Executive Summary

This vulnerability is an unbounded recursion flaw in the RelaxNG parser of the libxml2 XML parsing library. It occurs because the parser does not limit the depth of nested <include> directives in RelaxNG schema files. When processing specially crafted or deeply nested schema files, the parser recurses excessively, exhausting the system call stack and causing a stack overflow that crashes the application. [1]

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can cause denial of service by crashing applications that use the libxml2 parser when processing malicious or overly complex RelaxNG schemas. This impacts application availability but does not affect confidentiality or integrity. [1]

Useful 0 Not Useful 0

Detection Guidance

Detection involves monitoring for application crashes or stack overflow errors related to libxml2 when processing RelaxNG schemas, especially those with deeply nested or complex <include> directives. Since exploitation requires attacker-controlled schema input, inspecting logs for repeated crashes or denial-of-service symptoms in applications using libxml2 may help. Specific commands are not provided in the available resources. [1]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include avoiding processing untrusted or attacker-controlled RelaxNG schema files with libxml2, especially those containing deeply nested <include> directives. Applying any available patches or updates to libxml2 once released is recommended. Since the vulnerability is low severity and priority, monitoring for updates from your Linux distribution or libxml2 maintainers is advised. [1]

Useful 0 Not Useful 0