CVE-2026-1757
Medium · 6.2CVSS
6.2
EPSS
0.2%
Published
Feb 2, 2026
CISA due date
—
The record
A flaw was identified in the interactive shell of the xmllint utility, part of the libxml2 project, where memory allocated for user input is not properly released under certain conditions. When a user submits input consisting only of whitespace, the program skips command execution but fails to free the allocated buffer. Repeating this action causes memory to continuously accumulate. Over time, this can exhaust system memory and terminate the xmllint process, creating a denial-of-service condition on the local system.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| SUSE:Linux Enterprise Micro 5.2 | libxml2 | 0 | 2.9.7-150000.3.94.1 |
| SUSE:Linux Enterprise Micro 5.2 | python-libxml2-python | 0 | 2.9.7-150000.3.94.1 |
| SUSE:Linux Enterprise Micro 5.5 | libxml2 | 0 | 2.10.3-150500.5.38.1 |
| SUSE:Linux Enterprise Micro 5.5 | libxml2-python | 0 | 2.10.3-150500.5.38.1 |
| SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | libxml2 | 0 | 2.9.4-46.99.1 |
| SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | python-libxml2 | 0 | 2.9.4-46.99.1 |
| openSUSE:Leap 15.6 | libxml2 | 0 | 2.10.3-150500.5.38.1 |
| openSUSE:Leap 15.6 | libxml2-python | 0 | 2.10.3-150500.5.38.1 |
| openSUSE:Leap 15.6 | python-libxml2-python | 0 | 2.9.7-150000.3.94.1 |
| openSUSE:Leap 16.0 | libxml2 | 0 | 2.13.8-160000.4.1 |
| openSUSE:Leap 16.0 | libxml2-python | 0 | 2.13.8-160000.4.1 |
| openSUSE:Leap 16.0 | libxslt | 0 | 1.1.43-160000.4.1 |
| openSUSE:Tumbleweed | libxml2 | 0 | 2.14.5-3.1 |
Related vulnerabilities
- CVE-2026-0990 A flaw was found in libxml2, an XML parsing library. Also affects libxml2
- CVE-2026-0989 A flaw was identified in the RelaxNG parser of libxml2 related to how external schema… Also affects libxml2
- CVE-2026-0992 A flaw was found in the libxml2 library. Also affects libxml2
- CVE-2024-40896 In libxml2 2.11 before 2.11.9, 2.12 before 2.12.9, and 2.13 before 2.13.3, the SAX parser… Also affects libxml2
- CVE-2017-0663 A remote code execution vulnerability in libxml2 could enable an attacker using a… Also affects libxml2
- CVE-2015-7499 Heap-based buffer overflow in the xmlGROW function in parser.c in libxml2 before 2.9.3… Also affects libxml2
- CVE-2015-5312 The xmlStringLenDecodeEntities function in parser.c in libxml2 before 2.9.3 does not… Also affects libxml2
- CVE-2015-1819 The xmlreader in libxml allows remote attackers to cause a denial of service (memory… Also affects libxml2