Vulnerability-Lookup

SUSE-SU-2026:22596-1

Vulnerability from csaf_suse - Published: 2026-07-13 07:52 - Updated: 2026-10-15 17:09

Summary

Security update for libxml2

Severity

Important

Notes

Title of the patch: Security update for libxml2

Description of the patch: This update for libxml2 fixes the following issues - CVE-2026-6732: crafted XSD-validated document can cause a denial of service (bsc#1262719). - CVE-2026-11979: stack-based buffer overflows in the `xmlcatalog` utility when running in `--shell` mode (bsc#1269790).

Patchnames: SUSE-SL-Micro-6.2-1220

CVE-2026-11979

7 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

Recommended 12 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Micro 6.2:libxml2-2-0:2.13.8-160000.5.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.2:libxml2-2-0:2.13.8-160000.5.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.2:libxml2-2-0:2.13.8-160000.5.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.2:libxml2-2-0:2.13.8-160000.5.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.2:libxml2-tools-0:2.13.8-160000.5.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.2:libxml2-tools-0:2.13.8-160000.5.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.2:libxml2-tools-0:2.13.8-160000.5.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.2:libxml2-tools-0:2.13.8-160000.5.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.2:python313-libxml2-0:2.13.8-160000.5.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.2:python313-libxml2-0:2.13.8-160000.5.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.2:python313-libxml2-0:2.13.8-160000.5.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.2:python313-libxml2-0:2.13.8-160000.5.1.x86_64	—	Vendor Fix

Threats

Impact important

CVE-2026-6732

6.5 (Medium)


                
                  CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 12 products, the same list as for CVE-2026-11979

Threats

Impact moderate

References

12 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/s…	self
https://www.suse.com/support/update/announcement/…	self
https://lists.suse.com/pipermail/sle-updates/2026…	self
https://bugzilla.suse.com/1262719	self
https://bugzilla.suse.com/1269790	self
https://www.suse.com/security/cve/CVE-2026-11979/	self
https://www.suse.com/security/cve/CVE-2026-6732/	self
https://www.suse.com/security/cve/CVE-2026-11979	external
https://bugzilla.suse.com/1269790	external
https://www.suse.com/security/cve/CVE-2026-6732	external
https://bugzilla.suse.com/1262719	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for libxml2",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for libxml2 fixes the following issues\n\n- CVE-2026-6732: crafted XSD-validated document can cause a denial of service (bsc#1262719).\n- CVE-2026-11979: stack-based buffer overflows in the `xmlcatalog` utility when running in `--shell` mode (bsc#1269790).\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-SL-Micro-6.2-1220",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_22596-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2026:22596-1",
        "url": "https://www.suse.com/support/update/announcement/2026/suse-su-202622596-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2026:22596-1",
        "url": "https://lists.suse.com/pipermail/sle-updates/2026-July/048277.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1262719",
        "url": "https://bugzilla.suse.com/1262719"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1269790",
        "url": "https://bugzilla.suse.com/1269790"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-11979 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-11979/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-6732 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-6732/"
      }
    ],
    "title": "Security update for libxml2",
    "tracking": {
      "current_release_date": "2026-10-15T17:09:18Z",
      "generator": {
        "date": "2026-07-13T07:52:15Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2026:22596-1",
      "initial_release_date": "2026-07-13T07:52:15Z",
      "revision_history": [
        {
          "date": "2026-07-13T07:52:15Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-09-16T19:14:21Z",
          "number": "2",
          "summary": "unknown changes"
        },
        {
          "date": "2026-09-16T20:03:11Z",
          "number": "3",
          "summary": "unknown changes"
        },
        {
          "date": "2026-09-17T16:00:48Z",
          "number": "4",
          "summary": "unknown changes"
        },
        {
          "date": "2026-10-12T17:26:37Z",
          "number": "5",
          "summary": "unknown changes"
        },
        {
          "date": "2026-10-15T17:09:18Z",
          "number": "6",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "6"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libxml2-2-0:2.13.8-160000.5.1.aarch64",
                "product": {
                  "name": "libxml2-2-0:2.13.8-160000.5.1.aarch64",
                  "product_id": "libxml2-2-0:2.13.8-160000.5.1.aarch64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:xmlsoft:libxml2:2.13.8:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/libxml2-2@2.13.8-160000.5.1?arch=aarch64\u0026upstream=libxml2-0:2.13.8-160000.5.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libxml2-tools-0:2.13.8-160000.5.1.aarch64",
                "product": {
                  "name": "libxml2-tools-0:2.13.8-160000.5.1.aarch64",
                  "product_id": "libxml2-tools-0:2.13.8-160000.5.1.aarch64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:xmlsoft:libxml2:2.13.8:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/libxml2-tools@2.13.8-160000.5.1?arch=aarch64\u0026upstream=libxml2-0:2.13.8-160000.5.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python313-libxml2-0:2.13.8-160000.5.1.aarch64",
                "product": {
                  "name": "python313-libxml2-0:2.13.8-160000.5.1.aarch64",
                  "product_id": "python313-libxml2-0:2.13.8-160000.5.1.aarch64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:xmlsoft:libxml2:2.13.8:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/python313-libxml2@2.13.8-160000.5.1?arch=aarch64\u0026upstream=libxml2-0:2.13.8-160000.5.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libxml2-2-0:2.13.8-160000.5.1.ppc64le",
                "product": {
                  "name": "libxml2-2-0:2.13.8-160000.5.1.ppc64le",
                  "product_id": "libxml2-2-0:2.13.8-160000.5.1.ppc64le",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:xmlsoft:libxml2:2.13.8:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/libxml2-2@2.13.8-160000.5.1?arch=ppc64le\u0026upstream=libxml2-0:2.13.8-160000.5.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libxml2-tools-0:2.13.8-160000.5.1.ppc64le",
                "product": {
                  "name": "libxml2-tools-0:2.13.8-160000.5.1.ppc64le",
                  "product_id": "libxml2-tools-0:2.13.8-160000.5.1.ppc64le",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:xmlsoft:libxml2:2.13.8:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/libxml2-tools@2.13.8-160000.5.1?arch=ppc64le\u0026upstream=libxml2-0:2.13.8-160000.5.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python313-libxml2-0:2.13.8-160000.5.1.ppc64le",
                "product": {
                  "name": "python313-libxml2-0:2.13.8-160000.5.1.ppc64le",
                  "product_id": "python313-libxml2-0:2.13.8-160000.5.1.ppc64le",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:xmlsoft:libxml2:2.13.8:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/python313-libxml2@2.13.8-160000.5.1?arch=ppc64le\u0026upstream=libxml2-0:2.13.8-160000.5.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libxml2-2-0:2.13.8-160000.5.1.s390x",
                "product": {
                  "name": "libxml2-2-0:2.13.8-160000.5.1.s390x",
                  "product_id": "libxml2-2-0:2.13.8-160000.5.1.s390x",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:xmlsoft:libxml2:2.13.8:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/libxml2-2@2.13.8-160000.5.1?arch=s390x\u0026upstream=libxml2-0:2.13.8-160000.5.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libxml2-tools-0:2.13.8-160000.5.1.s390x",
                "product": {
                  "name": "libxml2-tools-0:2.13.8-160000.5.1.s390x",
                  "product_id": "libxml2-tools-0:2.13.8-160000.5.1.s390x",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:xmlsoft:libxml2:2.13.8:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/libxml2-tools@2.13.8-160000.5.1?arch=s390x\u0026upstream=libxml2-0:2.13.8-160000.5.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python313-libxml2-0:2.13.8-160000.5.1.s390x",
                "product": {
                  "name": "python313-libxml2-0:2.13.8-160000.5.1.s390x",
                  "product_id": "python313-libxml2-0:2.13.8-160000.5.1.s390x",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:xmlsoft:libxml2:2.13.8:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/python313-libxml2@2.13.8-160000.5.1?arch=s390x\u0026upstream=libxml2-0:2.13.8-160000.5.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libxml2-2-0:2.13.8-160000.5.1.x86_64",
                "product": {
                  "name": "libxml2-2-0:2.13.8-160000.5.1.x86_64",
                  "product_id": "libxml2-2-0:2.13.8-160000.5.1.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:xmlsoft:libxml2:2.13.8:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/libxml2-2@2.13.8-160000.5.1?arch=x86_64\u0026upstream=libxml2-0:2.13.8-160000.5.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libxml2-tools-0:2.13.8-160000.5.1.x86_64",
                "product": {
                  "name": "libxml2-tools-0:2.13.8-160000.5.1.x86_64",
                  "product_id": "libxml2-tools-0:2.13.8-160000.5.1.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:xmlsoft:libxml2:2.13.8:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/libxml2-tools@2.13.8-160000.5.1?arch=x86_64\u0026upstream=libxml2-0:2.13.8-160000.5.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python313-libxml2-0:2.13.8-160000.5.1.x86_64",
                "product": {
                  "name": "python313-libxml2-0:2.13.8-160000.5.1.x86_64",
                  "product_id": "python313-libxml2-0:2.13.8-160000.5.1.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:xmlsoft:libxml2:2.13.8:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/python313-libxml2@2.13.8-160000.5.1?arch=x86_64\u0026upstream=libxml2-0:2.13.8-160000.5.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Micro 6.2",
                "product": {
                  "name": "SUSE Linux Micro 6.2",
                  "product_id": "SUSE Linux Micro 6.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sl-micro:6.2"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxml2-2-0:2.13.8-160000.5.1.aarch64 as component of SUSE Linux Micro 6.2",
          "product_id": "SUSE Linux Micro 6.2:libxml2-2-0:2.13.8-160000.5.1.aarch64"
        },
        "product_reference": "libxml2-2-0:2.13.8-160000.5.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Micro 6.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxml2-2-0:2.13.8-160000.5.1.ppc64le as component of SUSE Linux Micro 6.2",
          "product_id": "SUSE Linux Micro 6.2:libxml2-2-0:2.13.8-160000.5.1.ppc64le"
        },
        "product_reference": "libxml2-2-0:2.13.8-160000.5.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Micro 6.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxml2-2-0:2.13.8-160000.5.1.s390x as component of SUSE Linux Micro 6.2",
          "product_id": "SUSE Linux Micro 6.2:libxml2-2-0:2.13.8-160000.5.1.s390x"
        },
        "product_reference": "libxml2-2-0:2.13.8-160000.5.1.s390x",
        "relates_to_product_reference": "SUSE Linux Micro 6.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxml2-2-0:2.13.8-160000.5.1.x86_64 as component of SUSE Linux Micro 6.2",
          "product_id": "SUSE Linux Micro 6.2:libxml2-2-0:2.13.8-160000.5.1.x86_64"
        },
        "product_reference": "libxml2-2-0:2.13.8-160000.5.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Micro 6.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxml2-tools-0:2.13.8-160000.5.1.aarch64 as component of SUSE Linux Micro 6.2",
          "product_id": "SUSE Linux Micro 6.2:libxml2-tools-0:2.13.8-160000.5.1.aarch64"
        },
        "product_reference": "libxml2-tools-0:2.13.8-160000.5.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Micro 6.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxml2-tools-0:2.13.8-160000.5.1.ppc64le as component of SUSE Linux Micro 6.2",
          "product_id": "SUSE Linux Micro 6.2:libxml2-tools-0:2.13.8-160000.5.1.ppc64le"
        },
        "product_reference": "libxml2-tools-0:2.13.8-160000.5.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Micro 6.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxml2-tools-0:2.13.8-160000.5.1.s390x as component of SUSE Linux Micro 6.2",
          "product_id": "SUSE Linux Micro 6.2:libxml2-tools-0:2.13.8-160000.5.1.s390x"
        },
        "product_reference": "libxml2-tools-0:2.13.8-160000.5.1.s390x",
        "relates_to_product_reference": "SUSE Linux Micro 6.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxml2-tools-0:2.13.8-160000.5.1.x86_64 as component of SUSE Linux Micro 6.2",
          "product_id": "SUSE Linux Micro 6.2:libxml2-tools-0:2.13.8-160000.5.1.x86_64"
        },
        "product_reference": "libxml2-tools-0:2.13.8-160000.5.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Micro 6.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-libxml2-0:2.13.8-160000.5.1.aarch64 as component of SUSE Linux Micro 6.2",
          "product_id": "SUSE Linux Micro 6.2:python313-libxml2-0:2.13.8-160000.5.1.aarch64"
        },
        "product_reference": "python313-libxml2-0:2.13.8-160000.5.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Micro 6.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-libxml2-0:2.13.8-160000.5.1.ppc64le as component of SUSE Linux Micro 6.2",
          "product_id": "SUSE Linux Micro 6.2:python313-libxml2-0:2.13.8-160000.5.1.ppc64le"
        },
        "product_reference": "python313-libxml2-0:2.13.8-160000.5.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Micro 6.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-libxml2-0:2.13.8-160000.5.1.s390x as component of SUSE Linux Micro 6.2",
          "product_id": "SUSE Linux Micro 6.2:python313-libxml2-0:2.13.8-160000.5.1.s390x"
        },
        "product_reference": "python313-libxml2-0:2.13.8-160000.5.1.s390x",
        "relates_to_product_reference": "SUSE Linux Micro 6.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-libxml2-0:2.13.8-160000.5.1.x86_64 as component of SUSE Linux Micro 6.2",
          "product_id": "SUSE Linux Micro 6.2:python313-libxml2-0:2.13.8-160000.5.1.x86_64"
        },
        "product_reference": "python313-libxml2-0:2.13.8-160000.5.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Micro 6.2"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-11979",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-11979"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "libxml2 is vulnerable to multiple stack-based buffer overflows in the xmlcatalog utility when running in --shell mode. The usershell() function processes user input using fixed-size stack buffers without proper bounds checking.\nBy supplying an overly long input line, an attacker can overflow internal buffers (command, arg, and argv) during input parsing. This results in memory corruption within the stack frame.\nSuccessful exploitation may cause a crash or potentially allow arbitrary code execution in the context of the xmlcatalog process.\n\nThis issue has been fixed in the commit c2e233fc.\n\nNOTE:\nThe maintainers of this project did not agree that this issue is a vulnerability and considered it a bug.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.2:libxml2-2-0:2.13.8-160000.5.1.aarch64",
          "SUSE Linux Micro 6.2:libxml2-2-0:2.13.8-160000.5.1.ppc64le",
          "SUSE Linux Micro 6.2:libxml2-2-0:2.13.8-160000.5.1.s390x",
          "SUSE Linux Micro 6.2:libxml2-2-0:2.13.8-160000.5.1.x86_64",
          "SUSE Linux Micro 6.2:libxml2-tools-0:2.13.8-160000.5.1.aarch64",
          "SUSE Linux Micro 6.2:libxml2-tools-0:2.13.8-160000.5.1.ppc64le",
          "SUSE Linux Micro 6.2:libxml2-tools-0:2.13.8-160000.5.1.s390x",
          "SUSE Linux Micro 6.2:libxml2-tools-0:2.13.8-160000.5.1.x86_64",
          "SUSE Linux Micro 6.2:python313-libxml2-0:2.13.8-160000.5.1.aarch64",
          "SUSE Linux Micro 6.2:python313-libxml2-0:2.13.8-160000.5.1.ppc64le",
          "SUSE Linux Micro 6.2:python313-libxml2-0:2.13.8-160000.5.1.s390x",
          "SUSE Linux Micro 6.2:python313-libxml2-0:2.13.8-160000.5.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-11979",
          "url": "https://www.suse.com/security/cve/CVE-2026-11979"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1269790 for CVE-2026-11979",
          "url": "https://bugzilla.suse.com/1269790"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.2:libxml2-2-0:2.13.8-160000.5.1.aarch64",
            "SUSE Linux Micro 6.2:libxml2-2-0:2.13.8-160000.5.1.ppc64le",
            "SUSE Linux Micro 6.2:libxml2-2-0:2.13.8-160000.5.1.s390x",
            "SUSE Linux Micro 6.2:libxml2-2-0:2.13.8-160000.5.1.x86_64",
            "SUSE Linux Micro 6.2:libxml2-tools-0:2.13.8-160000.5.1.aarch64",
            "SUSE Linux Micro 6.2:libxml2-tools-0:2.13.8-160000.5.1.ppc64le",
            "SUSE Linux Micro 6.2:libxml2-tools-0:2.13.8-160000.5.1.s390x",
            "SUSE Linux Micro 6.2:libxml2-tools-0:2.13.8-160000.5.1.x86_64",
            "SUSE Linux Micro 6.2:python313-libxml2-0:2.13.8-160000.5.1.aarch64",
            "SUSE Linux Micro 6.2:python313-libxml2-0:2.13.8-160000.5.1.ppc64le",
            "SUSE Linux Micro 6.2:python313-libxml2-0:2.13.8-160000.5.1.s390x",
            "SUSE Linux Micro 6.2:python313-libxml2-0:2.13.8-160000.5.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.2:libxml2-2-0:2.13.8-160000.5.1.aarch64",
            "SUSE Linux Micro 6.2:libxml2-2-0:2.13.8-160000.5.1.ppc64le",
            "SUSE Linux Micro 6.2:libxml2-2-0:2.13.8-160000.5.1.s390x",
            "SUSE Linux Micro 6.2:libxml2-2-0:2.13.8-160000.5.1.x86_64",
            "SUSE Linux Micro 6.2:libxml2-tools-0:2.13.8-160000.5.1.aarch64",
            "SUSE Linux Micro 6.2:libxml2-tools-0:2.13.8-160000.5.1.ppc64le",
            "SUSE Linux Micro 6.2:libxml2-tools-0:2.13.8-160000.5.1.s390x",
            "SUSE Linux Micro 6.2:libxml2-tools-0:2.13.8-160000.5.1.x86_64",
            "SUSE Linux Micro 6.2:python313-libxml2-0:2.13.8-160000.5.1.aarch64",
            "SUSE Linux Micro 6.2:python313-libxml2-0:2.13.8-160000.5.1.ppc64le",
            "SUSE Linux Micro 6.2:python313-libxml2-0:2.13.8-160000.5.1.s390x",
            "SUSE Linux Micro 6.2:python313-libxml2-0:2.13.8-160000.5.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-13T07:52:15Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-11979"
    },
    {
      "cve": "CVE-2026-6732",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-6732"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was found in libxml2. This vulnerability occurs when the library processes a specially crafted XML Schema Definition (XSD) validated document that includes an internal entity reference. An attacker could exploit this by providing a malicious document, leading to a type confusion error that causes the application to crash. This results in a denial of service (DoS), making the affected system or application unavailable.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.2:libxml2-2-0:2.13.8-160000.5.1.aarch64",
          "SUSE Linux Micro 6.2:libxml2-2-0:2.13.8-160000.5.1.ppc64le",
          "SUSE Linux Micro 6.2:libxml2-2-0:2.13.8-160000.5.1.s390x",
          "SUSE Linux Micro 6.2:libxml2-2-0:2.13.8-160000.5.1.x86_64",
          "SUSE Linux Micro 6.2:libxml2-tools-0:2.13.8-160000.5.1.aarch64",
          "SUSE Linux Micro 6.2:libxml2-tools-0:2.13.8-160000.5.1.ppc64le",
          "SUSE Linux Micro 6.2:libxml2-tools-0:2.13.8-160000.5.1.s390x",
          "SUSE Linux Micro 6.2:libxml2-tools-0:2.13.8-160000.5.1.x86_64",
          "SUSE Linux Micro 6.2:python313-libxml2-0:2.13.8-160000.5.1.aarch64",
          "SUSE Linux Micro 6.2:python313-libxml2-0:2.13.8-160000.5.1.ppc64le",
          "SUSE Linux Micro 6.2:python313-libxml2-0:2.13.8-160000.5.1.s390x",
          "SUSE Linux Micro 6.2:python313-libxml2-0:2.13.8-160000.5.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-6732",
          "url": "https://www.suse.com/security/cve/CVE-2026-6732"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1262719 for CVE-2026-6732",
          "url": "https://bugzilla.suse.com/1262719"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.2:libxml2-2-0:2.13.8-160000.5.1.aarch64",
            "SUSE Linux Micro 6.2:libxml2-2-0:2.13.8-160000.5.1.ppc64le",
            "SUSE Linux Micro 6.2:libxml2-2-0:2.13.8-160000.5.1.s390x",
            "SUSE Linux Micro 6.2:libxml2-2-0:2.13.8-160000.5.1.x86_64",
            "SUSE Linux Micro 6.2:libxml2-tools-0:2.13.8-160000.5.1.aarch64",
            "SUSE Linux Micro 6.2:libxml2-tools-0:2.13.8-160000.5.1.ppc64le",
            "SUSE Linux Micro 6.2:libxml2-tools-0:2.13.8-160000.5.1.s390x",
            "SUSE Linux Micro 6.2:libxml2-tools-0:2.13.8-160000.5.1.x86_64",
            "SUSE Linux Micro 6.2:python313-libxml2-0:2.13.8-160000.5.1.aarch64",
            "SUSE Linux Micro 6.2:python313-libxml2-0:2.13.8-160000.5.1.ppc64le",
            "SUSE Linux Micro 6.2:python313-libxml2-0:2.13.8-160000.5.1.s390x",
            "SUSE Linux Micro 6.2:python313-libxml2-0:2.13.8-160000.5.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.2:libxml2-2-0:2.13.8-160000.5.1.aarch64",
            "SUSE Linux Micro 6.2:libxml2-2-0:2.13.8-160000.5.1.ppc64le",
            "SUSE Linux Micro 6.2:libxml2-2-0:2.13.8-160000.5.1.s390x",
            "SUSE Linux Micro 6.2:libxml2-2-0:2.13.8-160000.5.1.x86_64",
            "SUSE Linux Micro 6.2:libxml2-tools-0:2.13.8-160000.5.1.aarch64",
            "SUSE Linux Micro 6.2:libxml2-tools-0:2.13.8-160000.5.1.ppc64le",
            "SUSE Linux Micro 6.2:libxml2-tools-0:2.13.8-160000.5.1.s390x",
            "SUSE Linux Micro 6.2:libxml2-tools-0:2.13.8-160000.5.1.x86_64",
            "SUSE Linux Micro 6.2:python313-libxml2-0:2.13.8-160000.5.1.aarch64",
            "SUSE Linux Micro 6.2:python313-libxml2-0:2.13.8-160000.5.1.ppc64le",
            "SUSE Linux Micro 6.2:python313-libxml2-0:2.13.8-160000.5.1.s390x",
            "SUSE Linux Micro 6.2:python313-libxml2-0:2.13.8-160000.5.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-13T07:52:15Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-6732"
    }
  ]
}

CVE-2026-11979 (GCVE-0-2026-11979)

Vulnerability from cvelistv5 – Published: 2026-06-29 13:21 – Updated: 2026-06-29 13:59 X_Open Source Disputed

Title

Stack-Based Buffer Overflow in libxml2

Summary

libxml2 is vulnerable to multiple stack-based buffer overflows in the xmlcatalog utility when running in --shell mode. The usershell() function processes user input using fixed-size stack buffers without proper bounds checking. By supplying an overly long input line, an attacker can overflow internal buffers (command, arg, and argv) during input parsing. This results in memory corruption within the stack frame. Successful exploitation may cause a crash or potentially allow arbitrary code execution in the context of the xmlcatalog process. This issue has been fixed in the commit c2e233fc. NOTE: The maintainers of this project did not agree that this issue is a vulnerability and considered it a bug.

Severity

1.8 (Low)


                        
                          CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:L/SI:L/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-29 13:59 UTC

CWE

CWE-121 - Stack-based Buffer Overflow

Assigner

CERT-PL CNA under the ENISA root

CNA scorecard B 81/100 over 257 records in the last 180 days details

References

2 references

URL	Tags
https://cert.pl/en/posts/2026/06/CVE-2026-11979	third-party-advisory
https://gitlab.gnome.org/GNOME/libxml2/-/commit/c…	patch

Impacted products

1 product

Vendor	Product	Version
xmlsoft	libxml2	Affected: 0 , ≤ 2.15.3 (custom)

Credits

Michał Majchrowicz (AFINE Team) Marcin Wyczechowski (AFINE Team)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-11979",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-29T13:59:12.311421Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-29T13:59:18.501Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "xmlcatalog"
          ],
          "product": "libxml2",
          "repo": "https://gitlab.gnome.org/GNOME/libxml2/",
          "vendor": "xmlsoft",
          "versions": [
            {
              "lessThanOrEqual": "2.15.3",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Micha\u0142 Majchrowicz (AFINE Team)"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Marcin Wyczechowski (AFINE Team)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "libxml2 is vulnerable to multiple stack-based buffer overflows in the xmlcatalog utility when running in --shell mode. The usershell() function processes user input using fixed-size stack buffers without proper bounds checking.\u003cbr\u003eBy supplying an overly long input line, an attacker can overflow internal buffers (command, arg, and argv) during input parsing. This results in memory corruption within the stack frame.\u003cbr\u003eSuccessful exploitation may cause a crash or potentially allow arbitrary code execution in the context of the xmlcatalog process.\u003cbr\u003e\u003cbr\u003eThis issue has been fixed in the commit c2e233fc.\u003cbr\u003e\u003cbr\u003eNOTE:\u003cbr\u003eThe maintainers of this project did not agree that this issue is a vulnerability and considered it a bug.\u003cbr\u003e"
            }
          ],
          "value": "libxml2 is vulnerable to multiple stack-based buffer overflows in the xmlcatalog utility when running in --shell mode. The usershell() function processes user input using fixed-size stack buffers without proper bounds checking.\nBy supplying an overly long input line, an attacker can overflow internal buffers (command, arg, and argv) during input parsing. This results in memory corruption within the stack frame.\nSuccessful exploitation may cause a crash or potentially allow arbitrary code execution in the context of the xmlcatalog process.\n\nThis issue has been fixed in the commit c2e233fc.\n\nNOTE:\nThe maintainers of this project did not agree that this issue is a vulnerability and considered it a bug."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-253",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-253 Remote Code Inclusion"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 1.8,
            "baseSeverity": "LOW",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-121",
              "description": "CWE-121: Stack-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-29T13:21:42.697Z",
        "orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6",
        "shortName": "CERT-PL"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://cert.pl/en/posts/2026/06/CVE-2026-11979"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://gitlab.gnome.org/GNOME/libxml2/-/commit/c2e233fc1b341685fc99621b2768b503f777a72e"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "tags": [
        "x_open-source",
        "disputed"
      ],
      "title": "Stack-Based Buffer Overflow in libxml2",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6",
    "assignerShortName": "CERT-PL",
    "cveId": "CVE-2026-11979",
    "datePublished": "2026-06-29T13:21:42.697Z",
    "dateReserved": "2026-06-11T13:20:24.839Z",
    "dateUpdated": "2026-06-29T13:59:18.501Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-6732 (GCVE-0-2026-6732)

Vulnerability from cvelistv5 – Published: 2026-04-23 22:19 – Updated: 2026-11-05 22:11

Title

Libxml2: libxml2: denial of service via crafted xsd-validated document

Summary

A flaw was found in libxml2. This vulnerability occurs when the library processes a specially crafted XML Schema Definition (XSD) validated document that includes an internal entity reference. An attacker could exploit this by providing a malicious document, leading to a type confusion error that causes the application to crash. This results in a denial of service (DoS), making the affected system or application unavailable.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-04-24 10:53 UTC

CWE

CWE-843 - Access of Resource Using Incompatible Type

Assigner

redhat CNA under the redhat root

CNA scorecard B 82/100 over 1206 records in the last 180 days details

References

5 references

URL	Tags
https://access.redhat.com/errata/RHSA-2026:11503	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-6732	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2461300	issue-trackingx_refsource_REDHAT
https://gitlab.gnome.org/GNOME/libxml2/-/issues/1097
https://gitlab.gnome.org/GNOME/libxml2/-/merge_re…

Impacted products

8 products

Vendor	Product	Version
Red Hat	Red Hat Hardened Images	Unaffected: 2.15.3-0.1.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat Enterprise Linux 10	cpe:/a:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:rhel_els:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:rhel_els:7
Red Hat	Red Hat Enterprise Linux 8	cpe:/a:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	cpe:/a:redhat:enterprise_linux:9
Red Hat	Red Hat JBoss Core Services	cpe:/a:redhat:jboss_core_services:1
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4

Date Public

2026-04-16 00:00

Credits

Red Hat would like to thank Ariel Schon for reporting this issue.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-6732",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-24T10:53:00.163293Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-24T10:54:21.129Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:hummingbird:1"
          ],
          "defaultStatus": "affected",
          "packageName": "libxml2-main",
          "product": "Red Hat Hardened Images",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2.15.3-0.1.hum1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "unaffected",
          "packageName": "libxml2",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:rhel_els:6"
          ],
          "defaultStatus": "unaffected",
          "packageName": "libxml2",
          "product": "Red Hat Enterprise Linux 6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:rhel_els:7"
          ],
          "defaultStatus": "unaffected",
          "packageName": "libxml2",
          "product": "Red Hat Enterprise Linux 7",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "unaffected",
          "packageName": "libxml2",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "unaffected",
          "packageName": "libxml2",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
          "cpes": [
            "cpe:/a:redhat:jboss_core_services:1"
          ],
          "defaultStatus": "affected",
          "packageName": "libxml2",
          "product": "Red Hat JBoss Core Services",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "unaffected",
          "packageName": "openshift/ose-rhel-coreos-8",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "unaffected",
          "packageName": "openshift/ose-rhel-coreos-9",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank Ariel Schon for reporting this issue."
        }
      ],
      "datePublic": "2026-04-16T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in libxml2. This vulnerability occurs when the library processes a specially crafted XML Schema Definition (XSD) validated document that includes an internal entity reference. An attacker could exploit this by providing a malicious document, leading to a type confusion error that causes the application to crash. This results in a denial of service (DoS), making the affected system or application unavailable."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-843",
              "description": "Access of Resource Using Incompatible Type",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-05T22:11:35.689Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2026:11503",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:11503"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-6732"
        },
        {
          "name": "RHBZ#2461300",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461300"
        },
        {
          "url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/1097"
        },
        {
          "url": "https://gitlab.gnome.org/GNOME/libxml2/-/merge_requests/411"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-04-23T22:04:33.973Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-04-16T00:00:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Libxml2: libxml2: denial of service via crafted xsd-validated document",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-843: Access of Resource Using Incompatible Type"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-6732",
    "datePublished": "2026-04-23T22:19:34.322Z",
    "dateReserved": "2026-04-20T22:34:45.863Z",
    "dateUpdated": "2026-11-05T22:11:35.689Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

SUSE-SU-2026:22596-1

CVE-2026-11979 (GCVE-0-2026-11979)

CVE-2026-6732 (GCVE-0-2026-6732)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour