CVE-2026-0990 Libxml2: libxml2: denial of service via uncontrolled recursion in xml catalog processing
Remote attackers can crash applications using libxml2 by supplying a crafted XML catalog with self-referencing delegates, causing infinite recursion and stack exhaustion.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-0990?
CVE-2026-0990 is a medium-severity denial of service vulnerability in Ibm Aix, published on 15 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in libxml2, an XML parsing library. This uncontrolled recursion vulnerability occurs in the xmlCatalogXMLResolveURI function when an XML catalog contains a delegate URI entry that references itself. A remote attacker could exploit this configuration-dependent issue by providing a specially crafted XML catalog, leading to infinite recursion and call stack exhaustion. This ultimately results in a segmentation fault, causing a Denial of Service (DoS) by crashing affected applications.
Weakness: CWE-674
Which versions are affected by CVE-2026-0990?
It affects 7 products.
Products include Ibm Aix, Ibm Vios, Redhat Enterprise Linux, Redhat Hardened Images, Redhat Jboss Core Services, Redhat Openshift Container Platform and 1 more.
How do I fix CVE-2026-0990?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-0990 being exploited?
There is no known exploitation of CVE-2026-0990 in the wild and no public exploit code.
Other vulnerabilities in Ibm Aix
Sources
Also known as AZL-74772, AZL-74780, BELL-CVE-2026-0990, DEBIAN-CVE-2026-0990, ECHO-7b93-f475-2a93, GHSA-2j3v-cxmf-cmp7 and 2 more.