CVE-2026-0990
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2026-01-15

Last updated on: 2026-04-22

Assigner: Red Hat, Inc.

Description
A flaw was found in libxml2, an XML parsing library. This uncontrolled recursion vulnerability occurs in the xmlCatalogXMLResolveURI function when an XML catalog contains a delegate URI entry that references itself. A remote attacker could exploit this configuration-dependent issue by providing a specially crafted XML catalog, leading to infinite recursion and call stack exhaustion. This ultimately results in a segmentation fault, causing a Denial of Service (DoS) by crashing affected applications.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-01-15
Last Modified
2026-04-22
Generated
2026-06-16
AI Q&A
2026-01-16
EPSS Evaluated
2026-06-15
NVD
CVE-2026-0990
EUVD
EUVD-2026-2797
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
gnome libxml2 *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-674 The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is an uncontrolled recursion flaw in the libxml2 XML parsing library, specifically in the xmlCatalogXMLResolveURI function. When an XML catalog contains a delegate URI entry that references itself, the function recursively tries to resolve the same catalog entry repeatedly without detecting the cycle. This causes infinite recursion, exhausting the call stack and resulting in a segmentation fault that crashes the application. [1]

Impact Analysis

This vulnerability can be exploited by a remote attacker who provides a specially crafted XML catalog that triggers infinite recursion. The impact is a Denial of Service (DoS) by crashing applications that use libxml2 for XML parsing, leading to unavailability of affected services or software. [1]

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-0990. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart