CVE-2026-0989
Low
Description
A flaw was identified in the RelaxNG parser of libxml2 related to how external schema inclusions are handled. The parser does not enforce a limit on inclusion depth when resolving nested <include> directives. Specially crafted or overly complex schemas can cause excessive recursion during parsing. This may lead to stack exhaustion and application crashes, creating a denial-of-service risk.
SeverityLow
CVSS3.7
Exploit probability—
Product
Xmlsoft Libxml2
PublishedJan 15, 2026
First seenJan 15, 2026
Weakness typeCWE-674CWE-674
How to fix
Update
- xmlsoft libxml22.15.2 or later
- ibm vios4.1.1.30 or later
- ibm aix7.2.5.12, 7.3.3.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| xmlsoft libxml2 | v < 2.15.2 | 2.15.2 |
| redhat hardened_images | No range specified | — |
| redhat jboss_core_services | No range specified | — |
| redhat openshift_container_platform | 4.0 | — |
| redhat enterprise_linux | 6.0, 7.0, 8.0, 9.0, 10.0 | — |
| ibm vios | 4.1.0 ≤ v < 4.1.1.30, 4.1.2.0 | 4.1.1.30 |
| ibm aix | 7.2.5 ≤ v < 7.2.5.12, 7.3.2 ≤ v < 7.3.3.3, 7.3.4 | 7.2.5.12, 7.3.3.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.