TI-2026-52582 CVE-2026-74860 · GHSA-8626-cqqj-mfff
Libxml2: double-free/uaf in libxml2 python bindings
Priority MEDIUM 40
A flaw was found in libxml2 with Python bindings enabled.
RHSA-2026:93791
libxml2 security update
Released 2026-11-02 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Server (v. 7 ELS) libxml2-2.9.1-6.el7_9.20, libxml2-2.9.1-6.el7_9.20.ppc, libxml2-devel-2.9.1-6.el7_9.20 +2
- Red Hat Enterprise Linux Server Optional (v. 7 ELS) libxml2-static-2.9.1-6.el7_9.20, libxml2-static-2.9.1-6.el7_9.20.ppc
Fixes 6 records
TI-2026-58934 CVE-2026-86140 · GHSA-6wmc-mmch-49h7
In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-based buffer overflow.
Priority LOW 36
In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-based buffer overflow.
TI-2026-58936 CVE-2026-86142 · GHSA-499q-6rmh-w6p7
Heap-based buffer overflow in xmlsoft libxml2
Priority LOW 35
In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation.
TI-2026-58938 CVE-2026-86144 · GHSA-h6w8-m27h-f268
In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do…
Priority LOW 33
In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags.
TI-2026-58937 CVE-2026-86143 · GHSA-r2q6-6v35-773j
In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and…
Priority LOW 33
In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks, aka a lack of a check for integer overflow before calling writecallback.
TI-2026-58932 CVE-2026-86138 · GHSA-v4gg-2cxp-fc23
In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based buffer overflow.
Priority LOW 33
In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based buffer overflow.