Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Red Hat libxml2 can let attackers cause crashes

published today

Summary

The libxml2 library included in Red Hat systems has a flaw that could let a malicious user send specially crafted data to make the program stop working or behave unexpectedly. This could affect any application that relies on libxml2 for processing XML files, potentially leading to downtime or data loss. Update the libxml2 packages to the latest version provided by Red Hat to eliminate the risk.

What to do

Update redhat libxml2-debuginfo to version 0:2.9.13-13.el9_6.
Update redhat libxml2-debugsource to version 0:2.9.13-13.el9_6.
Update redhat libxml2-devel to version 0:2.9.13-13.el9_6.
Update redhat python3-libxml2-debuginfo to version 0:2.9.13-13.el9_6.
Update redhat libxml2 to version 0:2.9.13-13.el9_6.
Update redhat python3-libxml2 to version 0:2.9.13-13.el9_6.

Affected software

Ecosystem	Vendor	Product	Affected versions
Red Hat:rhel_eus:9.6::appstream	redhat	libxml2-debuginfo	< 0:2.9.13-13.el9_6 Fix: upgrade to 0:2.9.13-13.el9_6
Red Hat:rhel_eus:9.6::appstream	redhat	libxml2-debugsource	< 0:2.9.13-13.el9_6 Fix: upgrade to 0:2.9.13-13.el9_6
Red Hat:rhel_eus:9.6::appstream	redhat	libxml2-devel	< 0:2.9.13-13.el9_6 Fix: upgrade to 0:2.9.13-13.el9_6
Red Hat:rhel_eus:9.6::appstream	redhat	python3-libxml2-debuginfo	< 0:2.9.13-13.el9_6 Fix: upgrade to 0:2.9.13-13.el9_6
Red Hat:rhel_eus:9.6::baseos	redhat	libxml2	< 0:2.9.13-13.el9_6 Fix: upgrade to 0:2.9.13-13.el9_6
Red Hat:rhel_eus:9.6::baseos	redhat	libxml2-debuginfo	< 0:2.9.13-13.el9_6 Fix: upgrade to 0:2.9.13-13.el9_6
Red Hat:rhel_eus:9.6::baseos	redhat	libxml2-debugsource	< 0:2.9.13-13.el9_6 Fix: upgrade to 0:2.9.13-13.el9_6
Red Hat:rhel_eus:9.6::baseos	redhat	python3-libxml2	< 0:2.9.13-13.el9_6 Fix: upgrade to 0:2.9.13-13.el9_6
Red Hat:rhel_eus:9.6::baseos	redhat	python3-libxml2-debuginfo	< 0:2.9.13-13.el9_6 Fix: upgrade to 0:2.9.13-13.el9_6

Original advisory text

Red Hat Security Advisory: libxml2 security, bug fix, and enhancement update

References

https://access.redhat.com/errata/RHSA-2026:90309 Vendor Advisory
https://access.redhat.com/security/updates/classification/#important Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2491354 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2494191 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2528986 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2528987 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2528989 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2528990 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2528992 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2529697 Third Party Advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_90309.... Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-6653 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-6653 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-6653 Vendor Advisory
https://bugs.launchpad.net/ubuntu/+source/libxml2/+bug/2141260 Third Party Advisory
https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1058 Third Party Advisory
https://access.redhat.com/security/cve/CVE-2026-11979 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-11979 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-11979 Vendor Advisory
https://cert.pl/en/posts/2026/06/CVE-2026-11979 Third Party Advisory
https://gitlab.gnome.org/GNOME/libxml2/-/commit/c2e233fc1b341685fc99621b2768b503... Third Party Advisory
https://access.redhat.com/security/cve/CVE-2026-74860 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-74860 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-74860 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-86138 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-86138 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-86138 Vendor Advisory
https://github.com/GNOME/libxml2/commit/a4cba4b5b5a8c42e155ed42d2d2a44955465a2e4 Third Party Advisory
https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4 Third Party Advisory
https://access.redhat.com/security/cve/CVE-2026-86140 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-86140 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-86140 Vendor Advisory
https://github.com/GNOME/libxml2/commit/d1686f91dbda141a752200419d35639fd6b38340 Third Party Advisory
https://access.redhat.com/security/cve/CVE-2026-86142 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-86142 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-86142 Vendor Advisory
https://github.com/GNOME/libxml2/commit/6b3a736c0edc74ceec3d82f5252499d7911b3a58 Third Party Advisory
https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1113 Third Party Advisory
https://access.redhat.com/security/cve/CVE-2026-86143 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-86143 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-86143 Vendor Advisory
https://github.com/GNOME/libxml2/commit/90f293ba74d28b1d570920382e707586f68ebf35 Third Party Advisory
https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1111 Third Party Advisory
https://access.redhat.com/security/cve/CVE-2026-86144 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-86144 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-86144 Vendor Advisory
https://github.com/GNOME/libxml2/commit/b63cd517afecb76582dd9488c55e54ceaf50de61 Third Party Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker full control (estimated)

Severity

8.5 High

Timeline

Published13 Nov 2026

Updated13 Nov 2026

First seen13 Nov 2026

Sources

RHSA-2026:90309 · OSV

Track software like this

Free during beta