CVE-2026-0990
Medium · 5.9CVSS
5.9
EPSS
1.0%
Published
Jan 15, 2026
CISA due date
—
The record
A flaw was found in libxml2, an XML parsing library. This uncontrolled recursion vulnerability occurs in the xmlCatalogXMLResolveURI function when an XML catalog contains a delegate URI entry that references itself. A remote attacker could exploit this configuration-dependent issue by providing a specially crafted XML catalog, leading to infinite recursion and call stack exhaustion. This ultimately results in a segmentation fault, causing a Denial of Service (DoS) by crashing affected applications.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Mageia:9 | libxml2 | 0 | 2.10.4-1.9.mga9 |
| SUSE:Linux Enterprise Micro 5.2 | libxml2 | 0 | 2.9.7-150000.3.94.1 |
| SUSE:Linux Enterprise Micro 5.2 | python-libxml2-python | 0 | 2.9.7-150000.3.94.1 |
| SUSE:Linux Enterprise Micro 5.5 | libxml2 | 0 | 2.10.3-150500.5.38.1 |
| SUSE:Linux Enterprise Micro 5.5 | libxml2-python | 0 | 2.10.3-150500.5.38.1 |
| SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | libxml2 | 0 | 2.9.4-46.99.1 |
| SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | python-libxml2 | 0 | 2.9.4-46.99.1 |
| openSUSE:Leap 15.6 | libxml2 | 0 | 2.10.3-150500.5.38.1 |
| openSUSE:Leap 15.6 | libxml2-python | 0 | 2.10.3-150500.5.38.1 |
| openSUSE:Leap 15.6 | python-libxml2-python | 0 | 2.9.7-150000.3.94.1 |
| openSUSE:Leap 16.0 | libxml2 | 0 | 2.13.8-160000.4.1 |
| openSUSE:Leap 16.0 | libxml2-python | 0 | 2.13.8-160000.4.1 |
| openSUSE:Leap 16.0 | libxslt | 0 | 1.1.43-160000.4.1 |
| openSUSE:Tumbleweed | libxml2 | 0 | 2.14.5-4.1 |
Related vulnerabilities
- CVE-2026-0989 A flaw was identified in the RelaxNG parser of libxml2 related to how external schema… Also affects libxml2
- CVE-2026-0992 A flaw was found in the libxml2 library. Also affects libxml2
- CVE-2026-1757 A flaw was identified in the interactive shell of the xmllint utility, part of the… Also affects libxml2
- CVE-2024-40896 In libxml2 2.11 before 2.11.9, 2.12 before 2.12.9, and 2.13 before 2.13.3, the SAX parser… Also affects libxml2
- CVE-2017-0663 A remote code execution vulnerability in libxml2 could enable an attacker using a… Also affects libxml2
- CVE-2015-7499 Heap-based buffer overflow in the xmlGROW function in parser.c in libxml2 before 2.9.3… Also affects libxml2
- CVE-2015-5312 The xmlStringLenDecodeEntities function in parser.c in libxml2 before 2.9.3 does not… Also affects libxml2
- CVE-2015-1819 The xmlreader in libxml allows remote attackers to cause a denial of service (memory… Also affects libxml2