CVE-2026-0989: Libxml2: unbounded relaxng include recursion leading to stack overflow
A flaw was identified in the RelaxNG parser of libxml2 related to how external schema inclusions are handled. The parser does not enforce a limit on inclusion depth when resolving nested <include> directives. Specially crafted or overly complex schemas can cause excessive recursion during parsing. This may lead to stack exhaustion and application crashes, creating a denial-of-service risk.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-0989?
CVE-2026-0989 is classified as a high severity vulnerability due to the potential for stack overflow attacks.
How do I fix CVE-2026-0989?
To fix CVE-2026-0989, update to a patched version of libxml2 that enforces limits on inclusion depth.
What types of software are affected by CVE-2026-0989?
CVE-2026-0989 affects the libxml2 library used primarily in GNOME applications.
What are the consequences of exploiting CVE-2026-0989?
Exploitation of CVE-2026-0989 can lead to application crashes and potentially allow remote code execution.
Is there a workaround for CVE-2026-0989?
Currently, there is no official workaround for CVE-2026-0989 other than applying the necessary updates.