CVE-2026-0989: Libxml2: unbounded relaxng include recursion leading to stack overflow
A flaw was identified in the RelaxNG parser of libxml2 related to how external schema inclusions are handled. The parser does not enforce a limit on inclusion depth when resolving nested <include> directives. Specially crafted or overly complex schemas can cause excessive recursion during parsing. This may lead to stack exhaustion and application crashes, creating a denial-of-service risk.
Other sources
Libxml2: unbounded relaxng include recursion leading to stack overflow
— Microsoft
Uncontrolled recursion vulnerability in the RelaxNG include handling logic of the libxml2 XML parsing library. The issue arises from the absence of limits on recursive <include> directive resolution. When a deeply nested chain of included RelaxNG schema files is processed, the parser enters unbounded recursion, eventually exhausting the system call stack. This results in a stack overflow and application crash. Exploitation requires attacker-controlled schema input and primarily impacts availability by causing a denial of service.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.11.5-10
Event History
Frequently Asked Questions
What is the severity of CVE-2026-0989?
CVE-2026-0989 is classified as a high severity vulnerability due to the potential for stack overflow attacks.
How do I fix CVE-2026-0989?
To fix CVE-2026-0989, update to a patched version of libxml2 that enforces limits on inclusion depth.
What types of software are affected by CVE-2026-0989?
CVE-2026-0989 affects the libxml2 library used primarily in GNOME applications.
What are the consequences of exploiting CVE-2026-0989?
Exploitation of CVE-2026-0989 can lead to application crashes and potentially allow remote code execution.
Is there a workaround for CVE-2026-0989?
Currently, there is no official workaround for CVE-2026-0989 other than applying the necessary updates.