Vulnerability-Lookup

OPENSUSE-SU-2026:10213-1

Vulnerability from csaf_opensuse - Published: 2026-02-17 00:00 - Updated: 2026-02-17 00:00

Summary

libxml2-16-2.14.5-4.1 on GA media

Notes

Title of the patch

libxml2-16-2.14.5-4.1 on GA media

Description of the patch

These are all security issues fixed in the libxml2-16-2.14.5-4.1 package on the GA media of openSUSE Tumbleweed.

Patchnames

openSUSE-Tumbleweed-2026-10213

CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "libxml2-16-2.14.5-4.1 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the libxml2-16-2.14.5-4.1 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2026-10213",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_10213-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-8732 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-8732/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-0990 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-0990/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-0992 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-0992/"
      }
    ],
    "title": "libxml2-16-2.14.5-4.1 on GA media",
    "tracking": {
      "current_release_date": "2026-02-17T00:00:00Z",
      "generator": {
        "date": "2026-02-17T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:10213-1",
      "initial_release_date": "2026-02-17T00:00:00Z",
      "revision_history": [
        {
          "date": "2026-02-17T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libxml2-16-2.14.5-4.1.aarch64",
                "product": {
                  "name": "libxml2-16-2.14.5-4.1.aarch64",
                  "product_id": "libxml2-16-2.14.5-4.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "libxml2-16-32bit-2.14.5-4.1.aarch64",
                "product": {
                  "name": "libxml2-16-32bit-2.14.5-4.1.aarch64",
                  "product_id": "libxml2-16-32bit-2.14.5-4.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "libxml2-devel-2.14.5-4.1.aarch64",
                "product": {
                  "name": "libxml2-devel-2.14.5-4.1.aarch64",
                  "product_id": "libxml2-devel-2.14.5-4.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "libxml2-devel-32bit-2.14.5-4.1.aarch64",
                "product": {
                  "name": "libxml2-devel-32bit-2.14.5-4.1.aarch64",
                  "product_id": "libxml2-devel-32bit-2.14.5-4.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "libxml2-doc-2.14.5-4.1.aarch64",
                "product": {
                  "name": "libxml2-doc-2.14.5-4.1.aarch64",
                  "product_id": "libxml2-doc-2.14.5-4.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "libxml2-tools-2.14.5-4.1.aarch64",
                "product": {
                  "name": "libxml2-tools-2.14.5-4.1.aarch64",
                  "product_id": "libxml2-tools-2.14.5-4.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libxml2-16-2.14.5-4.1.ppc64le",
                "product": {
                  "name": "libxml2-16-2.14.5-4.1.ppc64le",
                  "product_id": "libxml2-16-2.14.5-4.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "libxml2-16-32bit-2.14.5-4.1.ppc64le",
                "product": {
                  "name": "libxml2-16-32bit-2.14.5-4.1.ppc64le",
                  "product_id": "libxml2-16-32bit-2.14.5-4.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "libxml2-devel-2.14.5-4.1.ppc64le",
                "product": {
                  "name": "libxml2-devel-2.14.5-4.1.ppc64le",
                  "product_id": "libxml2-devel-2.14.5-4.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "libxml2-devel-32bit-2.14.5-4.1.ppc64le",
                "product": {
                  "name": "libxml2-devel-32bit-2.14.5-4.1.ppc64le",
                  "product_id": "libxml2-devel-32bit-2.14.5-4.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "libxml2-doc-2.14.5-4.1.ppc64le",
                "product": {
                  "name": "libxml2-doc-2.14.5-4.1.ppc64le",
                  "product_id": "libxml2-doc-2.14.5-4.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "libxml2-tools-2.14.5-4.1.ppc64le",
                "product": {
                  "name": "libxml2-tools-2.14.5-4.1.ppc64le",
                  "product_id": "libxml2-tools-2.14.5-4.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libxml2-16-2.14.5-4.1.s390x",
                "product": {
                  "name": "libxml2-16-2.14.5-4.1.s390x",
                  "product_id": "libxml2-16-2.14.5-4.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "libxml2-16-32bit-2.14.5-4.1.s390x",
                "product": {
                  "name": "libxml2-16-32bit-2.14.5-4.1.s390x",
                  "product_id": "libxml2-16-32bit-2.14.5-4.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "libxml2-devel-2.14.5-4.1.s390x",
                "product": {
                  "name": "libxml2-devel-2.14.5-4.1.s390x",
                  "product_id": "libxml2-devel-2.14.5-4.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "libxml2-devel-32bit-2.14.5-4.1.s390x",
                "product": {
                  "name": "libxml2-devel-32bit-2.14.5-4.1.s390x",
                  "product_id": "libxml2-devel-32bit-2.14.5-4.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "libxml2-doc-2.14.5-4.1.s390x",
                "product": {
                  "name": "libxml2-doc-2.14.5-4.1.s390x",
                  "product_id": "libxml2-doc-2.14.5-4.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "libxml2-tools-2.14.5-4.1.s390x",
                "product": {
                  "name": "libxml2-tools-2.14.5-4.1.s390x",
                  "product_id": "libxml2-tools-2.14.5-4.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libxml2-16-2.14.5-4.1.x86_64",
                "product": {
                  "name": "libxml2-16-2.14.5-4.1.x86_64",
                  "product_id": "libxml2-16-2.14.5-4.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libxml2-16-32bit-2.14.5-4.1.x86_64",
                "product": {
                  "name": "libxml2-16-32bit-2.14.5-4.1.x86_64",
                  "product_id": "libxml2-16-32bit-2.14.5-4.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libxml2-devel-2.14.5-4.1.x86_64",
                "product": {
                  "name": "libxml2-devel-2.14.5-4.1.x86_64",
                  "product_id": "libxml2-devel-2.14.5-4.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libxml2-devel-32bit-2.14.5-4.1.x86_64",
                "product": {
                  "name": "libxml2-devel-32bit-2.14.5-4.1.x86_64",
                  "product_id": "libxml2-devel-32bit-2.14.5-4.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libxml2-doc-2.14.5-4.1.x86_64",
                "product": {
                  "name": "libxml2-doc-2.14.5-4.1.x86_64",
                  "product_id": "libxml2-doc-2.14.5-4.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libxml2-tools-2.14.5-4.1.x86_64",
                "product": {
                  "name": "libxml2-tools-2.14.5-4.1.x86_64",
                  "product_id": "libxml2-tools-2.14.5-4.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxml2-16-2.14.5-4.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libxml2-16-2.14.5-4.1.aarch64"
        },
        "product_reference": "libxml2-16-2.14.5-4.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxml2-16-2.14.5-4.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libxml2-16-2.14.5-4.1.ppc64le"
        },
        "product_reference": "libxml2-16-2.14.5-4.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxml2-16-2.14.5-4.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libxml2-16-2.14.5-4.1.s390x"
        },
        "product_reference": "libxml2-16-2.14.5-4.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxml2-16-2.14.5-4.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libxml2-16-2.14.5-4.1.x86_64"
        },
        "product_reference": "libxml2-16-2.14.5-4.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxml2-16-32bit-2.14.5-4.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libxml2-16-32bit-2.14.5-4.1.aarch64"
        },
        "product_reference": "libxml2-16-32bit-2.14.5-4.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxml2-16-32bit-2.14.5-4.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libxml2-16-32bit-2.14.5-4.1.ppc64le"
        },
        "product_reference": "libxml2-16-32bit-2.14.5-4.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxml2-16-32bit-2.14.5-4.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libxml2-16-32bit-2.14.5-4.1.s390x"
        },
        "product_reference": "libxml2-16-32bit-2.14.5-4.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxml2-16-32bit-2.14.5-4.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libxml2-16-32bit-2.14.5-4.1.x86_64"
        },
        "product_reference": "libxml2-16-32bit-2.14.5-4.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxml2-devel-2.14.5-4.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libxml2-devel-2.14.5-4.1.aarch64"
        },
        "product_reference": "libxml2-devel-2.14.5-4.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxml2-devel-2.14.5-4.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libxml2-devel-2.14.5-4.1.ppc64le"
        },
        "product_reference": "libxml2-devel-2.14.5-4.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxml2-devel-2.14.5-4.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libxml2-devel-2.14.5-4.1.s390x"
        },
        "product_reference": "libxml2-devel-2.14.5-4.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxml2-devel-2.14.5-4.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libxml2-devel-2.14.5-4.1.x86_64"
        },
        "product_reference": "libxml2-devel-2.14.5-4.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxml2-devel-32bit-2.14.5-4.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libxml2-devel-32bit-2.14.5-4.1.aarch64"
        },
        "product_reference": "libxml2-devel-32bit-2.14.5-4.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxml2-devel-32bit-2.14.5-4.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libxml2-devel-32bit-2.14.5-4.1.ppc64le"
        },
        "product_reference": "libxml2-devel-32bit-2.14.5-4.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxml2-devel-32bit-2.14.5-4.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libxml2-devel-32bit-2.14.5-4.1.s390x"
        },
        "product_reference": "libxml2-devel-32bit-2.14.5-4.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxml2-devel-32bit-2.14.5-4.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libxml2-devel-32bit-2.14.5-4.1.x86_64"
        },
        "product_reference": "libxml2-devel-32bit-2.14.5-4.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxml2-doc-2.14.5-4.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libxml2-doc-2.14.5-4.1.aarch64"
        },
        "product_reference": "libxml2-doc-2.14.5-4.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxml2-doc-2.14.5-4.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libxml2-doc-2.14.5-4.1.ppc64le"
        },
        "product_reference": "libxml2-doc-2.14.5-4.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxml2-doc-2.14.5-4.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libxml2-doc-2.14.5-4.1.s390x"
        },
        "product_reference": "libxml2-doc-2.14.5-4.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxml2-doc-2.14.5-4.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libxml2-doc-2.14.5-4.1.x86_64"
        },
        "product_reference": "libxml2-doc-2.14.5-4.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxml2-tools-2.14.5-4.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libxml2-tools-2.14.5-4.1.aarch64"
        },
        "product_reference": "libxml2-tools-2.14.5-4.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxml2-tools-2.14.5-4.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libxml2-tools-2.14.5-4.1.ppc64le"
        },
        "product_reference": "libxml2-tools-2.14.5-4.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxml2-tools-2.14.5-4.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libxml2-tools-2.14.5-4.1.s390x"
        },
        "product_reference": "libxml2-tools-2.14.5-4.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxml2-tools-2.14.5-4.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libxml2-tools-2.14.5-4.1.x86_64"
        },
        "product_reference": "libxml2-tools-2.14.5-4.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-8732",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-8732"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A vulnerability was found in libxml2 up to 2.14.5. It has been declared as problematic. This vulnerability affects the function xmlParseSGMLCatalog of the component xmlcatalog. The manipulation leads to uncontrolled recursion. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The code maintainer explains, that \"[t]he issue can only be triggered with untrusted SGML catalogs and it makes absolutely no sense to use untrusted catalogs. I also doubt that anyone is still using SGML catalogs at all.\"",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:libxml2-16-2.14.5-4.1.aarch64",
          "openSUSE Tumbleweed:libxml2-16-2.14.5-4.1.ppc64le",
          "openSUSE Tumbleweed:libxml2-16-2.14.5-4.1.s390x",
          "openSUSE Tumbleweed:libxml2-16-2.14.5-4.1.x86_64",
          "openSUSE Tumbleweed:libxml2-16-32bit-2.14.5-4.1.aarch64",
          "openSUSE Tumbleweed:libxml2-16-32bit-2.14.5-4.1.ppc64le",
          "openSUSE Tumbleweed:libxml2-16-32bit-2.14.5-4.1.s390x",
          "openSUSE Tumbleweed:libxml2-16-32bit-2.14.5-4.1.x86_64",
          "openSUSE Tumbleweed:libxml2-devel-2.14.5-4.1.aarch64",
          "openSUSE Tumbleweed:libxml2-devel-2.14.5-4.1.ppc64le",
          "openSUSE Tumbleweed:libxml2-devel-2.14.5-4.1.s390x",
          "openSUSE Tumbleweed:libxml2-devel-2.14.5-4.1.x86_64",
          "openSUSE Tumbleweed:libxml2-devel-32bit-2.14.5-4.1.aarch64",
          "openSUSE Tumbleweed:libxml2-devel-32bit-2.14.5-4.1.ppc64le",
          "openSUSE Tumbleweed:libxml2-devel-32bit-2.14.5-4.1.s390x",
          "openSUSE Tumbleweed:libxml2-devel-32bit-2.14.5-4.1.x86_64",
          "openSUSE Tumbleweed:libxml2-doc-2.14.5-4.1.aarch64",
          "openSUSE Tumbleweed:libxml2-doc-2.14.5-4.1.ppc64le",
          "openSUSE Tumbleweed:libxml2-doc-2.14.5-4.1.s390x",
          "openSUSE Tumbleweed:libxml2-doc-2.14.5-4.1.x86_64",
          "openSUSE Tumbleweed:libxml2-tools-2.14.5-4.1.aarch64",
          "openSUSE Tumbleweed:libxml2-tools-2.14.5-4.1.ppc64le",
          "openSUSE Tumbleweed:libxml2-tools-2.14.5-4.1.s390x",
          "openSUSE Tumbleweed:libxml2-tools-2.14.5-4.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-8732",
          "url": "https://www.suse.com/security/cve/CVE-2025-8732"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1247850 for CVE-2025-8732",
          "url": "https://bugzilla.suse.com/1247850"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:libxml2-16-2.14.5-4.1.aarch64",
            "openSUSE Tumbleweed:libxml2-16-2.14.5-4.1.ppc64le",
            "openSUSE Tumbleweed:libxml2-16-2.14.5-4.1.s390x",
            "openSUSE Tumbleweed:libxml2-16-2.14.5-4.1.x86_64",
            "openSUSE Tumbleweed:libxml2-16-32bit-2.14.5-4.1.aarch64",
            "openSUSE Tumbleweed:libxml2-16-32bit-2.14.5-4.1.ppc64le",
            "openSUSE Tumbleweed:libxml2-16-32bit-2.14.5-4.1.s390x",
            "openSUSE Tumbleweed:libxml2-16-32bit-2.14.5-4.1.x86_64",
            "openSUSE Tumbleweed:libxml2-devel-2.14.5-4.1.aarch64",
            "openSUSE Tumbleweed:libxml2-devel-2.14.5-4.1.ppc64le",
            "openSUSE Tumbleweed:libxml2-devel-2.14.5-4.1.s390x",
            "openSUSE Tumbleweed:libxml2-devel-2.14.5-4.1.x86_64",
            "openSUSE Tumbleweed:libxml2-devel-32bit-2.14.5-4.1.aarch64",
            "openSUSE Tumbleweed:libxml2-devel-32bit-2.14.5-4.1.ppc64le",
            "openSUSE Tumbleweed:libxml2-devel-32bit-2.14.5-4.1.s390x",
            "openSUSE Tumbleweed:libxml2-devel-32bit-2.14.5-4.1.x86_64",
            "openSUSE Tumbleweed:libxml2-doc-2.14.5-4.1.aarch64",
            "openSUSE Tumbleweed:libxml2-doc-2.14.5-4.1.ppc64le",
            "openSUSE Tumbleweed:libxml2-doc-2.14.5-4.1.s390x",
            "openSUSE Tumbleweed:libxml2-doc-2.14.5-4.1.x86_64",
            "openSUSE Tumbleweed:libxml2-tools-2.14.5-4.1.aarch64",
            "openSUSE Tumbleweed:libxml2-tools-2.14.5-4.1.ppc64le",
            "openSUSE Tumbleweed:libxml2-tools-2.14.5-4.1.s390x",
            "openSUSE Tumbleweed:libxml2-tools-2.14.5-4.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:libxml2-16-2.14.5-4.1.aarch64",
            "openSUSE Tumbleweed:libxml2-16-2.14.5-4.1.ppc64le",
            "openSUSE Tumbleweed:libxml2-16-2.14.5-4.1.s390x",
            "openSUSE Tumbleweed:libxml2-16-2.14.5-4.1.x86_64",
            "openSUSE Tumbleweed:libxml2-16-32bit-2.14.5-4.1.aarch64",
            "openSUSE Tumbleweed:libxml2-16-32bit-2.14.5-4.1.ppc64le",
            "openSUSE Tumbleweed:libxml2-16-32bit-2.14.5-4.1.s390x",
            "openSUSE Tumbleweed:libxml2-16-32bit-2.14.5-4.1.x86_64",
            "openSUSE Tumbleweed:libxml2-devel-2.14.5-4.1.aarch64",
            "openSUSE Tumbleweed:libxml2-devel-2.14.5-4.1.ppc64le",
            "openSUSE Tumbleweed:libxml2-devel-2.14.5-4.1.s390x",
            "openSUSE Tumbleweed:libxml2-devel-2.14.5-4.1.x86_64",
            "openSUSE Tumbleweed:libxml2-devel-32bit-2.14.5-4.1.aarch64",
            "openSUSE Tumbleweed:libxml2-devel-32bit-2.14.5-4.1.ppc64le",
            "openSUSE Tumbleweed:libxml2-devel-32bit-2.14.5-4.1.s390x",
            "openSUSE Tumbleweed:libxml2-devel-32bit-2.14.5-4.1.x86_64",
            "openSUSE Tumbleweed:libxml2-doc-2.14.5-4.1.aarch64",
            "openSUSE Tumbleweed:libxml2-doc-2.14.5-4.1.ppc64le",
            "openSUSE Tumbleweed:libxml2-doc-2.14.5-4.1.s390x",
            "openSUSE Tumbleweed:libxml2-doc-2.14.5-4.1.x86_64",
            "openSUSE Tumbleweed:libxml2-tools-2.14.5-4.1.aarch64",
            "openSUSE Tumbleweed:libxml2-tools-2.14.5-4.1.ppc64le",
            "openSUSE Tumbleweed:libxml2-tools-2.14.5-4.1.s390x",
            "openSUSE Tumbleweed:libxml2-tools-2.14.5-4.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-02-17T00:00:00Z",
          "details": "low"
        }
      ],
      "title": "CVE-2025-8732"
    },
    {
      "cve": "CVE-2026-0990",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-0990"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was found in libxml2, an XML parsing library. This uncontrolled recursion vulnerability occurs in the xmlCatalogXMLResolveURI function when an XML catalog contains a delegate URI entry that references itself. A remote attacker could exploit this configuration-dependent issue by providing a specially crafted XML catalog, leading to infinite recursion and call stack exhaustion. This ultimately results in a segmentation fault, causing a Denial of Service (DoS) by crashing affected applications.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:libxml2-16-2.14.5-4.1.aarch64",
          "openSUSE Tumbleweed:libxml2-16-2.14.5-4.1.ppc64le",
          "openSUSE Tumbleweed:libxml2-16-2.14.5-4.1.s390x",
          "openSUSE Tumbleweed:libxml2-16-2.14.5-4.1.x86_64",
          "openSUSE Tumbleweed:libxml2-16-32bit-2.14.5-4.1.aarch64",
          "openSUSE Tumbleweed:libxml2-16-32bit-2.14.5-4.1.ppc64le",
          "openSUSE Tumbleweed:libxml2-16-32bit-2.14.5-4.1.s390x",
          "openSUSE Tumbleweed:libxml2-16-32bit-2.14.5-4.1.x86_64",
          "openSUSE Tumbleweed:libxml2-devel-2.14.5-4.1.aarch64",
          "openSUSE Tumbleweed:libxml2-devel-2.14.5-4.1.ppc64le",
          "openSUSE Tumbleweed:libxml2-devel-2.14.5-4.1.s390x",
          "openSUSE Tumbleweed:libxml2-devel-2.14.5-4.1.x86_64",
          "openSUSE Tumbleweed:libxml2-devel-32bit-2.14.5-4.1.aarch64",
          "openSUSE Tumbleweed:libxml2-devel-32bit-2.14.5-4.1.ppc64le",
          "openSUSE Tumbleweed:libxml2-devel-32bit-2.14.5-4.1.s390x",
          "openSUSE Tumbleweed:libxml2-devel-32bit-2.14.5-4.1.x86_64",
          "openSUSE Tumbleweed:libxml2-doc-2.14.5-4.1.aarch64",
          "openSUSE Tumbleweed:libxml2-doc-2.14.5-4.1.ppc64le",
          "openSUSE Tumbleweed:libxml2-doc-2.14.5-4.1.s390x",
          "openSUSE Tumbleweed:libxml2-doc-2.14.5-4.1.x86_64",
          "openSUSE Tumbleweed:libxml2-tools-2.14.5-4.1.aarch64",
          "openSUSE Tumbleweed:libxml2-tools-2.14.5-4.1.ppc64le",
          "openSUSE Tumbleweed:libxml2-tools-2.14.5-4.1.s390x",
          "openSUSE Tumbleweed:libxml2-tools-2.14.5-4.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-0990",
          "url": "https://www.suse.com/security/cve/CVE-2026-0990"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1256806 for CVE-2026-0990",
          "url": "https://bugzilla.suse.com/1256806"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:libxml2-16-2.14.5-4.1.aarch64",
            "openSUSE Tumbleweed:libxml2-16-2.14.5-4.1.ppc64le",
            "openSUSE Tumbleweed:libxml2-16-2.14.5-4.1.s390x",
            "openSUSE Tumbleweed:libxml2-16-2.14.5-4.1.x86_64",
            "openSUSE Tumbleweed:libxml2-16-32bit-2.14.5-4.1.aarch64",
            "openSUSE Tumbleweed:libxml2-16-32bit-2.14.5-4.1.ppc64le",
            "openSUSE Tumbleweed:libxml2-16-32bit-2.14.5-4.1.s390x",
            "openSUSE Tumbleweed:libxml2-16-32bit-2.14.5-4.1.x86_64",
            "openSUSE Tumbleweed:libxml2-devel-2.14.5-4.1.aarch64",
            "openSUSE Tumbleweed:libxml2-devel-2.14.5-4.1.ppc64le",
            "openSUSE Tumbleweed:libxml2-devel-2.14.5-4.1.s390x",
            "openSUSE Tumbleweed:libxml2-devel-2.14.5-4.1.x86_64",
            "openSUSE Tumbleweed:libxml2-devel-32bit-2.14.5-4.1.aarch64",
            "openSUSE Tumbleweed:libxml2-devel-32bit-2.14.5-4.1.ppc64le",
            "openSUSE Tumbleweed:libxml2-devel-32bit-2.14.5-4.1.s390x",
            "openSUSE Tumbleweed:libxml2-devel-32bit-2.14.5-4.1.x86_64",
            "openSUSE Tumbleweed:libxml2-doc-2.14.5-4.1.aarch64",
            "openSUSE Tumbleweed:libxml2-doc-2.14.5-4.1.ppc64le",
            "openSUSE Tumbleweed:libxml2-doc-2.14.5-4.1.s390x",
            "openSUSE Tumbleweed:libxml2-doc-2.14.5-4.1.x86_64",
            "openSUSE Tumbleweed:libxml2-tools-2.14.5-4.1.aarch64",
            "openSUSE Tumbleweed:libxml2-tools-2.14.5-4.1.ppc64le",
            "openSUSE Tumbleweed:libxml2-tools-2.14.5-4.1.s390x",
            "openSUSE Tumbleweed:libxml2-tools-2.14.5-4.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:libxml2-16-2.14.5-4.1.aarch64",
            "openSUSE Tumbleweed:libxml2-16-2.14.5-4.1.ppc64le",
            "openSUSE Tumbleweed:libxml2-16-2.14.5-4.1.s390x",
            "openSUSE Tumbleweed:libxml2-16-2.14.5-4.1.x86_64",
            "openSUSE Tumbleweed:libxml2-16-32bit-2.14.5-4.1.aarch64",
            "openSUSE Tumbleweed:libxml2-16-32bit-2.14.5-4.1.ppc64le",
            "openSUSE Tumbleweed:libxml2-16-32bit-2.14.5-4.1.s390x",
            "openSUSE Tumbleweed:libxml2-16-32bit-2.14.5-4.1.x86_64",
            "openSUSE Tumbleweed:libxml2-devel-2.14.5-4.1.aarch64",
            "openSUSE Tumbleweed:libxml2-devel-2.14.5-4.1.ppc64le",
            "openSUSE Tumbleweed:libxml2-devel-2.14.5-4.1.s390x",
            "openSUSE Tumbleweed:libxml2-devel-2.14.5-4.1.x86_64",
            "openSUSE Tumbleweed:libxml2-devel-32bit-2.14.5-4.1.aarch64",
            "openSUSE Tumbleweed:libxml2-devel-32bit-2.14.5-4.1.ppc64le",
            "openSUSE Tumbleweed:libxml2-devel-32bit-2.14.5-4.1.s390x",
            "openSUSE Tumbleweed:libxml2-devel-32bit-2.14.5-4.1.x86_64",
            "openSUSE Tumbleweed:libxml2-doc-2.14.5-4.1.aarch64",
            "openSUSE Tumbleweed:libxml2-doc-2.14.5-4.1.ppc64le",
            "openSUSE Tumbleweed:libxml2-doc-2.14.5-4.1.s390x",
            "openSUSE Tumbleweed:libxml2-doc-2.14.5-4.1.x86_64",
            "openSUSE Tumbleweed:libxml2-tools-2.14.5-4.1.aarch64",
            "openSUSE Tumbleweed:libxml2-tools-2.14.5-4.1.ppc64le",
            "openSUSE Tumbleweed:libxml2-tools-2.14.5-4.1.s390x",
            "openSUSE Tumbleweed:libxml2-tools-2.14.5-4.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-02-17T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-0990"
    },
    {
      "cve": "CVE-2026-0992",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-0992"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was found in the libxml2 library. This uncontrolled resource consumption vulnerability occurs when processing XML catalogs that contain repeated \u003cnextCatalog\u003e elements pointing to the same downstream catalog. A remote attacker can exploit this by supplying crafted catalogs, causing the parser to redundantly traverse catalog chains. This leads to excessive CPU consumption and degrades application availability, resulting in a denial-of-service condition.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:libxml2-16-2.14.5-4.1.aarch64",
          "openSUSE Tumbleweed:libxml2-16-2.14.5-4.1.ppc64le",
          "openSUSE Tumbleweed:libxml2-16-2.14.5-4.1.s390x",
          "openSUSE Tumbleweed:libxml2-16-2.14.5-4.1.x86_64",
          "openSUSE Tumbleweed:libxml2-16-32bit-2.14.5-4.1.aarch64",
          "openSUSE Tumbleweed:libxml2-16-32bit-2.14.5-4.1.ppc64le",
          "openSUSE Tumbleweed:libxml2-16-32bit-2.14.5-4.1.s390x",
          "openSUSE Tumbleweed:libxml2-16-32bit-2.14.5-4.1.x86_64",
          "openSUSE Tumbleweed:libxml2-devel-2.14.5-4.1.aarch64",
          "openSUSE Tumbleweed:libxml2-devel-2.14.5-4.1.ppc64le",
          "openSUSE Tumbleweed:libxml2-devel-2.14.5-4.1.s390x",
          "openSUSE Tumbleweed:libxml2-devel-2.14.5-4.1.x86_64",
          "openSUSE Tumbleweed:libxml2-devel-32bit-2.14.5-4.1.aarch64",
          "openSUSE Tumbleweed:libxml2-devel-32bit-2.14.5-4.1.ppc64le",
          "openSUSE Tumbleweed:libxml2-devel-32bit-2.14.5-4.1.s390x",
          "openSUSE Tumbleweed:libxml2-devel-32bit-2.14.5-4.1.x86_64",
          "openSUSE Tumbleweed:libxml2-doc-2.14.5-4.1.aarch64",
          "openSUSE Tumbleweed:libxml2-doc-2.14.5-4.1.ppc64le",
          "openSUSE Tumbleweed:libxml2-doc-2.14.5-4.1.s390x",
          "openSUSE Tumbleweed:libxml2-doc-2.14.5-4.1.x86_64",
          "openSUSE Tumbleweed:libxml2-tools-2.14.5-4.1.aarch64",
          "openSUSE Tumbleweed:libxml2-tools-2.14.5-4.1.ppc64le",
          "openSUSE Tumbleweed:libxml2-tools-2.14.5-4.1.s390x",
          "openSUSE Tumbleweed:libxml2-tools-2.14.5-4.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-0992",
          "url": "https://www.suse.com/security/cve/CVE-2026-0992"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1256808 for CVE-2026-0992",
          "url": "https://bugzilla.suse.com/1256808"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:libxml2-16-2.14.5-4.1.aarch64",
            "openSUSE Tumbleweed:libxml2-16-2.14.5-4.1.ppc64le",
            "openSUSE Tumbleweed:libxml2-16-2.14.5-4.1.s390x",
            "openSUSE Tumbleweed:libxml2-16-2.14.5-4.1.x86_64",
            "openSUSE Tumbleweed:libxml2-16-32bit-2.14.5-4.1.aarch64",
            "openSUSE Tumbleweed:libxml2-16-32bit-2.14.5-4.1.ppc64le",
            "openSUSE Tumbleweed:libxml2-16-32bit-2.14.5-4.1.s390x",
            "openSUSE Tumbleweed:libxml2-16-32bit-2.14.5-4.1.x86_64",
            "openSUSE Tumbleweed:libxml2-devel-2.14.5-4.1.aarch64",
            "openSUSE Tumbleweed:libxml2-devel-2.14.5-4.1.ppc64le",
            "openSUSE Tumbleweed:libxml2-devel-2.14.5-4.1.s390x",
            "openSUSE Tumbleweed:libxml2-devel-2.14.5-4.1.x86_64",
            "openSUSE Tumbleweed:libxml2-devel-32bit-2.14.5-4.1.aarch64",
            "openSUSE Tumbleweed:libxml2-devel-32bit-2.14.5-4.1.ppc64le",
            "openSUSE Tumbleweed:libxml2-devel-32bit-2.14.5-4.1.s390x",
            "openSUSE Tumbleweed:libxml2-devel-32bit-2.14.5-4.1.x86_64",
            "openSUSE Tumbleweed:libxml2-doc-2.14.5-4.1.aarch64",
            "openSUSE Tumbleweed:libxml2-doc-2.14.5-4.1.ppc64le",
            "openSUSE Tumbleweed:libxml2-doc-2.14.5-4.1.s390x",
            "openSUSE Tumbleweed:libxml2-doc-2.14.5-4.1.x86_64",
            "openSUSE Tumbleweed:libxml2-tools-2.14.5-4.1.aarch64",
            "openSUSE Tumbleweed:libxml2-tools-2.14.5-4.1.ppc64le",
            "openSUSE Tumbleweed:libxml2-tools-2.14.5-4.1.s390x",
            "openSUSE Tumbleweed:libxml2-tools-2.14.5-4.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:libxml2-16-2.14.5-4.1.aarch64",
            "openSUSE Tumbleweed:libxml2-16-2.14.5-4.1.ppc64le",
            "openSUSE Tumbleweed:libxml2-16-2.14.5-4.1.s390x",
            "openSUSE Tumbleweed:libxml2-16-2.14.5-4.1.x86_64",
            "openSUSE Tumbleweed:libxml2-16-32bit-2.14.5-4.1.aarch64",
            "openSUSE Tumbleweed:libxml2-16-32bit-2.14.5-4.1.ppc64le",
            "openSUSE Tumbleweed:libxml2-16-32bit-2.14.5-4.1.s390x",
            "openSUSE Tumbleweed:libxml2-16-32bit-2.14.5-4.1.x86_64",
            "openSUSE Tumbleweed:libxml2-devel-2.14.5-4.1.aarch64",
            "openSUSE Tumbleweed:libxml2-devel-2.14.5-4.1.ppc64le",
            "openSUSE Tumbleweed:libxml2-devel-2.14.5-4.1.s390x",
            "openSUSE Tumbleweed:libxml2-devel-2.14.5-4.1.x86_64",
            "openSUSE Tumbleweed:libxml2-devel-32bit-2.14.5-4.1.aarch64",
            "openSUSE Tumbleweed:libxml2-devel-32bit-2.14.5-4.1.ppc64le",
            "openSUSE Tumbleweed:libxml2-devel-32bit-2.14.5-4.1.s390x",
            "openSUSE Tumbleweed:libxml2-devel-32bit-2.14.5-4.1.x86_64",
            "openSUSE Tumbleweed:libxml2-doc-2.14.5-4.1.aarch64",
            "openSUSE Tumbleweed:libxml2-doc-2.14.5-4.1.ppc64le",
            "openSUSE Tumbleweed:libxml2-doc-2.14.5-4.1.s390x",
            "openSUSE Tumbleweed:libxml2-doc-2.14.5-4.1.x86_64",
            "openSUSE Tumbleweed:libxml2-tools-2.14.5-4.1.aarch64",
            "openSUSE Tumbleweed:libxml2-tools-2.14.5-4.1.ppc64le",
            "openSUSE Tumbleweed:libxml2-tools-2.14.5-4.1.s390x",
            "openSUSE Tumbleweed:libxml2-tools-2.14.5-4.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-02-17T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-0992"
    }
  ]
}

CVE-2025-8732 (GCVE-0-2025-8732)

Vulnerability from cvelistv5 – Published: 2025-08-08 16:32 – Updated: 2025-08-08 17:12 Disputed

Title

libxml2 xmlcatalog xmlParseSGMLCatalog recursion

Summary

A vulnerability was found in libxml2 up to 2.14.5. It has been declared as problematic. This vulnerability affects the function xmlParseSGMLCatalog of the component xmlcatalog. The manipulation leads to uncontrolled recursion. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The code maintainer explains, that "[t]he issue can only be triggered with untrusted SGML catalogs and it makes absolutely no sense to use untrusted catalogs. I also doubt that anyone is still using SGML catalogs at all."

Severity ?

4.8 (Medium)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P

3.3 (Low)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C

3.3 (Low)


                        
                          CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C

CWE

CWE-674 - Uncontrolled Recursion
CWE-404 - Denial of Service

Assigner

VulDB

References

URL

Tags

	https://vuldb.com/?id.319228	vdb-entrytechnical-description
	https://vuldb.com/?ctiid.319228	signaturepermissions-required
	https://vuldb.com/?submit.622285	third-party-advisory
	https://gitlab.gnome.org/GNOME/libxml2/-/issues/958	issue-tracking
	https://gitlab.gnome.org/GNOME/libxml2/-/issues/9…	issue-tracking
	https://drive.google.com/file/d/1woIeYVcSQB_NwfEh…	exploit

Impacted products

	Vendor	Product	Version
	n/a	libxml2	Affected: 2.14.0 Affected: 2.14.1 Affected: 2.14.2 Affected: 2.14.3 Affected: 2.14.4 Affected: 2.14.5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-8732",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-08-08T17:04:09.914830Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-08-08T17:12:15.735Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "xmlcatalog"
          ],
          "product": "libxml2",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "2.14.0"
            },
            {
              "status": "affected",
              "version": "2.14.1"
            },
            {
              "status": "affected",
              "version": "2.14.2"
            },
            {
              "status": "affected",
              "version": "2.14.3"
            },
            {
              "status": "affected",
              "version": "2.14.4"
            },
            {
              "status": "affected",
              "version": "2.14.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was found in libxml2 up to 2.14.5. It has been declared as problematic. This vulnerability affects the function xmlParseSGMLCatalog of the component xmlcatalog. The manipulation leads to uncontrolled recursion. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The code maintainer explains, that \"[t]he issue can only be triggered with untrusted SGML catalogs and it makes absolutely no sense to use untrusted catalogs. I also doubt that anyone is still using SGML catalogs at all.\""
        },
        {
          "lang": "de",
          "value": "In libxml2 bis 2.14.5 wurde eine Schwachstelle ausgemacht. Sie wurde als problematisch eingestuft. Dabei geht es um die Funktion xmlParseSGMLCatalog der Komponente xmlcatalog. Durch Manipulieren mit unbekannten Daten kann eine uncontrolled recursion-Schwachstelle ausgenutzt werden. Die Umsetzung des Angriffs hat dabei lokal zu erfolgen. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung. Zur Zeit ist nicht genau klar, ob diese Schwachstelle in der besagten Form wirklich existiert."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 1.7,
            "vectorString": "AV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:ND/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-674",
              "description": "Uncontrolled Recursion",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-404",
              "description": "Denial of Service",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-08-08T16:32:06.990Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-319228 | libxml2 xmlcatalog xmlParseSGMLCatalog recursion",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/?id.319228"
        },
        {
          "name": "VDB-319228 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/?ctiid.319228"
        },
        {
          "name": "Submit #622285 | LibXML2  xmlcatalog  the newest master stack overflow",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/?submit.622285"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/958"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/958#note_2505853"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://drive.google.com/file/d/1woIeYVcSQB_NwfEhaVnX6MedpWJ_nqWl/view?usp=drive_link"
        }
      ],
      "tags": [
        "disputed"
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2025-08-08T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2025-08-08T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2025-08-08T09:55:15.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "libxml2 xmlcatalog xmlParseSGMLCatalog recursion"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2025-8732",
    "datePublished": "2025-08-08T16:32:06.990Z",
    "dateReserved": "2025-08-08T07:49:27.806Z",
    "dateUpdated": "2025-08-08T17:12:15.735Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2026-0992 (GCVE-0-2026-0992)

Vulnerability from cvelistv5 – Published: 2026-01-15 14:20 – Updated: 2026-01-15 16:39

Title

Libxml2: libxml2: denial of service via crafted xml catalogs

Summary

A flaw was found in the libxml2 library. This uncontrolled resource consumption vulnerability occurs when processing XML catalogs that contain repeated <nextCatalog> elements pointing to the same downstream catalog. A remote attacker can exploit this by supplying crafted catalogs, causing the parser to redundantly traverse catalog chains. This leads to excessive CPU consumption and degrades application availability, resulting in a denial-of-service condition.

Severity ?

2.9 (Low)


                        
                          CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

CWE

CWE-400 - Uncontrolled Resource Consumption

Assigner

redhat

References

URL

Tags

	https://access.redhat.com/security/cve/CVE-2026-0992	vdb-entryx_refsource_REDHAT
	https://bugzilla.redhat.com/show_bug.cgi?id=2429975	issue-trackingx_refsource_REDHAT

Impacted products

Vendor

Product

Version

Red Hat

Red Hat Enterprise Linux 10

cpe:/o:redhat:enterprise_linux:10

Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat JBoss Core Services	cpe:/a:redhat:jboss_core_services:1
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4

Credits

Red Hat would like to thank Nick Wellnhofer for reporting this issue.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-0992",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-15T16:31:06.823175Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-15T16:39:47.982Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "affected",
          "packageName": "libxml2",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:6"
          ],
          "defaultStatus": "affected",
          "packageName": "libxml2",
          "product": "Red Hat Enterprise Linux 6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7"
          ],
          "defaultStatus": "affected",
          "packageName": "libxml2",
          "product": "Red Hat Enterprise Linux 7",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "affected",
          "packageName": "libxml2",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "affected",
          "packageName": "libxml2",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
          "cpes": [
            "cpe:/a:redhat:jboss_core_services:1"
          ],
          "defaultStatus": "affected",
          "packageName": "libxml2",
          "product": "Red Hat JBoss Core Services",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected",
          "packageName": "rhcos",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank Nick Wellnhofer for reporting this issue."
        }
      ],
      "datePublic": "2026-01-15T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in the libxml2 library. This uncontrolled resource consumption vulnerability occurs when processing XML catalogs that contain repeated \u003cnextCatalog\u003e elements pointing to the same downstream catalog. A remote attacker can exploit this by supplying crafted catalogs, causing the parser to redundantly traverse catalog chains. This leads to excessive CPU consumption and degrades application availability, resulting in a denial-of-service condition."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Low"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 2.9,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-15T14:20:24.934Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-0992"
        },
        {
          "name": "RHBZ#2429975",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2429975"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-01-15T13:29:32.742Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-01-15T00:00:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Libxml2: libxml2: denial of service via crafted xml catalogs",
      "workarounds": [
        {
          "lang": "en",
          "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-400: Uncontrolled Resource Consumption"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-0992",
    "datePublished": "2026-01-15T14:20:24.934Z",
    "dateReserved": "2026-01-15T13:34:08.872Z",
    "dateUpdated": "2026-01-15T16:39:47.982Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-0990 (GCVE-0-2026-0990)

Vulnerability from cvelistv5 – Published: 2026-01-15 14:20 – Updated: 2026-01-15 16:39

Title

Libxml2: libxml2: denial of service via uncontrolled recursion in xml catalog processing

Summary

A flaw was found in libxml2, an XML parsing library. This uncontrolled recursion vulnerability occurs in the xmlCatalogXMLResolveURI function when an XML catalog contains a delegate URI entry that references itself. A remote attacker could exploit this configuration-dependent issue by providing a specially crafted XML catalog, leading to infinite recursion and call stack exhaustion. This ultimately results in a segmentation fault, causing a Denial of Service (DoS) by crashing affected applications.

Severity ?

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-674 - Uncontrolled Recursion

Assigner

redhat

References

URL

Tags

	https://access.redhat.com/security/cve/CVE-2026-0990	vdb-entryx_refsource_REDHAT
	https://bugzilla.redhat.com/show_bug.cgi?id=2429959	issue-trackingx_refsource_REDHAT

Impacted products

Vendor

Product

Version

Red Hat

Red Hat Enterprise Linux 10

cpe:/o:redhat:enterprise_linux:10

Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat JBoss Core Services	cpe:/a:redhat:jboss_core_services:1
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4

Credits

Red Hat would like to thank Nick Wellnhofer for reporting this issue.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-0990",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-15T16:31:20.247968Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-15T16:39:20.891Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "affected",
          "packageName": "libxml2",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:6"
          ],
          "defaultStatus": "affected",
          "packageName": "libxml2",
          "product": "Red Hat Enterprise Linux 6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7"
          ],
          "defaultStatus": "affected",
          "packageName": "libxml2",
          "product": "Red Hat Enterprise Linux 7",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "affected",
          "packageName": "libxml2",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "affected",
          "packageName": "libxml2",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
          "cpes": [
            "cpe:/a:redhat:jboss_core_services:1"
          ],
          "defaultStatus": "affected",
          "packageName": "libxml2",
          "product": "Red Hat JBoss Core Services",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected",
          "packageName": "rhcos",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank Nick Wellnhofer for reporting this issue."
        }
      ],
      "datePublic": "2026-01-15T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in libxml2, an XML parsing library. This uncontrolled recursion vulnerability occurs in the xmlCatalogXMLResolveURI function when an XML catalog contains a delegate URI entry that references itself. A remote attacker could exploit this configuration-dependent issue by providing a specially crafted XML catalog, leading to infinite recursion and call stack exhaustion. This ultimately results in a segmentation fault, causing a Denial of Service (DoS) by crashing affected applications."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-674",
              "description": "Uncontrolled Recursion",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-15T14:20:06.515Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-0990"
        },
        {
          "name": "RHBZ#2429959",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2429959"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-01-15T13:15:23.187Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-01-15T00:00:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Libxml2: libxml2: denial of service via uncontrolled recursion in xml catalog processing",
      "workarounds": [
        {
          "lang": "en",
          "value": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-674: Uncontrolled Recursion"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-0990",
    "datePublished": "2026-01-15T14:20:06.515Z",
    "dateReserved": "2026-01-15T13:15:10.756Z",
    "dateUpdated": "2026-01-15T16:39:20.891Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

OPENSUSE-SU-2026:10213-1

CVE-2025-8732 (GCVE-0-2025-8732)

CVE-2026-0992 (GCVE-0-2026-0992)

CVE-2026-0990 (GCVE-0-2026-0990)

Tags

Sightings

Nomenclature