CVE-2026-0992
BaseFortify
Publication date: 2026-01-15
Last updated on: 2026-04-22
Assigner: Red Hat, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| gnome | libxml2 | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-400 | The product does not properly control the allocation and maintenance of a limited resource. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a denial-of-service flaw in the libxml2 library's XML catalog processing. It happens when the parser processes XML catalogs containing repeated <nextCatalog> elements that point to the same downstream catalog multiple times. This causes the parser to redundantly traverse catalog chains, leading to excessive CPU usage and slowing down or crashing the application. [1]
How can this vulnerability impact me? :
An attacker can exploit this vulnerability by supplying specially crafted XML catalogs that cause the libxml2 parser to consume excessive CPU resources. This results in degraded application availability or a denial-of-service condition, potentially making the affected application or system unresponsive. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection of this vulnerability involves monitoring for excessive CPU usage by applications using the libxml2 library when processing XML catalogs, especially those containing repeated <nextCatalog> elements. You can use system monitoring commands such as 'top' or 'htop' to observe CPU usage spikes. Additionally, inspecting XML catalog files for repeated <nextCatalog> elements might help identify potentially malicious catalogs. There are no specific commands provided for direct detection of this vulnerability. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include updating the libxml2 library to a version where this vulnerability is fixed. Avoid processing untrusted or specially crafted XML catalogs that contain repeated <nextCatalog> elements. Implement resource limits on applications using libxml2 to prevent excessive CPU consumption. Since the vulnerability is related to uncontrolled resource consumption, applying patches and restricting input sources are key mitigation strategies. [1]