PT-2026-3019 · Libxml2+3 · Libxml2+3

Published 2026-01-01 · Updated 2026-04-29 · CVE-2026-0992

Positive Technologies (AI Summary)

CVSS v3.1

2.9

Low

Base vector

AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions libxml2 (affected versions not specified)

Description An issue exists in the libxml2 library related to uncontrolled resource consumption. The problem occurs when processing XML catalogs containing repeated <nextCatalog> elements that point to the same downstream catalog. An attacker can exploit this by providing crafted catalogs, causing the parser to repeatedly traverse catalog chains. This leads to excessive CPU usage and can result in a denial-of-service condition. The issue degrades application availability.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

AZL-74778

AZL-74783

BDU:2026-03632

CVE-2026-0992

ECHO-6716-1C27-CA2E

MGASA-2026-0027

OESA-2026-1598

OPENSUSE-SU-2026:10213-1

OPENSUSE-SU-2026:20312-1

RHSA-2026:7519

SUSE-SU-2026:0568-1

SUSE-SU-2026:0570-1

SUSE-SU-2026:0605-1

SUSE-SU-2026:0606-1

SUSE-SU-2026:0782-1

SUSE-SU-2026:20631-1

SUSE-SU-2026:20647-1

SUSE-SU-2026:20657-1

SUSE-SU-2026:20707-1

USN-7974-1

Affected Products

Linuxmint

Red Os

Ubuntu

Libxml2

References · 79

• https://osv.dev/vulnerability/SUSE-SU-2026:0568-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:20647-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7974-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:20707-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-0992 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:0605-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-0992 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-13-CVE-2026-0992 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-0992 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0782-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2026-0027 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2026-0421SE17 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-0992 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-74783 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:20312-1 · Vendor Advisory