CVSS 3.1
2.9 lowCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:LCVE-2026-0992
Low (2.9). EPSS 0.5% chance of exploitation in the next 30 days.
A flaw was found in the libxml2 library. This uncontrolled resource consumption vulnerability occurs when processing XML catalogs that contain repeated <nextCatalog> elements pointing to the same downstream catalog. A remote attacker can exploit this by supplying crafted catalogs, causing the parser to redundantly traverse catalog chains. This leads to excessive CPU consumption and degrades application availability, resulting in a denial-of-service condition.
Severity
- EPSS
- 0.5% chance of exploitation in the next 30 days; higher than 39% of CVEs (scores of 2026-10-31)
- CWE
- CWE-400
- Published
- Modified
- Record from
- the NVD, synced
Affected
- ibm:aix
- ibm:vios
- redhat:enterprise_linux
- redhat:hardened_images
- redhat:jboss_core_services
- redhat:openshift_container_platform
- xmlsoft:libxml2