CVE-2026-6732 Libxml2: libxml2: denial of service via crafted xsd-validated document
An attacker can cause a denial of service by providing a crafted XSD-validated document with an internal entity reference, leading to a crash.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-6732?
CVE-2026-6732 is a medium-severity denial of service vulnerability in Ibm Aix, published on 23 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A flaw was found in libxml2. This vulnerability occurs when the library processes a specially crafted XML Schema Definition (XSD) validated document that includes an internal entity reference. An attacker could exploit this by providing a malicious document, leading to a type confusion error that causes the application to crash. This results in a denial of service (DoS), making the affected system or application unavailable.
Weakness: CWE-843
Which versions are affected by CVE-2026-6732?
It affects 7 products.
Products include Ibm Aix, Ibm Vios, Redhat Enterprise Linux, Redhat Hardened Images, Redhat Jboss Core Services, Redhat Openshift Container Platform and 1 more.
How do I fix CVE-2026-6732?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-6732 being exploited?
There is no known exploitation of CVE-2026-6732 in the wild and no public exploit code.
Other vulnerabilities in Ibm Aix
Sources
Also known as ALPINE-CVE-2026-6732, BELL-CVE-2026-6732, DEBIAN-CVE-2026-6732, GHSA-6rf6-xrp6-223m, JLSEC-2026-1241, MGASA-2026-0248 and 2 more.