CVE-2026-86144
Received Received - Intake

libxml2 XInclude Processing Flag Propagation Flaw

Publication date: 2026-09-05

Last updated on: 2026-09-05

Assigner: MITRE

Description
In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, the XML_PARSE_NONET flag, if (without it) a custom resource loader accesses the internet and triggers XML external entity injection, SSRF, or a denial of service (e.g., for an attacker-controlled internet resource that is intentionally slow).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-05
Last Modified
2026-09-05
Generated
2026-09-05
AI Q&A
2026-09-05
EPSS Evaluated
N/A
NVD
CVE-2026-86144
EUVD
EUVD-2026-71823

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
gnome libxml2 to 2.15.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-669 The product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in libxml2 before 2.15.4 involves XInclude processing functions not propagating parseFlags. Specifically, xmlXIncludeProcess and xmlXIncludeProcessTree fail to pass flags like XML_PARSE_NONET, which are meant to restrict network access. Without these flags, custom resource loaders might access the internet, enabling attacks such as XML external entity injection, SSRF, or denial of service.

Detection Guidance

To detect this vulnerability, check the version of libxml2 installed on your system. Run: libxml2 --version. If the version is before 2.15.4, the system is vulnerable. Additionally, review applications using libxml2 for XInclude processing without proper parseFlags handling.

Impact Analysis

If you use libxml2 before 2.15.4, this flaw could allow attackers to trigger unintended network access during XML processing. This might lead to data breaches via XML external entity injection, unauthorized server access through SSRF, or system slowdowns from denial of service attacks on network resources.

Compliance Impact

This vulnerability could lead to unauthorized data exposure or network access, violating GDPR's data protection principles or HIPAA's security requirements for safeguarding sensitive information. Non-compliance risks include legal penalties and reputational damage.

Mitigation Strategies

Upgrade libxml2 to version 2.15.4 or later. Ensure applications using libxml2 set XML_PARSE_NONET and other relevant parseFlags during XInclude processing to block unintended network access. Review and update custom resource loaders to respect these flags.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86144. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart