RHSA-2026:90309 — Security Advisory

An update for libxml2 is now available for Red Hat Enterprise Linux 9.6 Extended Update Support.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The libxml2 library is a development toolbox providing the implementation of various XML standards.

Security Fix(es):

• libxml2: mingw-libxml2: libxml2: Denial of Service via crafted XML input due to use-after-free (CVE-2026-6653)

• libxml2: libxml2: Arbitrary code execution in xmlcatalog utility via buffer overflow (CVE-2026-11979)

• libxml2: libxml2: Arbitrary code execution via heap-based buffer overflow (CVE-2026-86138)

• libxml2: libxml2: Data integrity issues due to integer overflow in write callbacks (CVE-2026-86143)

• libxml2: libxml2: Arbitrary code execution via stack-based buffer overflow in xmlSnprintfElements (CVE-2026-86140)

• libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation (CVE-2026-86142)

• libxml2: libxml2: Information disclosure, SSRF, or denial of service due to improper parseFlags propagation. (CVE-2026-86144)

• libxml2: double-free/UAF in libxml2 Python bindings (CVE-2026-74860)

Bug Fix(es) and Enhancement(s):

• sync release version across rhel-9.2/4/6 for libxml2 (JIRA:RHEL-282570)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.