CVE-2026-0992
LowCVSS 2.9Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
A flaw was found in the libxml2 library where uncontrolled resource consumption occurs when processing XML catalogs with repeated <nextCatalog> elements pointing to the same downstream catalog. A remote attacker can exploit this by supplying crafted catalogs, causing redundant traversal of catalog chains.
Risk Assessment
Exploitation leads to excessive CPU consumption, significantly degrading application availability and resulting in a denial-of-service (DoS) condition.
Recommendation
Update libxml2 to the latest patched version immediately. If updating is not possible, restrict processing of untrusted XML catalogs.
Other vulnerabilities in libxml2
See all- CVE-2017-7013High
An issue was discovered in certain Apple products related to the 'libxml2' component. Affects iOS before 10.3.3, macOS before 10.12.6, iCloud before 6.2.2 on Windows, iTunes before 12.6.2 on Windows, tvOS before 10.2.2, and watchOS before 3.2.3.
- CVE-2017-7010High
An issue was discovered in certain Apple products related to the 'libxml2' component. It affects iOS before 10.3.3, macOS before 10.12.6, iCloud before 6.2.2 on Windows, iTunes before 12.6.2 on Windows, and tvOS before 10.2.2.
- CVE-2016-4483High
The xmlBufAttrSerializeTxtContent function in xmlsave.c in libxml2 allows context-dependent attackers to cause a denial of service (out-of-bounds read and application crash) via a non-UTF-8 attribute value, related to serialization.
- CVE-2016-4449High
CVE-2016-4449 describes an XXE vulnerability in the xmlStringLenDecodeEntities function in parser.c in libxml2 before version 2.9.4. This vulnerability, when not in validating mode, allows attackers to read arbitrary files or cause denial of service through unspecified vectors.
- CVE-2016-4447High
The xmlParseElementDecl function in libxml2 before version 2.9.4 allows context-dependent attackers to cause a denial of service via a crafted file, resulting in heap-based buffer underread and application crash.
- CVE-2016-1840High
Heap-based buffer overflow in the xmlFAParsePosCharGroup function in libxml2 before version 2.9.4 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted XML document.
- CVE-2016-1835High
Use-after-free vulnerability in the xmlSAX2AttributeNs function in libxml2 before version 2.9.4, as used in Apple iOS before 9.3.2 and OS X before 10.11.5, allows remote attackers to cause a denial of service via a crafted XML document.
- CVE-2016-1834High
Heap-based buffer overflow in the xmlStrncat function in libxml2 before version 2.9.4, used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted XML document.
- CVE-2016-3705High
The xmlParserEntityCheck and xmlParseAttValueComplex functions in libxml2 2.9.3 do not properly keep track of the recursion depth, allowing context-dependent attackers to cause a denial of service via a crafted XML document containing a large number of nested entity references.
- CVE-2016-3627High
The xmlStringGetNodeList function in libxml2 version 2.9.3 and earlier, when used in recovery mode, allows context-dependent attackers to cause a denial of service through a crafted XML document, leading to infinite recursion, stack consumption, and application crash.
Original NVD description (English source)
A flaw was found in the libxml2 library. This uncontrolled resource consumption vulnerability occurs when processing XML catalogs that contain repeated <nextCatalog> elements pointing to the same downstream catalog. A remote attacker can exploit this by supplying crafted catalogs, causing the parser to redundantly traverse catalog chains. This leads to excessive CPU consumption and degrades application availability, resulting in a denial-of-service condition.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS