CVE-2026-0992

Analyzed Analyzed - Analysis Complete

BaseFortify

Publication date: 2026-01-15

Last updated on: 2026-06-30

Assigner: Red Hat, Inc.

Description

A flaw was found in the libxml2 library. This uncontrolled resource consumption vulnerability occurs when processing XML catalogs that contain repeated <nextCatalog> elements pointing to the same downstream catalog. A remote attacker can exploit this by supplying crafted catalogs, causing the parser to redundantly traverse catalog chains. This leads to excessive CPU consumption and degrades application availability, resulting in a denial-of-service condition.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-01-15

Last Modified

2026-06-30

Generated

2026-07-06

AI Q&A

2026-01-16

EPSS Evaluated

2026-07-05

NVD

CVE-2026-0992

EUVD

EUVD-2026-2795

Affected Vendors & Products

Vendor	Product	Version / Range
redhat	enterprise_linux	7.0
redhat	enterprise_linux	6.0
redhat	jboss_core_services	*
redhat	enterprise_linux	8.0
redhat	openshift_container_platform	4.0
redhat	enterprise_linux	9.0
redhat	enterprise_linux	10.0
redhat	hardened_images	*
ibm	vios	From 4.1.0 (inc) to 4.1.1.30 (exc)
ibm	vios	4.1.2.0
ibm	aix	From 7.2.5 (inc) to 7.2.5.12 (exc)
ibm	aix	From 7.3.2 (inc) to 7.3.3.3 (exc)
ibm	aix	7.3.4
xmlsoft	libxml2	to 2.15.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This vulnerability is a denial-of-service flaw in the libxml2 library's XML catalog processing. It happens when the parser processes XML catalogs containing repeated <nextCatalog> elements that point to the same downstream catalog multiple times. This causes the parser to redundantly traverse catalog chains, leading to excessive CPU usage and slowing down or crashing the application. [1]

Impact Analysis

An attacker can exploit this vulnerability by supplying specially crafted XML catalogs that cause the libxml2 parser to consume excessive CPU resources. This results in degraded application availability or a denial-of-service condition, potentially making the affected application or system unresponsive. [1]

Detection Guidance

Detection of this vulnerability involves monitoring for excessive CPU usage by applications using the libxml2 library when processing XML catalogs, especially those containing repeated <nextCatalog> elements. You can use system monitoring commands such as 'top' or 'htop' to observe CPU usage spikes. Additionally, inspecting XML catalog files for repeated <nextCatalog> elements might help identify potentially malicious catalogs. There are no specific commands provided for direct detection of this vulnerability. [1]

Mitigation Strategies

Immediate mitigation steps include updating the libxml2 library to a version where this vulnerability is fixed. Avoid processing untrusted or specially crafted XML catalogs that contain repeated <nextCatalog> elements. Implement resource limits on applications using libxml2 to prevent excessive CPU consumption. Since the vulnerability is related to uncontrolled resource consumption, applying patches and restricting input sources are key mitigation strategies. [1]

Hi! I’m here to help you understand CVE-2026-0992. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70