Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

libxml2 could let attackers execute code

published 8 days ago

Summary

The libxml2 software used on Red Hat systems for handling XML files has a security flaw that could allow a crafted XML document to run unwanted code or crash the program. This could expose your servers to data loss or unauthorized actions. Install the latest Red Hat security update for libxml2 and its related packages right away.

What to do

Update redhat libxml2-debuginfo to version 0:2.9.7-13.el8_6.15.
Update redhat libxml2-debugsource to version 0:2.9.7-13.el8_6.15.
Update redhat libxml2-devel to version 0:2.9.7-13.el8_6.15.
Update redhat python3-libxml2-debuginfo to version 0:2.9.7-13.el8_6.15.
Update redhat libxml2 to version 0:2.9.7-13.el8_6.15.
Update redhat python3-libxml2 to version 0:2.9.7-13.el8_6.15.

Affected software

Ecosystem	Vendor	Product	Affected versions
Red Hat:rhel_aus:8.6::appstream	redhat	libxml2-debuginfo	< 0:2.9.7-13.el8_6.15 Fix: upgrade to 0:2.9.7-13.el8_6.15
Red Hat:rhel_aus:8.6::appstream	redhat	libxml2-debugsource	< 0:2.9.7-13.el8_6.15 Fix: upgrade to 0:2.9.7-13.el8_6.15
Red Hat:rhel_aus:8.6::appstream	redhat	libxml2-devel	< 0:2.9.7-13.el8_6.15 Fix: upgrade to 0:2.9.7-13.el8_6.15
Red Hat:rhel_aus:8.6::appstream	redhat	python3-libxml2-debuginfo	< 0:2.9.7-13.el8_6.15 Fix: upgrade to 0:2.9.7-13.el8_6.15
Red Hat:rhel_eus_long_life:8.6::appstream	redhat	libxml2-debuginfo	< 0:2.9.7-13.el8_6.15 Fix: upgrade to 0:2.9.7-13.el8_6.15
Red Hat:rhel_eus_long_life:8.6::appstream	redhat	libxml2-debugsource	< 0:2.9.7-13.el8_6.15 Fix: upgrade to 0:2.9.7-13.el8_6.15
Red Hat:rhel_eus_long_life:8.6::appstream	redhat	libxml2-devel	< 0:2.9.7-13.el8_6.15 Fix: upgrade to 0:2.9.7-13.el8_6.15
Red Hat:rhel_eus_long_life:8.6::appstream	redhat	python3-libxml2-debuginfo	< 0:2.9.7-13.el8_6.15 Fix: upgrade to 0:2.9.7-13.el8_6.15
Red Hat:rhel_aus:8.6::baseos	redhat	libxml2	< 0:2.9.7-13.el8_6.15 Fix: upgrade to 0:2.9.7-13.el8_6.15
Red Hat:rhel_aus:8.6::baseos	redhat	libxml2-debuginfo	< 0:2.9.7-13.el8_6.15 Fix: upgrade to 0:2.9.7-13.el8_6.15
Red Hat:rhel_aus:8.6::baseos	redhat	libxml2-debugsource	< 0:2.9.7-13.el8_6.15 Fix: upgrade to 0:2.9.7-13.el8_6.15
Red Hat:rhel_aus:8.6::baseos	redhat	python3-libxml2	< 0:2.9.7-13.el8_6.15 Fix: upgrade to 0:2.9.7-13.el8_6.15
Red Hat:rhel_aus:8.6::baseos	redhat	python3-libxml2-debuginfo	< 0:2.9.7-13.el8_6.15 Fix: upgrade to 0:2.9.7-13.el8_6.15
Red Hat:rhel_eus_long_life:8.6::baseos	redhat	libxml2	< 0:2.9.7-13.el8_6.15 Fix: upgrade to 0:2.9.7-13.el8_6.15
Red Hat:rhel_eus_long_life:8.6::baseos	redhat	libxml2-debuginfo	< 0:2.9.7-13.el8_6.15 Fix: upgrade to 0:2.9.7-13.el8_6.15
Red Hat:rhel_eus_long_life:8.6::baseos	redhat	libxml2-debugsource	< 0:2.9.7-13.el8_6.15 Fix: upgrade to 0:2.9.7-13.el8_6.15
Red Hat:rhel_eus_long_life:8.6::baseos	redhat	python3-libxml2	< 0:2.9.7-13.el8_6.15 Fix: upgrade to 0:2.9.7-13.el8_6.15
Red Hat:rhel_eus_long_life:8.6::baseos	redhat	python3-libxml2-debuginfo	< 0:2.9.7-13.el8_6.15 Fix: upgrade to 0:2.9.7-13.el8_6.15

Original advisory text

Red Hat Security Advisory: libxml2 security update

References

https://access.redhat.com/errata/RHSA-2026:79120 Vendor Advisory
https://access.redhat.com/security/updates/classification/#low Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2372952 Third Party Advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_79120.... Vendor Advisory
https://access.redhat.com/security/cve/CVE-2025-6170 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2025-6170 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-6170 Vendor Advisory
https://gitlab.gnome.org/GNOME/libxml2/-/issues/941 Third Party Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

2.5 Low

Timeline

Published10 Oct 2026

Updated10 Oct 2026

First seen10 Oct 2026

Sources

RHSA-2026:79120 · OSV

Track software like this

Free during beta