CVE-2026-86144
Medium
Description
In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, the XML_PARSE_NONET flag, if (without it) a custom resource loader accesses the internet and triggers XML external entity injection, SSRF, or a denial of service (e.g., for an attacker-controlled internet resource that is intentionally slow).
SeverityMedium
CVSS5.6
Exploit probability—
ProductXmlsoft Libxml2
PublishedSep 5, 2026
First seenSep 5, 2026
Weakness typeCWE-669CWE-669
How to fix
Update
- xmlsoft libxml22.15.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| xmlsoft libxml2 | v < 2.15.4 | 2.15.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.