Skip to content
Sign in
8.5 High

CVE-2026-74860 Libxml2: double-free/uaf in libxml2 python bindings

Description

A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition (DTD) with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callback handler, where a string is freed twice. This flaw can lead to a denial of service (DoS) due to a reproducible crash in Python applications using the libxml2 SAX bindings.

CVSS 3.1 detail

Vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Exploitable remotely over the network, with an ordinary account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector
Network
Attack complexity
High
Privileges required
Low
Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

Affected products and versions

Product Affected versions Fixed in
Red Hat Enterprise Linux 10 Versions not published
Red Hat Enterprise Linux 6 Versions not published
Red Hat Enterprise Linux 7 Versions not published
Red Hat Enterprise Linux 8 Versions not published
Red Hat Enterprise Linux 9 Versions not published
Red Hat Hardened Images Versions not published
Red Hat OpenShift Container Platform 4 Versions not published
Cert Manager support for Red Hat OpenShift release 1.20 1790589855 earliest → < 1790589855 1790589855
Red Hat Cost Management On-Premise 1 1791460851 earliest → < 1791460851 1791460851
Show the 17 other branches
Product Affected versions Fixed in
Red Hat Update Infrastructure 5 1791978693 earliest → < 1791978693 1791978693
Red Hat Enterprise Linux 10.0 Extended Update Support Versions not published
Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions Versions not published
Red Hat Enterprise Linux 9.6 Extended Update Support Versions not published
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Versions not published
Red Hat OpenShift AI 3.0 1793328358 earliest → < 1793328358 1793328358
Red Hat OpenShift AI 3.4 1793326837 earliest → < 1793326837 1793326837
Red Hat OpenShift AI 3.5 1793327660 earliest → < 1793327660 1793327660
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support Versions not published
Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On Versions not published
Red Hat OpenShift Container Platform 5 Versions not published
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Versions not published
Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On Versions not published
Red Hat Enterprise Linux 8.8 Telecommunications Update Service Versions not published
Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions Versions not published
Red Hat Enterprise Linux 7 Extended Lifecycle Support Versions not published
Red Hat OpenShift AI (RHOAI) Versions not published

Other CVEs of Red Hat Enterprise Linux 10

The 1456 CVEs of Red Hat Enterprise Linux 10 →
CVE-2026-123876 Podman: containers-common: containers-common: default seccomp af_vsock/netlink_audit deny rules bypassable via 32-bit truncation 4.4 Medium CVE-2026-120749 Dbus: dbus-daemon: dbus-daemon aborts (reply_serial != 0) when a broadcast from the driver cannot be delivered to a monitored bus 6.2 Medium CVE-2026-123037 Ansible-core: user module generate_ssh_key follows a symlinked ~/.ssh enabling local privilege escalation (incomplete fix of cve-2024-9902) 6.7 Medium CVE-2026-123151 Gdb: gdb: stack buffer overflow in parse_tsv_definition via stale rs->buf tail Not rated
Track this CVE