CVE-2026-0992: Libxml2: libxml2: denial of service via crafted xml catalogs
A flaw was found in the libxml2 library. This uncontrolled resource consumption vulnerability occurs when processing XML catalogs that contain repeated <nextCatalog> elements pointing to the same downstream catalog. A remote attacker can exploit this by supplying crafted catalogs, causing the parser to redundantly traverse catalog chains. This leads to excessive CPU consumption and degrades application availability, resulting in a denial-of-service condition.
Other sources
Libxml2: libxml2: denial of service via crafted xml catalogs
— Microsoft
Uncontrolled resource consumption vulnerability in the XML catalog processing logic of the libxml2 library. The issue arises when handling chains of XML catalogs that contain repeated <nextCatalog> elements pointing to the same downstream catalog. During entity resolution, the parser redundantly traverses catalog chains, causing exponential growth in processing time as depth increases. This can be exploited by supplying crafted catalogs to cause excessive CPU consumption and degrade application availability, resulting in a denial-of-service condition.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-0992?
CVE-2026-0992 is classified as a denial of service vulnerability with high severity due to its potential for uncontrolled resource consumption.
How do I fix CVE-2026-0992?
To remedy CVE-2026-0992, users should update to the latest version of libxml2 that addresses this vulnerability.
What causes CVE-2026-0992?
CVE-2026-0992 is caused by processing XML catalogs with repeated <nextCatalog> elements that reference the same downstream catalog, leading to resource exhaustion.
Who is affected by CVE-2026-0992?
CVE-2026-0992 primarily affects users of the libxml2 library, specifically within Red Hat distributions.
Is CVE-2026-0992 exploitable remotely?
Yes, CVE-2026-0992 can be exploited by a remote attacker to cause denial of service by providing specially crafted XML catalogs.