CVE-2026-0989

Analyzed Analyzed - Analysis Complete

BaseFortify

Publication date: 2026-01-15

Last updated on: 2026-06-30

Assigner: Red Hat, Inc.

Description

A flaw was identified in the RelaxNG parser of libxml2 related to how external schema inclusions are handled. The parser does not enforce a limit on inclusion depth when resolving nested <include> directives. Specially crafted or overly complex schemas can cause excessive recursion during parsing. This may lead to stack exhaustion and application crashes, creating a denial-of-service risk.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-01-15

Last Modified

2026-06-30

Generated

2026-07-06

AI Q&A

2026-01-16

EPSS Evaluated

2026-07-05

NVD

CVE-2026-0989

EUVD

EUVD-2026-2796

Affected Vendors & Products

Vendor	Product	Version / Range
xmlsoft	libxml2	to 2.15.2 (exc)
redhat	enterprise_linux	7.0
redhat	enterprise_linux	6.0
redhat	jboss_core_services	*
redhat	enterprise_linux	8.0
redhat	openshift_container_platform	4.0
redhat	enterprise_linux	9.0
redhat	enterprise_linux	10.0
redhat	hardened_images	*
ibm	vios	From 4.1.0 (inc) to 4.1.1.30 (exc)
ibm	vios	4.1.2.0
ibm	aix	From 7.2.5 (inc) to 7.2.5.12 (exc)
ibm	aix	From 7.3.2 (inc) to 7.3.3.3 (exc)
ibm	aix	7.3.4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-674	The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Attack-Flow Graph

Executive Summary

This vulnerability is an unbounded recursion flaw in the RelaxNG parser of the libxml2 XML parsing library. It occurs because the parser does not limit the depth of nested <include> directives in RelaxNG schema files. When processing specially crafted or deeply nested schema files, the parser recurses excessively, exhausting the system call stack and causing a stack overflow that crashes the application. [1]

Impact Analysis

The vulnerability can cause denial of service by crashing applications that use the libxml2 parser when processing malicious or overly complex RelaxNG schemas. This impacts application availability but does not affect confidentiality or integrity. [1]

Detection Guidance

Detection involves monitoring for application crashes or stack overflow errors related to libxml2 when processing RelaxNG schemas, especially those with deeply nested or complex <include> directives. Since exploitation requires attacker-controlled schema input, inspecting logs for repeated crashes or denial-of-service symptoms in applications using libxml2 may help. Specific commands are not provided in the available resources. [1]

Mitigation Strategies

Immediate mitigation steps include avoiding processing untrusted or attacker-controlled RelaxNG schema files with libxml2, especially those containing deeply nested <include> directives. Applying any available patches or updates to libxml2 once released is recommended. Since the vulnerability is low severity and priority, monitoring for updates from your Linux distribution or libxml2 maintainers is advised. [1]

Hi! I’m here to help you understand CVE-2026-0989. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70