CVEvulnerability

CVE-2026-0990

5.9 MEDIUM Published 2026-01-15 Modified 2026-09-01 Official page ↗
Status
Analyzed
Published
2026-01-15
Last modified
2026-09-01
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.9 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-674

Description

A flaw was found in libxml2, an XML parsing library. This uncontrolled recursion vulnerability occurs in the xmlCatalogXMLResolveURI function when an XML catalog contains a delegate URI entry that references itself. A remote attacker could exploit this configuration-dependent issue by providing a specially crafted XML catalog, leading to infinite recursion and call stack exhaustion. This ultimately results in a segmentation fault, causing a Denial of Service (DoS) by crashing affected applications.

Affected configurations

• redhat hardened images • redhat jboss core services • redhat openshift container platform 4.0 • redhat enterprise linux 6.0 • redhat enterprise linux 7.0 • redhat enterprise linux 8.0 • redhat enterprise linux 9.0 • redhat enterprise linux 10.0 • ibm vios (>= 4.1.0 < 4.1.1.30) • ibm vios 4.1.2.0 • ibm aix (>= 7.2.5 < 7.2.5.12) • ibm aix (>= 7.3.2 < 7.3.3.3) • ibm aix 7.3.4 • xmlsoft libxml2 (< 2.15.2)

Related

Weakness · CWE (1)

  • CWE-674 Uncontrolled Recursion weakness

References