A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition (DTD) with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callback handler, where a string is freed twice. This flaw can lead to a denial of service (DoS) due to a reproducible crash in Python applications using the libxml2 SAX bindings.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libxml2Upgrade libxml2-develUpgrade python3-libxml2 | Oct 11, 2026 | Sep 24, 2026 |
| Amazon Linux Ami 2 | — | Upgrade libxml2-develUpgrade libxml2-debuginfoUpgrade libxml2-staticUpgrade libxml2-pythonUpgrade libxml2 | Oct 19, 2026 | Oct 19, 2026 |
| Amazon_linux_2023 | — | Upgrade libxml2-debugsourceUpgrade python3-libxml2Upgrade libxml2Upgrade libxml2-staticUpgrade python3-libxml2-debuginfoUpgrade libxml2-debuginfoUpgrade libxml2-devel | Sep 30, 2026 | Sep 8, 2026 |
| Redhat_linux | — | Upgrade libxml2-develNo solution existsUpgrade libxml2-debuginfoUpgrade libxml2Upgrade libxml2-debugsourceUpgrade libxml2-staticUpgrade python3-libxml2-debuginfoUpgrade python3-libxml2 | Sep 10, 2026 | Mar 8, 2026 |
| Rocky_linux | — | Upgrade libxml2-staticUpgrade python3-libxml2Upgrade libxml2Upgrade python3-libxml2-debuginfoUpgrade libxml2-debuginfoUpgrade libxml2-debugsourceUpgrade libxml2-devel | Sep 28, 2026 | Sep 26, 2026 |
| Ubuntu | — | Upgrade libxml2-16Upgrade python3-libxml2 (Ubuntu Pro)Upgrade python3-libxml2Upgrade libxml2-utils (Ubuntu Pro)Upgrade libxml2-utilsUpgrade libxml2 (Ubuntu Pro)Upgrade libxml2Upgrade python-libxml2 (Ubuntu Pro) | Sep 21, 2026 | Sep 8, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub