CVE-2026-6732
published 2026-04-23CVE-2026-6732: A flaw was found in libxml2. This vulnerability occurs when the library processes a specially crafted XML Schema Definition (XSD) validated document that…
PriorityP343high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.63%
46.6th percentile
A flaw was found in libxml2. This vulnerability occurs when the library processes a specially crafted XML Schema Definition (XSD) validated document that includes an internal entity reference. An attacker could exploit this by providing a malicious document, leading to a type confusion error that causes the application to crash. This results in a denial of service (DoS), making the affected system or application unavailable.
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ibm | aix | — | — |
| ibm | aix | >= 7.2.5 < 7.2.5.12 | 7.2.5.12 |
| ibm | aix | >= 7.3.2 < 7.3.3.3 | 7.3.3.3 |
| ibm | vios | — | — |
| ibm | vios | >= 4.1.0 < 4.1.1.30 | 4.1.1.30 |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | openshift_container_platform | — | — |
| ubuntu | libxml2 | — | — |
| xmlsoft | libxml2 | — | — |
| xmlsoft | libxml2 | >= 2.13.0 < 2.15.3 | 2.15.3 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_redhat6.5MEDIUM
vendor_ubuntu6.2MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
libxml2 vulnerabilities
vendor_ubuntu·2026-06-22·CVSS 6.2
CVE-2026-1757 [MEDIUM] libxml2 vulnerabilities
Title: libxml2 vulnerabilities
Summary: Several security issues were fixed in libxml2.
It was discovered that libxml2 did not properly release memory allocated in
the xmllint utility. An attacker could possibly use this issue to cause a
denial of service. (CVE-2026-1757)
A type confusion vulnerability was found in libxml2 when processing a
specially crafted XML document. A remote attacker could possibly use this
issue to cause a denial of service. (CVE-2026-6732)
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
libxml2: libxml2: Denial of Service via crafted XSD-validated document
vendor_redhat·2026-04-16·CVSS 6.5
CVE-2026-6732 [MEDIUM] CWE-843 libxml2: libxml2: Denial of Service via crafted XSD-validated document
libxml2: libxml2: Denial of Service via crafted XSD-validated document
A flaw was found in libxml2. This vulnerability occurs when the library processes a specially crafted XML Schema Definition (XSD) validated document that includes an internal entity reference. An attacker could exploit this by providing a malicious document, leading to a type confusion error that causes the application to crash. This results in a denial of service (DoS), making the affected system or application unavailable.
Statement: Per upstream:
> It's NOT recommended to use this software to process untrusted data. There is a lot of ways that a malicious crafted xml could exploit a hidden vulnerability in the software.
Package: libxml2 (Red Hat Enterprise Linux 10) - Fix deferred
Package: libxml2 (Red Hat Enterp
GHSA
GHSA-6rf6-xrp6-223m: A flaw was found in libxml2
ghsa_unreviewed·2026-04-24
CVE-2026-6732 [MEDIUM] CWE-843 GHSA-6rf6-xrp6-223m: A flaw was found in libxml2
A flaw was found in libxml2. This vulnerability occurs when the library processes a specially crafted XML Schema Definition (XSD) validated document that includes an internal entity reference. An attacker could exploit this by providing a malicious document, leading to a type confusion error that causes the application to crash. This results in a denial of service (DoS), making the affected system or application unavailable.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-43408 kernel: ceph: add a bunch of missing ceph_path_info initializers
bugzilla·2026-05-08
CVE-2026-43408 [MEDIUM] CVE-2026-43408 kernel: ceph: add a bunch of missing ceph_path_info initializers
CVE-2026-43408 kernel: ceph: add a bunch of missing ceph_path_info initializers
In the Linux kernel, the following vulnerability has been resolved:
ceph: add a bunch of missing ceph_path_info initializers
ceph_mdsc_build_path() must be called with a zero-initialized
ceph_path_info parameter, or else the following
ceph_mdsc_free_path_info() may crash.
Example crash (on Linux 6.18.12):
virt_to_cache: Object is not a Slab page!
WARNING: CPU: 184 PID: 2871736 at mm/slub.c:6732 kmem_cache_free+0x316/0x400
[...]
Call Trace:
[...]
ceph_open+0x13d/0x3e0
do_dentry_open+0x134/0x480
vfs_open+0x2a/0xe0
path_openat+0x9a3/0x1160
[...]
cache_from_obj: Wrong slab cache. names_cache but object is from ceph_inode_info
WARNING: CPU: 184 PID: 2871736 at mm/slub.c:6746 kmem_cache_free+0x2dd/0x400
[...]
ke
Bugzilla
CVE-2026-6732 libxml2: libxml2: Denial of Service via crafted XSD-validated document
bugzilla·2026-04-23·CVSS 6.5
CVE-2026-6732 [MEDIUM] CVE-2026-6732 libxml2: libxml2: Denial of Service via crafted XSD-validated document
CVE-2026-6732 libxml2: libxml2: Denial of Service via crafted XSD-validated document
xmlParseReference in parser.c passes ctxt instead of ctxt->userData to the SAX characters / cdataBlock callbacks when emitting the first or last text child of a cached entity tree (parser.c). Every other SAX callsite in the same file correctly passes ctxt->userData.
When xmlSchemaSAXPlug is active, which is the case for every user of xmlTextReaderSetSchema / xmlTextReaderSchemaValidate and for lxml's XMLParser(schema=...), ctxt->userData has been swapped to a _xmlSchemaSAXPlug *. Handing the confused charactersSplit handler a raw xmlParserCtxt * causes it to dereference ctxt->myDoc as the forwarded SAX handler and call myDoc->URL as a function pointer, producing a reliable SIGSEGV on the first internal-e
2026-04-23
Published