.9.7-16.el8_8.15
Red Hat:rhel_tus:8.8::baseos	redhat	libxml2-debugsource	< 0:2.9.7-16.el8_8.15 Fix: upgrade to 0:2.9.7-16.el8_8.15
Red Hat:rhel_tus:8.8::baseos	redhat	python3-libxml2	< 0:2.9.7-16.el8_8.15 Fix: upgrade to 0:2.9.7-16.el8_8.15
Red Hat:rhel_tus:8.8::baseos	redhat	python3-libxml2-debuginfo	< 0:2.9.7-16.el8_8.15 Fix: upgrade to 0:2.9.7-16.el8_8.15

Original advisory text

Red Hat Security Advisory: libxml2 security update

References

https://access.redhat.com/errata/RHSA-2026:79119 Vendor Advisory
https://access.redhat.com/security/updates/classification/#low Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2372952 Third Party Advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_79119.... Vendor Advisory
https://access.redhat.com/security/cve/CVE-2025-6170 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2025-6170 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-6170 Vendor Advisory
https://gitlab.gnome.org/GNOME/libxml2/-/issues/941 Third Party Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

2.5 Low

Timeline

Published10 Oct 2026

Updated10 Oct 2026

First seen10 Oct 2026

Sources

RHSA-2026:79119 · OSV

Track software like this

Free during beta