CVE-2026-0992
Low · 2.9CVSS
2.9
EPSS
0.5%
Published
Jan 15, 2026
CISA due date
—
The record
A flaw was found in the libxml2 library. This uncontrolled resource consumption vulnerability occurs when processing XML catalogs that contain repeated <nextCatalog> elements pointing to the same downstream catalog. A remote attacker can exploit this by supplying crafted catalogs, causing the parser to redundantly traverse catalog chains. This leads to excessive CPU consumption and degrades application availability, resulting in a denial-of-service condition.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Mageia:9 | libxml2 | 0 | 2.10.4-1.9.mga9 |
| SUSE:Linux Enterprise Micro 5.2 | libxml2 | 0 | 2.9.7-150000.3.94.1 |
| SUSE:Linux Enterprise Micro 5.2 | python-libxml2-python | 0 | 2.9.7-150000.3.94.1 |
| SUSE:Linux Enterprise Micro 5.5 | libxml2 | 0 | 2.10.3-150500.5.38.1 |
| SUSE:Linux Enterprise Micro 5.5 | libxml2-python | 0 | 2.10.3-150500.5.38.1 |
| SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | libxml2 | 0 | 2.9.4-46.99.1 |
| SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | python-libxml2 | 0 | 2.9.4-46.99.1 |
| openSUSE:Leap 15.6 | libxml2 | 0 | 2.10.3-150500.5.38.1 |
| openSUSE:Leap 15.6 | libxml2-python | 0 | 2.10.3-150500.5.38.1 |
| openSUSE:Leap 15.6 | python-libxml2-python | 0 | 2.9.7-150000.3.94.1 |
| openSUSE:Leap 16.0 | libxml2 | 0 | 2.13.8-160000.4.1 |
| openSUSE:Leap 16.0 | libxml2-python | 0 | 2.13.8-160000.4.1 |
| openSUSE:Leap 16.0 | libxslt | 0 | 1.1.43-160000.4.1 |
| openSUSE:Tumbleweed | libxml2 | 0 | 2.14.5-4.1 |
Related vulnerabilities
- CVE-2026-0990 A flaw was found in libxml2, an XML parsing library. Also affects libxml2
- CVE-2026-0989 A flaw was identified in the RelaxNG parser of libxml2 related to how external schema… Also affects libxml2
- CVE-2026-1757 A flaw was identified in the interactive shell of the xmllint utility, part of the… Also affects libxml2
- CVE-2024-40896 In libxml2 2.11 before 2.11.9, 2.12 before 2.12.9, and 2.13 before 2.13.3, the SAX parser… Also affects libxml2
- CVE-2017-0663 A remote code execution vulnerability in libxml2 could enable an attacker using a… Also affects libxml2
- CVE-2015-7499 Heap-based buffer overflow in the xmlGROW function in parser.c in libxml2 before 2.9.3… Also affects libxml2
- CVE-2015-5312 The xmlStringLenDecodeEntities function in parser.c in libxml2 before 2.9.3 does not… Also affects libxml2
- CVE-2015-1819 The xmlreader in libxml allows remote attackers to cause a denial of service (memory… Also affects libxml2