CVE-2026-0990: Libxml2: libxml2: denial of service via uncontrolled recursion in xml catalog processing
A flaw was found in libxml2, an XML parsing library. This uncontrolled recursion vulnerability occurs in the xmlCatalogXMLResolveURI function when an XML catalog contains a delegate URI entry that references itself. A remote attacker could exploit this configuration-dependent issue by providing a specially crafted XML catalog, leading to infinite recursion and call stack exhaustion. This ultimately results in a segmentation fault, causing a Denial of Service (DoS) by crashing affected applications.
Other sources
Libxml2: libxml2: denial of service via uncontrolled recursion in xml catalog processing
— Microsoft
Uncontrolled recursion vulnerability in the xmlCatalogXMLResolveURI function of the libxml2 XML parsing library. The issue occurs when an XML catalog contains a delegate URI entry that references the catalog itself. During entity resolution, the function recursively resolves the same catalog entry without detecting the cyclic reference. This results in infinite recursion and eventual call stack exhaustion, leading to a segmentation fault. Exploitation is configuration-dependent and primarily impacts availability by allowing an attacker to crash affected applications.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-0990?
The severity of CVE-2026-0990 has been rated as high due to its potential to cause denial of service.
How do I fix CVE-2026-0990?
To fix CVE-2026-0990, update to the latest version of libxml2 that addresses this vulnerability.
What causes CVE-2026-0990?
CVE-2026-0990 is caused by uncontrolled recursion in the xmlCatalogXMLResolveURI function during XML catalog processing.
Who is affected by CVE-2026-0990?
All users of libxml2 that handle XML catalogs with delegate URI entries may be affected by CVE-2026-0990.
How can I test for CVE-2026-0990?
You can test for CVE-2026-0990 by attempting to process an XML catalog that includes recursive delegate URI entries and observing for any denial of service conditions.