CVE-2026-0989
Low · 3.7CVSS
3.7
EPSS
0.5%
Published
Jan 15, 2026
CISA due date
—
The record
A flaw was identified in the RelaxNG parser of libxml2 related to how external schema inclusions are handled. The parser does not enforce a limit on inclusion depth when resolving nested <include> directives. Specially crafted or overly complex schemas can cause excessive recursion during parsing. This may lead to stack exhaustion and application crashes, creating a denial-of-service risk.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Mageia:9 | libxml2 | 0 | 2.10.4-1.9.mga9 |
| SUSE:Linux Enterprise Micro 5.2 | libxml2 | 0 | 2.9.7-150000.3.91.1 |
| SUSE:Linux Enterprise Micro 5.2 | python-libxml2-python | 0 | 2.9.7-150000.3.91.1 |
| SUSE:Linux Enterprise Micro 5.5 | libxml2 | 0 | 2.10.3-150500.5.35.1 |
| SUSE:Linux Enterprise Micro 5.5 | libxml2-python | 0 | 2.10.3-150500.5.35.1 |
| openSUSE:Leap 15.6 | libxml2 | 0 | 2.10.3-150500.5.35.1 |
| openSUSE:Leap 15.6 | libxml2-python | 0 | 2.10.3-150500.5.35.1 |
| openSUSE:Leap 15.6 | python-libxml2-python | 0 | 2.9.7-150000.3.91.1 |
| openSUSE:Leap 16.0 | libxml2 | 0 | 2.13.8-160000.3.1 |
| openSUSE:Leap 16.0 | libxml2-python | 0 | 2.13.8-160000.3.1 |
| openSUSE:Tumbleweed | libxml2 | 0 | 2.14.5-2.1 |
Related vulnerabilities
- CVE-2026-0990 A flaw was found in libxml2, an XML parsing library. Also affects libxml2
- CVE-2026-0992 A flaw was found in the libxml2 library. Also affects libxml2
- CVE-2026-1757 A flaw was identified in the interactive shell of the xmllint utility, part of the… Also affects libxml2
- CVE-2024-40896 In libxml2 2.11 before 2.11.9, 2.12 before 2.12.9, and 2.13 before 2.13.3, the SAX parser… Also affects libxml2
- CVE-2017-0663 A remote code execution vulnerability in libxml2 could enable an attacker using a… Also affects libxml2
- CVE-2015-7499 Heap-based buffer overflow in the xmlGROW function in parser.c in libxml2 before 2.9.3… Also affects libxml2
- CVE-2015-5312 The xmlStringLenDecodeEntities function in parser.c in libxml2 before 2.9.3 does not… Also affects libxml2
- CVE-2015-1819 The xmlreader in libxml allows remote attackers to cause a denial of service (memory… Also affects libxml2