Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.6
CVE-2026-86144: libxml2 may fetch remote data via XML includes
CVE-2026-86144 · published 2 months ago
Summary
Versions of libxml2 earlier than 2.15.4 do not correctly pass security settings when processing XInclude statements. This can let a crafted XML file cause your application to reach out to the internet, potentially exposing data, overloading resources, or causing a denial of service. Upgrade libxml2 to version 2.15.4 or newer, or explicitly enforce safe parsing options in your code.
What to do
- Update debian libxml2 to version 2.15.4+dfsg-1.
- Update bellsoft libxml2 to version 2.13.9-r6.
- Update libxml2 to version 2.13.9-r6.
- Update bellsoft libxml2 to version 2.13.9-r5.
- Update libxml2 to version 2.13.9-r5.
- Update libxml2 to version 2.9.14+dfsg-1.3~deb12u6.aikido.20.
- Update rootio-libxml2 to version 2.9.14+dfsg-1.3~deb12u6.aikido.20.
- Update bellsoft libxml2 to version 2.10.4-r11.
- Update libxml2 to version 2.10.4-r11.
- Update xmlsoft libxml2 to version 2.15.4 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | xmlsoft | libxml2 | < 2.15.4 |
| Ubuntu:Pro:14.04:LTS | canonical | libxml2 | All versions |
| Debian:12 | debian | libxml2 | All versions |
| Debian:14 | debian | libxml2 |
< 2.15.4+dfsg-1 Fix: upgrade to 2.15.4+dfsg-1
|
| Alpaquita:stream | bellsoft | libxml2 |
>= 2.10.3-r2, < 2.13.9-r6 Fix: upgrade to 2.13.9-r6
|
| BellSoft Hardened Containers:stream | – | libxml2 |
>= 2.10.3-r2, < 2.13.9-r6 Fix: upgrade to 2.13.9-r6
|
| Alpaquita:25 | bellsoft | libxml2 |
>= 2.13.8-r0, < 2.13.9-r5 Fix: upgrade to 2.13.9-r5
|
| BellSoft Hardened Containers:25 | – | libxml2 |
>= 2.13.8-r0, < 2.13.9-r5 Fix: upgrade to 2.13.9-r5
|
| Root:Debian:12 | – | libxml2 |
< 2.9.14+dfsg-1.3~deb12u6.aikido.20 Fix: upgrade to 2.9.14+dfsg-1.3~deb12u6.aikido.20
|
| Root:Debian:12 | – | rootio-libxml2 |
< 2.9.14+dfsg-1.3~deb12u6.aikido.20 Fix: upgrade to 2.9.14+dfsg-1.3~deb12u6.aikido.20
|
| Alpaquita:23 | bellsoft | libxml2 |
>= 2.10.3-r2, < 2.10.4-r11 Fix: upgrade to 2.10.4-r11
|
| BellSoft Hardened Containers:23 | – | libxml2 |
>= 2.10.3-r2, < 2.10.4-r11 Fix: upgrade to 2.10.4-r11
|
Original advisory text
BELL-CVE-2026-86144
In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, the XML_PARSE_NONET flag, if (without it) a custom resource loader accesses the internet and triggers XML external entity injection, SSRF, or a denial of service (e.g., for an attacker-controlled internet resource that is intentionally slow).
References
- https://docs.bell-sw.com/security/cves/CVE-2026-86144 Vendor Advisory
- https://ubuntu.com/security/CVE-2026-86144 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-86144 Third Party Advisory
- https://github.com/GNOME/libxml2/commit/b63cd517afecb76582dd9488c55e54ceaf50de61 Patch
- https://nvd.nist.gov/vuln/detail/CVE-2026-86144 Vendor Advisory
- https://security-tracker.debian.org/tracker/CVE-2026-86144 Vendor Advisory
- https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4 URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86144... Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-669Incorrect Resource Transfer Between Spheres
Timeline
Published5 Sep 2026
Updated30 Oct 2026
First seen5 Sep 2026
Sources
CVE-2026-86144 · NVD
CVE-2026-86144 · OSV
UBUNTU-CVE-2026-86144 · OSV
CVE-2026-86144 · MITRE
DEBIAN-CVE-2026-86144 · OSV
BELL-CVE-2026-86144 · OSV
Track software like this
Free during beta