Skip to content
Fencer Vulns
critical 9.8

CVE-2026-6653 json

libxml2: Use after free in xmlParseInternalSubset via improper entity resolution handling

published 2026-06-22 4 mo ago modified 2026-10-25 14 d ago also EUVD-2026-38232 , JLSEC-2026-1240

cvss
9.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 29%
public exploits
0
none known

Summary

Use After Free in libxml2's xmlParseInternalSubset from GNOME libxml2 version 2.9.11 to 2.11.0 allows a remote attacker to cause a denial-of-service via maliciously crafted XML input with improper entity resolution handling.

Patch / fix

  • julia XML2_jll 2.11.5+0
  • GNOME libxml2 2.11.0
  • libxml2 Debian 14 2.14.5+dfsg-0.1

debian advisories DEBIAN-CVE-2026-6653

  • libxml2 Ubuntu 22.04 LTS 2.9.13+dfsg-1ubuntu0.12
  • libxml2 Ubuntu 24.04 LTS 2.9.14+dfsg-1.3ubuntu3.8

ubuntu advisories UBUNTU-CVE-2026-6653

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • libxml2 RHEL 8 2.9.7-21.el8_10.8
  • python3-libxml2 RHEL 8 2.9.7-21.el8_10.8
  • libxml2 RHEL 9 2.9.13-14.el9_8.4
  • python3-libxml2 RHEL 9 2.9.13-14.el9_8.4

red hat advisories RHSA-2026:69655RHSA-2026:61247

  • libxml2 AlmaLinux 8 2.9.7-21.el8_10.8
  • python3-libxml2 AlmaLinux 8 2.9.7-21.el8_10.8
  • libxml2 AlmaLinux 9 2.9.13-14.el9_8.4
  • python3-libxml2 AlmaLinux 9 2.9.13-14.el9_8.4

almalinux advisories ALSA-2026:69655ALSA-2026:61247

  • libxml2 Rocky Linux 8 2.9.7-21.el8_10.8
  • libxml2 Rocky Linux 9 2.9.13-14.el9_8.4

rocky linux advisories RLSA-2026:69655RLSA-2026:61247

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-6653 updated cvss 5.9

libxml2: mingw-libxml2: libxml2: Denial of Service via crafted XML input due to use-after-free

  • Red Hat OpenShift Container Platform 4 openshift/ose-rhel-coreos-8, openshift/ose-rhel-coreos-9 Red Hat OpenShift Container Platform 5 openshift/ose-rhel-coreos-9
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Cert Manager support for Red Hat OpenShift release 1.17 cert-manager/cert-manager-operator-rhel9 1791788287, cert-manager/jetstack-cert-manager-rhel9 1791371069, cert-manager/cert-manager-istio-csr-rhel9 1791378395, cert-manager/cert-manager-operator-bundle 1791970484, cert-manager/jetstack-cert-manager-acmesolver-rhel9 1791371080
    fixed: vendor fix RHSA-2026:82336
  • Red Hat Cert Manager support for Red Hat OpenShift release 1.18 cert-manager/cert-manager-operator-rhel9 1789029076, cert-manager/jetstack-cert-manager-rhel9 1791459711, cert-manager/cert-manager-istio-csr-rhel9 1791459759, cert-manager/cert-manager-operator-bundle 1791966259, cert-manager/jetstack-cert-manager-acmesolver-rhel9 1791459707
    fixed: vendor fix RHSA-2026:82354
  • Red Hat Cert Manager support for Red Hat OpenShift release 1.20 cert-manager/cert-manager-operator-rhel9 1790272426, cert-manager/cert-manager-operator-rhel9 1790589855, cert-manager/jetstack-cert-manager-rhel9 1790223279, cert-manager/jetstack-cert-manager-rhel9 1790589912, cert-manager/cert-manager-istio-csr-rhel9 1790223719, cert-manager/cert-manager-istio-csr-rhel9 1790589914, +2 more
    fixed: vendor fix RHSA-2026:72475
  • Red Hat Discovery 2 discovery/discovery-server-rhel9 1788205779
    fixed: vendor fix RHSA-2026:61783
  • Red Hat Enterprise Linux AppStream (v. 8) libxml2-devel 2.9.7-21.el8_10.8, libxml2-debuginfo 2.9.7-21.el8_10.8, libxml2-debugsource 2.9.7-21.el8_10.8, python3-libxml2-debuginfo 2.9.7-21.el8_10.8
    fixed: vendor fix RHSA-2026:69655
  • Red Hat Enterprise Linux AppStream (v. 9) libxml2-devel 2.9.13-14.el9_8.4, libxml2-debuginfo 2.9.13-14.el9_8.4, libxml2-debugsource 2.9.13-14.el9_8.4, python3-libxml2-debuginfo 2.9.13-14.el9_8.4
    fixed: vendor fix RHSA-2026:61247
  • Red Hat Enterprise Linux AppStream AUS (v.8.4) libxml2-devel 2.9.7-9.el8_4.20, libxml2-debuginfo 2.9.7-9.el8_4.20, libxml2-debugsource 2.9.7-9.el8_4.20, python3-libxml2-debuginfo 2.9.7-9.el8_4.20
    fixed: vendor fix RHSA-2026:93473
show 24 more
  • Red Hat Enterprise Linux AppStream AUS (v.8.6) libxml2-devel 2.9.7-13.el8_6.24, libxml2-debuginfo 2.9.7-13.el8_6.24, libxml2-debugsource 2.9.7-13.el8_6.24, python3-libxml2-debuginfo 2.9.7-13.el8_6.24
    fixed: vendor fix RHSA-2026:92589
  • Red Hat Enterprise Linux AppStream E4S (v.8.8) libxml2-devel 2.9.7-16.el8_8.24, libxml2-debuginfo 2.9.7-16.el8_8.24, libxml2-debugsource 2.9.7-16.el8_8.24, python3-libxml2-debuginfo 2.9.7-16.el8_8.24
    fixed: vendor fix RHSA-2026:93463
  • Red Hat Enterprise Linux AppStream E4S (v.9.2) libxml2-devel 2.9.13-3.el9_2.20, libxml2-debuginfo 2.9.13-3.el9_2.20, libxml2-debugsource 2.9.13-3.el9_2.20, python3-libxml2-debuginfo 2.9.13-3.el9_2.20
    fixed: vendor fix RHSA-2026:92352
  • Red Hat Enterprise Linux AppStream E4S (v.9.4) libxml2-devel 2.9.13-13.el9_4.10, libxml2-debuginfo 2.9.13-13.el9_4.10, libxml2-debugsource 2.9.13-13.el9_4.10, python3-libxml2-debuginfo 2.9.13-13.el9_4.10
    fixed: vendor fix RHSA-2026:89750
  • Red Hat Enterprise Linux AppStream EUS (v.9.6) libxml2-devel 2.9.13-13.el9_6, libxml2-debuginfo 2.9.13-13.el9_6, libxml2-debugsource 2.9.13-13.el9_6, python3-libxml2-debuginfo 2.9.13-13.el9_6
    fixed: vendor fix RHSA-2026:90309
  • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) libxml2-devel 2.9.7-9.el8_4.20, libxml2-debuginfo 2.9.7-9.el8_4.20, libxml2-debugsource 2.9.7-9.el8_4.20, python3-libxml2-debuginfo 2.9.7-9.el8_4.20
    fixed: vendor fix RHSA-2026:93473
  • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) libxml2-devel 2.9.7-13.el8_6.24, libxml2-debuginfo 2.9.7-13.el8_6.24, libxml2-debugsource 2.9.7-13.el8_6.24, python3-libxml2-debuginfo 2.9.7-13.el8_6.24
    fixed: vendor fix RHSA-2026:92589
  • Red Hat Enterprise Linux AppStream TUS (v.8.8) libxml2-devel 2.9.7-16.el8_8.24, libxml2-debuginfo 2.9.7-16.el8_8.24, libxml2-debugsource 2.9.7-16.el8_8.24, python3-libxml2-debuginfo 2.9.7-16.el8_8.24
    fixed: vendor fix RHSA-2026:93463
  • Red Hat Enterprise Linux BaseOS (v. 8) libxml2 2.9.7-21.el8_10.8, python3-libxml2 2.9.7-21.el8_10.8
    fixed: vendor fix RHSA-2026:69655
  • Red Hat Enterprise Linux BaseOS (v. 9) libxml2 2.9.13-14.el9_8.4, python3-libxml2 2.9.13-14.el9_8.4
    fixed: vendor fix RHSA-2026:61247
  • Red Hat Enterprise Linux BaseOS AUS (v.8.4) libxml2 2.9.7-9.el8_4.20, python3-libxml2 2.9.7-9.el8_4.20
    fixed: vendor fix RHSA-2026:93473
  • Red Hat Enterprise Linux BaseOS AUS (v.8.6) libxml2 2.9.7-13.el8_6.24, python3-libxml2 2.9.7-13.el8_6.24
    fixed: vendor fix RHSA-2026:92589
  • Red Hat Enterprise Linux BaseOS E4S (v.8.8) libxml2 2.9.7-16.el8_8.24, python3-libxml2 2.9.7-16.el8_8.24
    fixed: vendor fix RHSA-2026:93463
  • Red Hat Enterprise Linux BaseOS E4S (v.9.2) libxml2 2.9.13-3.el9_2.20, python3-libxml2 2.9.13-3.el9_2.20
    fixed: vendor fix RHSA-2026:92352
  • Red Hat Enterprise Linux BaseOS E4S (v.9.4) libxml2 2.9.13-13.el9_4.10, python3-libxml2 2.9.13-13.el9_4.10
    fixed: vendor fix RHSA-2026:89750
  • Red Hat Enterprise Linux BaseOS EUS (v.9.6) libxml2 2.9.13-13.el9_6, python3-libxml2 2.9.13-13.el9_6
    fixed: vendor fix RHSA-2026:90309
  • Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) libxml2 2.9.7-9.el8_4.20, python3-libxml2 2.9.7-9.el8_4.20
    fixed: vendor fix RHSA-2026:93473
  • Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6) libxml2 2.9.7-13.el8_6.24, python3-libxml2 2.9.7-13.el8_6.24
    fixed: vendor fix RHSA-2026:92589
  • Red Hat Enterprise Linux BaseOS TUS (v.8.8) libxml2 2.9.7-16.el8_8.24, python3-libxml2 2.9.7-16.el8_8.24
    fixed: vendor fix RHSA-2026:93463
  • Red Hat OpenShift AI 3.0 rhai/base-image-cpu-rhel9 1793042072, rhai/base-image-cpu-rhel9 1793329709, rhai/base-image-tpu-rhel9 1793041987, rhai/base-image-cuda-rhel9 1793042067, rhai/base-image-cuda-rhel9 1793328358, rhai/base-image-rocm-rhel9 1793041981, +1 more
    fixed: vendor fix RHSA-2026:94459
  • Red Hat OpenShift AI 3.4 rhai/base-image-cpu-rhel9 1793042088, rhai/base-image-tpu-rhel9 1793042006, rhai/base-image-gaudi-rhel9 1793042011, rhai/base-image-spyre-rhel9 1793042074, rhai/base-image-neuron-rhel9 1793042008, rhai/base-image-rocm-6.4-rhel9 1793041995, +4 more
    fixed: vendor fix RHSA-2026:91241
  • Red Hat OpenShift AI 3.5 rhai/base-image-cpu-rhel9 1793042162, rhai/base-image-tpu-rhel9 1793042010, rhai/base-image-gaudi-rhel9 1793042004, rhai/base-image-rubin-rhel9 1793042092, rhai/base-image-spyre-rhel9 1793042114, rhai/base-image-neuron-rhel9 1793042008, +4 more
    fixed: vendor fix RHSA-2026:91204
  • Red Hat Update Infrastructure 5 rhui5/cds-rhel9 1788880464, rhui5/rhua-rhel9 1788880581, rhui5/haproxy-rhel9 1788880456, rhui5/installer-rhel9 1788765051, rhui5/cds-kubernetes-rhel9 1788880445
    fixed: vendor fix RHSA-2026:66018
  • Red Hat Cert Manager support for Red Hat OpenShift release 1.20 cert-manager/jetstack-cert-manager-acmesolver-rhel9 1790223630 Red Hat Discovery 2 discovery/discovery-ui-rhel9 1788206196 Red Hat Enterprise Linux 6 libxml2, libxml2-python Red Hat Enterprise Linux 7 libxml2, libxml2-python Red Hat Enterprise Linux 10 libxml2 Red Hat Hardened Images libxml2
    +1 more products
    Red Hat OpenShift AI (RHOAI) rhoai/odh-llama-stack-k8s-operator-rhel9
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-26-293-05 updated cvss 8.8

Hitachi Energy RTU500 Product

  • Hitachi Energy RTU500 series CMU Firmware vers:RTU500_series_CMU_Firmware/>=13.5.1, <=13.5.4, vers:RTU500_series_CMU_Firmware/>=13.6.1, <=13.6.3, vers:RTU500_series_CMU_Firmware/>=13.7.1, <=13.7.8, vers:RTU500_series_CMU_Firmware/>=13.8.1, <=13.8.2
    affected: vendor fix, mitigation

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
4 mo ago

Exploit prediction

0.36% chance of exploitation in the next 30 days, higher than 29% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • gitlab.gnome.org https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1058 referenced PoC, tagged "exploit" by a source, unverified
  • bugs.launchpad.net https://bugs.launchpad.net/ubuntu/+source/libxml2/+bug/2141260 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 4.0 7.0 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
CNA 4.0 7.0 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
OSV 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
julia XML2_jll
<2.11.5+0
2.11.5+0

Affected products

  • GNOME libxml2

Classification

Weakness
  • CWE-416 Use After Free
  • CWE-611 Improper Restriction of XML External Entity Reference

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.