Hardened Images
CVE-2026-0992
LOW
Severity by source
AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Primary rating from Vendor (redhat) · only source for this CVE.
CVSS VectorVendor: redhat
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in the libxml2 library. This uncontrolled resource consumption vulnerability occurs when processing XML catalogs that contain repeated <nextCatalog> elements pointing to the same downstream catalog. A remote attacker can exploit this by supplying crafted catalogs, causing the parser to redundantly traverse catalog chains. This leads to excessive CPU consumption and degrades application availability, resulting in a denial-of-service condition.
AnalysisAI
A flaw was found in the libxml2 library. This uncontrolled resource consumption vulnerability occurs when processing XML catalogs that contain repeated <nextCatalog> elements pointing to the same downstream catalog. [CVSS 2.9 LOW]
Technical ContextAI
Classified as CWE-400 (Uncontrolled Resource Consumption). A flaw was found in the libxml2 library. This uncontrolled resource consumption vulnerability occurs when processing XML catalogs that contain repeated <nextCatalog> elements pointing to the same downstream catalog. A remote attacker can exploit this by supplying crafted catalogs, causing the parser to redundantly traverse catalog chains. This leads to excessive CPU consumption and degrades application availability, resulting in a denial-of-service condition.
RemediationAI
Monitor vendor advisories for a patch.
More in Hardened Images
View allAuthentication bypass in GnuTLS affects servers that enable the RSA-PSK key exchange, where the PSK identity comparison
Denial of service in GnuTLS affects the Datagram Transport Layer Security (DTLS) packet reordering logic, where the comp
Stack-based buffer overflow in libssh's SFTP server allows a connected client to crash the server or potentially execute
Libarchive fails to properly validate the pz_log2_bs field in ISO9660 Rock Ridge extensions during zisofs decompression,
Heap-based buffer overflow in libsolv's repo_add_solv() function enables a remote unauthenticated attacker to crash the
Stack-based buffer overflow in libsolv's Debian metadata parser allows remote, unauthenticated attackers to cause a deni
libxml2's xmlCatalogXMLResolveURI function is vulnerable to uncontrolled recursion when processing self-referencing dele
Shell metacharacter injection in libssh's ProxyCommand handling allows a crafted SSH username to break out of the intend
A flaw was identified in the RelaxNG parser of libxml2 related to how external schema inclusions are handled. The parser
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today