CVE-2026-86144
MediumCVSS 5.6Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
In libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, the XML_PARSE_NONET flag, if (without it) a custom resource loader accesses the internet and triggers XML external entity injection, SSRF, or a denial of service.
Risk Assessment
Applications using libxml2 may be vulnerable to SSRF, XML external entity injection, or DoS if they process untrusted XML documents with XInclude.
Recommendation
Upgrade libxml2 to version 2.15.4 or later and explicitly set parse flags.
Other vulnerabilities in libxml2
See all- CVE-2017-16932High
The parser.c file in libxml2 before version 2.9.5 does not prevent infinite recursion in parameter entities.
- CVE-2017-7013High
An issue was discovered in certain Apple products related to the 'libxml2' component. Affects iOS before 10.3.3, macOS before 10.12.6, iCloud before 6.2.2 on Windows, iTunes before 12.6.2 on Windows, tvOS before 10.2.2, and watchOS before 3.2.3.
- CVE-2017-7010High
An issue was discovered in certain Apple products related to the 'libxml2' component. It affects iOS before 10.3.3, macOS before 10.12.6, iCloud before 6.2.2 on Windows, iTunes before 12.6.2 on Windows, and tvOS before 10.2.2.
- CVE-2017-0663High
A remote code execution vulnerability in libxml2 could allow an attacker to execute arbitrary code within the context of an unprivileged process. This issue affects applications using this library on Android.
- CVE-2017-9050High
libxml2 version 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictAddString function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. The issue exists due to an incomplete fix for CVE-2016-1839.
- CVE-2017-9049High
libxml2 version 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictComputeFastKey function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash.
- CVE-2017-9048High
libxml2 version 20904-GITv2.9.4-16-g0741801 is vulnerable to a stack-based buffer overflow. The function xmlSnprintfElementContent in valid.c may strcat two more characters to the buffer without checking if the size allows it.
- CVE-2017-9047High
A buffer overflow was discovered in the libxml2 library in the xmlSnprintfElementContent function, which can lead to writing data beyond allocated memory. The issue arises when the buffer length check does not account for the updated length after appending the prefix.
- CVE-2016-4483High
The xmlBufAttrSerializeTxtContent function in xmlsave.c in libxml2 allows context-dependent attackers to cause a denial of service (out-of-bounds read and application crash) via a non-UTF-8 attribute value, related to serialization.
- CVE-2016-4449High
CVE-2016-4449 describes an XXE vulnerability in the xmlStringLenDecodeEntities function in parser.c in libxml2 before version 2.9.4. This vulnerability, when not in validating mode, allows attackers to read arbitrary files or cause denial of service through unspecified vectors.
Original NVD description (English source)
In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, the XML_PARSE_NONET flag, if (without it) a custom resource loader accesses the internet and triggers XML external entity injection, SSRF, or a denial of service (e.g., for an attacker-controlled internet resource that is intentionally slow).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS