A flaw was found in libxml2. A local user or an attacker providing a specially crafted XML catalog can trigger a NULL pointer dereference during XML catalog parsing. This occurs when a `nextCatalog` element lacks its mandatory `catalog` attribute, leading to the application crashing and causing a Denial of Service (DoS).
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade python3-libxml2Upgrade libxml2-staticUpgrade libxml2-develUpgrade libxml2-debuginfoUpgrade libxml2Upgrade python3-libxml2-debuginfoUpgrade libxml2-debugsource | Nov 2, 2026 | Sep 17, 2026 |
| Redhat_linux | — | No solution exists | Sep 21, 2026 | Aug 19, 2026 |
| Ubuntu | — | Upgrade libxml2Upgrade libxml2-devUpgrade libxml2-sourceUpgrade libxml2-dev (Ubuntu Pro)Upgrade libxml2 (Ubuntu Pro)Upgrade libxml2-16 | Oct 12, 2026 | Oct 8, 2026 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub