p PatchFirst

CVE-2026-6653

CVE-2026-6653 · libxml2: Use after free in xmlParseInternalSubset via improper entity resolution handling

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Use After Free in libxml2's xmlParseInternalSubset from GNOME libxml2 version 2.9.11 to 2.11.0 allows a remote attacker to cause a denial-of-service via maliciously crafted XML input with improper entity resolution handling.

CVSS 7.0 · High · EPSS 0.4% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • libxml2

    Versions
    • ≥ 2.9.11, < 2.11.0: Affected (semver)

    Update to 2.11.0

  • libxml2 Debian:12

    Versions
    • 2.12.3+dfsg-0exp1
    • 2.12.5+dfsg-0exp1
    • 2.12.6+dfsg-0exp1
    • 2.12.6+dfsg-0exp2
    • 2.12.7+dfsg+really2.9.14-0.1
    • 2.12.7+dfsg+really2.9.14-0.2
    • 2.12.7+dfsg+really2.9.14-0.3
    • 2.12.7+dfsg+really2.9.14-0.4
    • 2.12.7+dfsg+really2.9.14-1
    • 2.12.7+dfsg+really2.9.14-2
    • 2.12.7+dfsg+really2.9.14-2.1
    • 2.12.7+dfsg-1
    • 2.12.7+dfsg-2
    • 2.12.7+dfsg-3
    • 2.13.1+dfsg-0exp1
    • 2.13.3+dfsg-0exp1
    • 2.13.3+dfsg-0exp2
    • 2.14.1+dfsg-0exp1
    • 2.14.2+dfsg-0exp1
    • 2.14.3+dfsg-0exp1
    • 2.14.3+dfsg-0exp2
    • 2.14.3+dfsg-0exp3
    • 2.14.4+dfsg-0exp1
    • 2.14.5+dfsg-0.1
    • 2.14.5+dfsg-0.2
    • 2.14.5+dfsg-0exp1
    • 2.14.5+dfsg-0exp2
    • 2.14.6+dfsg-0.1
    • 2.15.0+dfsg-0.1
    • 2.15.0+dfsg-0.2
    • 2.15.0+dfsg-0.3
    • 2.15.1+dfsg-0.1
    • 2.15.1+dfsg-0.2
    • 2.15.1+dfsg-0.3
    • 2.15.1+dfsg-0.4
    • 2.15.1+dfsg-0.5
    • 2.15.1+dfsg-1
    • 2.15.1+dfsg-2
    • 2.15.2+dfsg-0.1
    • 2.15.3+dfsg-1
    • 2.15.4+dfsg-1
    • 2.9.14+dfsg-1.2
    • 2.9.14+dfsg-1.3
    • 2.9.14+dfsg-1.3~deb12u1
    • 2.9.14+dfsg-1.3~deb12u2
    • 2.9.14+dfsg-1.3~deb12u3
    • 2.9.14+dfsg-1.3~deb12u4
    • 2.9.14+dfsg-1.3~deb12u5
    • 2.9.14+dfsg-1.3~deb12u6
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libxml2 Debian:13

    Versions
    • 2.12.7+dfsg+really2.9.14-2.1
    • 2.12.7+dfsg+really2.9.14-2.1+deb13u1
    • 2.12.7+dfsg+really2.9.14-2.1+deb13u2
    • 2.12.7+dfsg+really2.9.14-2.1+deb13u3
    • 2.13.1+dfsg-0exp1
    • 2.13.3+dfsg-0exp1
    • 2.13.3+dfsg-0exp2
    • 2.14.1+dfsg-0exp1
    • 2.14.2+dfsg-0exp1
    • 2.14.3+dfsg-0exp1
    • 2.14.3+dfsg-0exp2
    • 2.14.3+dfsg-0exp3
    • 2.14.4+dfsg-0exp1
    • 2.14.5+dfsg-0.1
    • 2.14.5+dfsg-0.2
    • 2.14.5+dfsg-0exp1
    • 2.14.5+dfsg-0exp2
    • 2.14.6+dfsg-0.1
    • 2.15.0+dfsg-0.1
    • 2.15.0+dfsg-0.2
    • 2.15.0+dfsg-0.3
    • 2.15.1+dfsg-0.1
    • 2.15.1+dfsg-0.2
    • 2.15.1+dfsg-0.3
    • 2.15.1+dfsg-0.4
    • 2.15.1+dfsg-0.5
    • 2.15.1+dfsg-1
    • 2.15.1+dfsg-2
    • 2.15.2+dfsg-0.1
    • 2.15.3+dfsg-1
    • 2.15.4+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libxml2 Debian:14

    Versions
    • 2.12.7+dfsg+really2.9.14-2.1
    • 2.13.1+dfsg-0exp1
    • 2.13.3+dfsg-0exp1
    • 2.13.3+dfsg-0exp2
    • 2.14.1+dfsg-0exp1
    • 2.14.2+dfsg-0exp1
    • 2.14.3+dfsg-0exp1
    • 2.14.3+dfsg-0exp2
    • 2.14.3+dfsg-0exp3
    • 2.14.4+dfsg-0exp1
    • 2.14.5+dfsg-0exp1
    • 2.14.5+dfsg-0exp2
    Affected ranges
    • ECOSYSTEM: < 2.14.5+dfsg-0.1

    Update to 2.14.5+dfsg-0.1

  • libxml2 Ubuntu:22.04:LTS

    Versions
    • 2.9.12+dfsg-4
    • 2.9.12+dfsg-5
    • 2.9.12+dfsg-6
    • 2.9.13+dfsg-1
    • 2.9.13+dfsg-1build1
    • 2.9.13+dfsg-1ubuntu0.1
    • 2.9.13+dfsg-1ubuntu0.2
    • 2.9.13+dfsg-1ubuntu0.3
    • 2.9.13+dfsg-1ubuntu0.4
    • 2.9.13+dfsg-1ubuntu0.5
    • 2.9.13+dfsg-1ubuntu0.6
    • 2.9.13+dfsg-1ubuntu0.7
    • 2.9.13+dfsg-1ubuntu0.8
    • 2.9.13+dfsg-1ubuntu0.9
    • 2.9.13+dfsg-1ubuntu0.10
    • 2.9.13+dfsg-1ubuntu0.11
    Affected ranges
    • ECOSYSTEM: < 2.9.13+dfsg-1ubuntu0.12

    Update to 2.9.13+dfsg-1ubuntu0.12

  • libxml2 Ubuntu:24.04:LTS

    Versions
    • 2.9.14+dfsg-1.3
    • 2.9.14+dfsg-1.3build1
    • 2.9.14+dfsg-1.3build2
    • 2.9.14+dfsg-1.3build3
    • 2.9.14+dfsg-1.3ubuntu1
    • 2.9.14+dfsg-1.3ubuntu2
    • 2.9.14+dfsg-1.3ubuntu3
    • 2.9.14+dfsg-1.3ubuntu3.1
    • 2.9.14+dfsg-1.3ubuntu3.2
    • 2.9.14+dfsg-1.3ubuntu3.3
    • 2.9.14+dfsg-1.3ubuntu3.4
    • 2.9.14+dfsg-1.3ubuntu3.5
    • 2.9.14+dfsg-1.3ubuntu3.6
    • 2.9.14+dfsg-1.3ubuntu3.7
    Affected ranges
    • ECOSYSTEM: < 2.9.14+dfsg-1.3ubuntu3.8

    Update to 2.9.14+dfsg-1.3ubuntu3.8

Original sources

Check your server →