Hoch 7.8Software
CVE-2026-86144
libxml2: Mehrere Schwachstellen
Amazon Linux 2, Red Hat Enterprise Linux, IBM QRadar SIEM, IBM MQ, IBM AIX, RESF Rocky Linux, Ubuntu Linux, Oracle…
In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, the XML_PARSE_NONET flag, if (without it) a custom resource loader accesses the internet and triggers XML external entity injection, SSRF, or a denial of service (e.g., for an attacker-controlled internet resource that is intentionally slow).
5. Sep 2026
Original bei CERT-Bund öffnen