CVE-2026-0989
BaseFortify
Publication date: 2026-01-15
Last updated on: 2026-04-22
Assigner: Red Hat, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| gnome | libxml2 | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-674 | The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an unbounded recursion flaw in the RelaxNG parser of the libxml2 XML parsing library. It occurs because the parser does not limit the depth of nested <include> directives in RelaxNG schema files. When processing specially crafted or deeply nested schema files, the parser recurses excessively, exhausting the system call stack and causing a stack overflow that crashes the application. [1]
How can this vulnerability impact me? :
The vulnerability can cause denial of service by crashing applications that use the libxml2 parser when processing malicious or overly complex RelaxNG schemas. This impacts application availability but does not affect confidentiality or integrity. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection involves monitoring for application crashes or stack overflow errors related to libxml2 when processing RelaxNG schemas, especially those with deeply nested or complex <include> directives. Since exploitation requires attacker-controlled schema input, inspecting logs for repeated crashes or denial-of-service symptoms in applications using libxml2 may help. Specific commands are not provided in the available resources. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include avoiding processing untrusted or attacker-controlled RelaxNG schema files with libxml2, especially those containing deeply nested <include> directives. Applying any available patches or updates to libxml2 once released is recommended. Since the vulnerability is low severity and priority, monitoring for updates from your Linux distribution or libxml2 maintainers is advised. [1]