Skip to main content

libxml2 CVE-2026-86144

| EUVDEUVD-2026-71823 MEDIUM
Incorrect Resource Transfer Between Spheres (CWE-669)
2026-09-05 mitre GHSA-h6w8-m27h-f268
Denial Of Service SSRF XXE Red Hat Libxml2 Suse Xmlsoft
5.6
CVSS 3.1 · Vendor: mitre
Share

Severity by source

Vendor (mitre) PRIMARY
5.6 MEDIUM
AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
vuln.today AI
6.5 MEDIUM

AV:N reflects realistic delivery via network-facing XML APIs; AC:H captures the compound prerequisites of XInclude use plus XML_PARSE_NONET reliance; S:C for outbound cross-boundary connections; C/I/A:L for limited SSRF/XXE/DoS impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.6 MEDIUM
qualitative

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector
Local
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
Low

Lifecycle Timeline

4
Patch available
Sep 05, 2026 - 06:01 EUVD
Source Code Evidence Fetched
Sep 05, 2026 - 05:15 vuln.today
Analysis Generated
Sep 05, 2026 - 05:15 vuln.today
CVE Published
Sep 05, 2026 - 04:34 cve.org
MEDIUM 5.6

DescriptionCVE.org

In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, the XML_PARSE_NONET flag, if (without it) a custom resource loader accesses the internet and triggers XML external entity injection, SSRF, or a denial of service (e.g., for an attacker-controlled internet resource that is intentionally slow).

AnalysisAI

Flag-propagation failure in libxml2's XInclude processor before version 2.15.4 allows security-critical parse options - most notably XML_PARSE_NONET, which blocks outbound network entity loading - to be silently discarded when xmlXIncludeProcess or xmlXIncludeProcessTree resolves included sub-documents. Applications that rely on XML_PARSE_NONET as a sandboxing boundary may unknowingly initiate outbound HTTP connections to attacker-controlled hosts, enabling server-side request forgery (SSRF), XML external entity (XXE) data extraction, or denial of service via intentionally slow network responses. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Persist
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires all three of the following simultaneous conditions to be present: (1) the application calls xmlXIncludeProcess() or xmlXIncludeProcessTree() - the zero-flags convenience wrappers - rather than the explicit xmlXIncludeProcessFlags() variant with a caller-supplied flags argument; (2) the application has set XML_PARSE_NONET in the parser context with the intent of preventing network access as a security boundary - applications that do not restrict network access via this flag gain no additional exposure from this bug; and (3) the application processes attacker-influenced XML input containing xi:include elements with external http:// or https:// href targets. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The provided CVSS 5.6 score with vector AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L reflects a moderate, scope-crossing flaw under high-complexity conditions. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Upgrade libxml2 to version 2.15.4 or later, which applies the fix from commit b63cd517afecb76582dd9488c55e54ceaf50de61; the release diff is available at https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Libxml2

View all
CVE-2025-6021 HIGH POC
7.5 Jun 12

Stack-based buffer overflow in libxml2's xmlBuildQName function allows remote unauthenticated attackers to crash affecte
CVE-2016-4658 CRITICAL
9.8 Sep 25

xpointer.c in libxml2 before 2.9.5 (as used in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS befor
CVE-2016-1762 HIGH POC
8.1 Mar 24

The xmlNextChar function in libxml2 before 2.9.4 allows remote attackers to cause a denial of service (heap-based buffer
CVE-2016-1834 HIGH POC
7.8 May 20

Heap-based buffer overflow in the xmlStrncat function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X b
CVE-2016-1840 HIGH POC
7.8 May 20

Heap-based buffer overflow in the xmlFAParsePosCharGroup function in libxml2 before 2.9.4, as used in Apple iOS before 9
CVE-2017-9047 HIGH POC
7.5 May 18

A buffer overflow was discovered in libxml2 20904-GITv2.9.4-16-g0741801. Rated high severity (CVSS 7.5), this vulnerabil
CVE-2016-4447 HIGH POC
7.5 Jun 09

The xmlParseElementDecl function in parser.c in libxml2 before 2.9.4 allows context-dependent attackers to cause a denia
CVE-2017-16932 HIGH
7.5 Nov 23

parser.c in libxml2 before 2.9.5 does not prevent infinite recursion in parameter entities. Rated high severity (CVSS 7.
CVE-2016-4483 HIGH POC
7.5 Apr 11

The xmlBufAttrSerializeTxtContent function in xmlsave.c in libxml2 allows context-dependent attackers to cause a denial

CVE-2013-1969 HIGH POC
7.5 Apr 25

Multiple use-after-free vulnerabilities in libxml2 2.9.0 and possibly other versions might allow context-dependent attac
CVE-2016-1839 MEDIUM POC
5.5 May 20

The xmlDictAddString function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS befo
CVE-2016-1838 MEDIUM POC
5.5 May 20

The xmlPArserPrintFileContextInternal function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 1

Same weakness CWE-669 – Incorrect Resource Transfer Between Spheres

View all
CVE-2026-31431 HIGH POC
7.8
CVE-2020-1048 HIGH POC
7.8
CVE-2020-5800 CRITICAL POC
9.8
CVE-2020-15892 CRITICAL POC
9.8
CVE-2026-25253 HIGH POC
8.8
CVE-2020-25917 HIGH POC
8.8
CVE-2019-13266 HIGH POC
8.8
CVE-2019-13263 HIGH POC
8.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Micro 5.3 Not-Affected
SUSE Linux Enterprise Micro 5.4 Not-Affected
SUSE Linux Enterprise Micro 5.5 Not-Affected

Share

CVE-2026-86144 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy