Red Hat Security AdvisoryRHSA-2026:7519
Red Hat Hardened Images RPMs bug fix and enhancement update
Released 2026-04-10 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Hardened Images libxml2-16-2.15.2-0.3.hum1@aarch64, libxml2-16-2.15.2-0.3.hum1@x86_64, libxml2-2.15.2-0.3.hum1@aarch64 +8
Fixes 13 records
Priority HIGH 72
A flaw was found in libxml2's xmlBuildQName function, where integer overflows in buffer size calculations can lead to a stack-based buffer overflow.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01367 · Published 2025-06-12 · Partial fix · 2.14.4, 2.12.5-7.el10_0 +21 CWE-787
Priority HIGH 66
In libxml2 before 2.13.8 and 2.14.x before 2.14.2, xmlSchemaIDCFillNodeTables in xmlschemas.c has a heap-based buffer under-read.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0059 · Published 2025-04-17 · Partial fix · 2.13.8, 2.14.2 CWE-1284
Priority HIGH 66
In libxml2 before 2.13.8 and 2.14.x before 2.14.2, out-of-bounds memory access can occur in the Python API (Python bindings) because of an incorrect return value.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00384 · Published 2025-04-08 · Partial fix · 2.13.8, 2.14.2 CWE-393
Priority MEDIUM 48
A vulnerability was found in libxml2.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.01558 · Published 2025-06-16 · Partial fix · 2.15.0, 2.12.5-7.el10_0 +34 CWE-125
Priority MEDIUM 47
A use-after-free vulnerability was found in libxml2.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00833 · Published 2025-06-16 · Partial fix · 2.15.0, 2.12.5-7.el10_0 +33 CWE-825
Priority MEDIUM 40
A NULL pointer dereference vulnerability was found in libxml2 when processing XPath XML expressions.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00592 · Published 2025-06-16 · Partial fix · 2.14.5, 2.12.5-7.el10_0 +1 CWE-825
Priority LOW 28
A flaw was found in libxml2, an XML parsing library.
CVSS 3.1MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.00955 · Published 2026-01-15 · Partial fix · 2.15.2-0.3.hum1 CWE-674
Priority LOW 27
A flaw was identified in the interactive shell of the xmllint utility, part of the libxml2 project, where memory allocated for user input is not properly released under certain conditions.
CVSS 3.1MEDIUM 6.2· Local · No auth · No interaction · EPSS 0.00217 · Published 2026-02-02 · Partial fix · 2.15.2-0.3.hum1 CWE-401
Priority LOW 27
Uncontrolled recursion in XPath evaluation in libxml2 up to and including version 2.9.14 allows a local attacker to cause a stack overflow via crafted expressions.
CVSS 3.1MEDIUM 6.2· Local · No auth · No interaction · EPSS 0.00159 · Published 2025-09-10 · Partial fix · 2.10.0, 2.12.7+dfsg+really2.9.14-0.4ubuntu0.3 +6 CWE-674
Priority LOW 23
In libxml2, there is a possible out of bounds read due to a buffer overflow.
CVSS 3.1MEDIUM 5.5· Local · Low privileges · No interaction · EPSS 0.00081 · Published 2025-09-05 · Fixed CWE-120
Priority LOW 18
A flaw was identified in the RelaxNG parser of libxml2 related to how external schema inclusions are handled.
CVSS 3.1LOW 3.7· Network · No auth · No interaction · EPSS 0.0053 · Published 2026-01-15 · Partial fix · 2.15.2-0.3.hum1 CWE-674
Priority LOW 15
A flaw was found in the libxml2 library.
CVSS 3.1LOW 2.9· Local · No auth · No interaction · EPSS 0.00459 · Published 2026-01-15 · Partial fix · 2.15.2-0.3.hum1 CWE-400
Priority LOW 13
A flaw was found in the interactive shell of the xmllint command-line tool, used for parsing XML files.
CVSS 3.1LOW 2.5· Local · No auth · User interaction · EPSS 0.00323 · Published 2025-06-16 · Partial fix · 2.14.5, 2.12.5-10.el10_2.2 +89 CWE-121
THREATIST.IORead the docs