libxml2

A Library to Manipulate XML Files

Current: 2.14.5
Candidate: 2.15.4Stale

License: MIT

Build

Target	Result	Last successful version	Succeeded at
rva23	Succeeded	2.14.5	2026-10-09 05:33:48 UTC
rva20	Succeeded	2.14.5	2026-10-09 05:37:07 UTC
x86_64	Succeeded	2.14.5	2026-10-09 05:27:28 UTC

Advisory · 14

Query product: libxml2NVD
Query vendor: xmlsoftNVD
Query version: 2.14.5NVD

Provider matches do not establish RPM applicability. Local patches, bundled dependencies and binary artifacts are not evaluated.

CVE-2025-8732
NVD
Summary
A vulnerability was found in libxml2 up to 2.14.5. It has been declared as problematic. This vulnerability affects the function xmlParseSGMLCatalog of the component xmlcatalog. The manipulation leads to uncontrolled recursion. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The code maintainer explains, that "[t]he issue can only be triggered with untrusted SGML catalogs and it makes absolutely no sense to use untrusted catalogs. I also doubt that anyone is still using SGM…NVD
EPSS model date
2026-11-10FIRST
EPSS probability
0.255%FIRST
Vulnerable CPE criteria
cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:*; < 2.15.2NVD
Aliases
—NVD
KEV
NoCISA
CVSS_V2
AV:L/AC:L/Au:S/C:N/I:N/A:PNVD
CVSS_V3
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:LNVD
CVSS_V4
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XNVD
Summary characters omitted
19NVD
References
Web · cert-portal.siemens.com Web · drive.google.com Web · gitlab.gnome.org Web · gitlab.gnome.org Web · vuldb.com Web · vuldb.com Web · vuldb.com
CVE-2026-0989
NVD
Summary
A flaw was identified in the RelaxNG parser of libxml2 related to how external schema inclusions are handled. The parser does not enforce a limit on inclusion depth when resolving nested <include> directives. Specially crafted or overly complex schemas can cause excessive recursion during parsing. This may lead to stack exhaustion and application crashes, creating a denial-of-service risk.NVD
EPSS model date
2026-11-10FIRST
EPSS probability
0.53%FIRST
Vulnerable CPE criteria
cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:*; < 2.15.2NVD
Aliases
—NVD
KEV
NoCISA
CVSS_V3
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:LNVD
References
Web · access.redhat.com Web · access.redhat.com Web · bugzilla.redhat.com Web · gitlab.gnome.org
CVE-2026-0990
NVD
Summary
A flaw was found in libxml2, an XML parsing library. This uncontrolled recursion vulnerability occurs in the xmlCatalogXMLResolveURI function when an XML catalog contains a delegate URI entry that references itself. A remote attacker could exploit this configuration-dependent issue by providing a specially crafted XML catalog, leading to infinite recursion and call stack exhaustion. This ultimately results in a segmentation fault, causing a Denial of Service (DoS) by crashing affected applications.NVD
EPSS model date
2026-11-10FIRST
EPSS probability
0.955%FIRST
Vulnerable CPE criteria
cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:*; < 2.15.2NVD
Aliases
—NVD
KEV
NoCISA
CVSS_V3
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:HNVD
References
Web · access.redhat.com Web · access.redhat.com Web · bugzilla.redhat.com Web · gitlab.gnome.org
CVE-2026-0992
NVD
Summary
A flaw was found in the libxml2 library. This uncontrolled resource consumption vulnerability occurs when processing XML catalogs that contain repeated <nextCatalog> elements pointing to the same downstream catalog. A remote attacker can exploit this by supplying crafted catalogs, causing the parser to redundantly traverse catalog chains. This leads to excessive CPU consumption and degrades application availability, resulting in a denial-of-service condition.NVD
EPSS model date
2026-11-10FIRST
EPSS probability
0.459%FIRST
Vulnerable CPE criteria
cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:*; < 2.15.2NVD
Aliases
—NVD
KEV
NoCISA
CVSS_V3
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:LNVD
References
Web · access.redhat.com Web · access.redhat.com Web · bugzilla.redhat.com Web · gitlab.gnome.org
CVE-2026-11979
NVD
Summary
libxml2 is vulnerable to multiple stack-based buffer overflows in the xmlcatalog utility when running in --shell mode. The usershell() function processes user input using fixed-size stack buffers without proper bounds checking. By supplying an overly long input line, an attacker can overflow internal buffers (command, arg, and argv) during input parsing. This results in memory corruption within the stack frame. Successful exploitation may cause a crash or potentially allow arbitrary code execution in the context of the xmlcatalog process. This issue has been fixed in the commit c2e233fc. NOTE:…NVD
EPSS model date
2026-11-10FIRST
EPSS probability
0.148%FIRST
Vulnerable CPE criteria
cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:*; <= 2.15.3NVD
Aliases
—NVD
KEV
NoCISA
CVSS_V3
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HNVD
CVSS_V4
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XNVD
Summary characters omitted
106NVD
References
Fix · c2e233fc1b34 Web · cert.pl
CVE-2026-6732
NVD
Summary
A flaw was found in libxml2. This vulnerability occurs when the library processes a specially crafted XML Schema Definition (XSD) validated document that includes an internal entity reference. An attacker could exploit this by providing a malicious document, leading to a type confusion error that causes the application to crash. This results in a denial of service (DoS), making the affected system or application unavailable.NVD
EPSS model date
2026-11-10FIRST
EPSS probability
0.632%FIRST
Vulnerable CPE criteria
cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:*; >= 2.13.0, < 2.15.3NVD
Aliases
—NVD
KEV
NoCISA
CVSS_V3
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HNVD
CVSS_V3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HNVD
References
Web · access.redhat.com Web · access.redhat.com Web · bugzilla.redhat.com Web · gitlab.gnome.org Web · gitlab.gnome.org
CVE-2026-86137
NVD
Summary
In libxml2 before 2.15.4, xmlFAParsePosCharGroup has an out-of-bounds read, aka an out-of-bounds read in the NXT macro in xmlregexp.NVD
EPSS model date
2026-11-10FIRST
EPSS probability
0.195%FIRST
Vulnerable CPE criteria
cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:*; < 2.15.4NVD
Aliases
—NVD
KEV
NoCISA
CVSS_V3
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:LNVD
CVSS_V3
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:LNVD
References
Advisory · gitlab.gnome.org Fix · 76fe08d97de8 Web · github.com
CVE-2026-86138
NVD
Summary
In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based buffer overflow.NVD
EPSS model date
2026-11-10FIRST
EPSS probability
0.132%FIRST
Vulnerable CPE criteria
cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:*; < 2.15.4NVD
Aliases
—NVD
KEV
NoCISA
CVSS_V3
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:LNVD
CVSS_V3
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HNVD
References
Fix · a4cba4b5b5a8 Web · github.com
CVE-2026-86139
NVD
Summary
In libxml2 before 2.15.4, xmlURIEscapeStr in uri.c has an integer overflow.NVD
EPSS model date
2026-11-10FIRST
EPSS probability
0.166%FIRST
Vulnerable CPE criteria
cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:*; < 2.15.4NVD
Aliases
—NVD
KEV
NoCISA
CVSS_V3
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:LNVD
CVSS_V3
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HNVD
References
Fix · 8edbbdb09f24 Web · github.com
CVE-2026-86140
NVD
Summary
In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-based buffer overflow.NVD
EPSS model date
2026-11-10FIRST
EPSS probability
0.157%FIRST
Vulnerable CPE criteria
cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:*; < 2.15.4NVD
Aliases
—NVD
KEV
NoCISA
CVSS_V3
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HNVD
CVSS_V3
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:LNVD
References
Fix · d1686f91dbda Web · github.com
CVE-2026-86141
NVD
Summary
xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup failure, i.e., it does not calculate a string length after NULL checking.NVD
EPSS model date
2026-11-10FIRST
EPSS probability
0.165%FIRST
Vulnerable CPE criteria
cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:*; < 2.15.4NVD
Aliases
—NVD
KEV
NoCISA
CVSS_V3
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:LNVD
CVSS_V3
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:LNVD
References
Advisory · gitlab.gnome.org Fix · e89a8aae4c9b Web · github.com
CVE-2026-86142
NVD
Summary
In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation.NVD
EPSS model date
2026-11-10FIRST
EPSS probability
0.157%FIRST
Vulnerable CPE criteria
cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:*; < 2.15.4NVD
Aliases
—NVD
KEV
NoCISA
CVSS_V3
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:LNVD
CVSS_V3
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HNVD
References
Advisory · gitlab.gnome.org Fix · 6b3a736c0edc Web · github.com
CVE-2026-86143
NVD
Summary
In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks, aka a lack of a check for integer overflow before calling writecallback. This has security relevance for many types of uses of that length value within a callback.NVD
EPSS model date
2026-11-10FIRST
EPSS probability
0.194%FIRST
Vulnerable CPE criteria
cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:*; < 2.15.4NVD
Aliases
—NVD
KEV
NoCISA
CVSS_V3
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:LNVD
CVSS_V3
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:LNVD
References
Advisory · gitlab.gnome.org Fix · 90f293ba74d2 Web · github.com
CVE-2026-86144
NVD
Summary
In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, the XML_PARSE_NONET flag, if (without it) a custom resource loader accesses the internet and triggers XML external entity injection, SSRF, or a denial of service (e.g., for an attacker-controlled internet resource that is intentionally slow).NVD
EPSS model date
2026-11-10FIRST
EPSS probability
0.186%FIRST
Vulnerable CPE criteria
cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:*; < 2.15.4NVD
Aliases
—NVD
KEV
NoCISA
CVSS_V3
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:LNVD
CVSS_V3
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HNVD
References
Fix · b63cd517afec Web · github.com

Description

The XML C library was developed for the GNOME project. It is used by many programs to load, save, and manipulate any kind of XML files. This package contains the core runtime library and command-line tools.

Changelog

SPECS: libxml2: Add python-libxml2
Yafen Fangd4792c84c61f2026-05-06 10:24:32 UTC
SPECS: libxml2: Format pc file.
yyjeqhcce57e6cbfc8a2026-03-31 10:29:50 UTC
SPECS: change many file's email.
yyjeqhcf3fdb97677442026-03-05 03:29:17 UTC
SPECS: libxml2: Fix spec file formatting.
misaka0025147c14a590daf2026-01-26 15:37:40 UTC
SPECS: Don't manually delete the la file.
Zheng Junjie5298531f80202025-12-01 11:32:48 UTC
SPECS: glibc: Auto call ldconfig.
Zheng Junjie24d6ed4da5ec2025-12-01 14:10:56 UTC
Initial commit
Z572bc722d18574a2025-08-05 09:00:05 UTC

PR · 3

#318 SPECS: libxml2: Add python-libxml2
woqidaideshi2026-05-14 06:51:12 UTC
#122 SPECS: format pc files.
yyjeqhc2026-04-14 08:34:55 UTC
#104 SPECS: *: Fix style %{?autochangelog} -> %autochangelog (automated)
dramforever2026-04-09 06:15:39 UTC

Issue · 2

#1232 pre-commit: Add spec name check step to CI pipeline
redrose21002026-09-11 02:47:17 UTC
#760 llvm22: missing /usr/lib64/llvm22/lib/libLLVMTestingAnnotations.a
Z5722026-06-24 13:09:44 UTC

Checks

Monitor	Observation	Last checked
Source	Stale Repository refresh: git fetch exited 128 (authentication)	2026-11-10 17:23:44 UTC
Version	Stale Source last confirmed at 2026-11-10T17:23:44+00:00; repository refresh overdue.	2026-11-10 17:37:16 UTC
Build	Checked	2026-11-10 19:23:53 UTC
GitHub	Checked	2026-11-10 19:16:46 UTC
EOL	Not configured No reliable monitor identity/configuration.	—
LicenseDiff	Not configured No reliable monitor identity/configuration.	—
Dependencies	Not configured No reliable monitor identity/configuration.	—
Advisory	Checked Current source component only; local patches, build options, bundled dependencies and binary artifacts are not evaluated.	2026-11-10 18:53:26 UTC Last attempted2026-11-10 18:55:27 UTC
Yanked	Not configured No reliable monitor identity/configuration.	—

Monitor	Checks
Source	6367 Stale 17 CheckFailed
Version	5459 Stale 210 CheckFailed 707 Not configured 8 Input unavailable
Build	6382 Checked 2 Not yet checked
GitHub	6384 Checked
EOL	6260 Not configured 118 Checked 3 Metadata unavailable 3 Input unavailable
LicenseDiff	1665 Not configured 187 Input changed 3168 Not applicable 12 Input unavailable 1139 Checked 209 Metadata unavailable 4 CheckFailed
Dependencies	1852 Not configured 3214 Checked 1248 Metadata unavailable 7 Input unavailable 58 Partial evidence 5 CheckFailed
Advisory	4996 Checked 1375 Not configured 7 Input unavailable 6 Metadata unavailable
Yanked	2248 Not configured 4116 Checked 5 CheckFailed 7 Input unavailable 8 Metadata unavailable