{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-74860 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-74860 is a high-severity use after free vulnerability in Cert Manager support for Red Hat OpenShift release 1.20, published on 8 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-74860 and fix it if it is affected.\n\nWhat it is: CVE-2026-74860 is a high-severity use after free vulnerability in Cert Manager support for Red Hat OpenShift release 1.20, published on 8 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-74860 in the wild and no public exploit code.\n\nAffected product: Cert Manager support for Red Hat OpenShift release 1.20. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-74860/ (Markdown: https://insights.sbomify.com/CVE-2026-74860/index.md)","id":"CVE-2026-74860","markdown":"https://insights.sbomify.com/CVE-2026-74860/index.md","name":"CVE-2026-74860","record":{"aliases":["AZL-100941","BELL-CVE-2026-74860","CLSA-2026-1790786185","CLSA-2026-1790833998","CLSA-2026-1791280039","CLSA-2026-1791372460","CLSA-2026-1791489916","CLSA-2026-1791493216","CLSA-2026-1791551729","DEBIAN-CVE-2026-74860","ECHO-88ec-e122-3747","GHSA-8626-cqqj-mfff","ROOT-OS-DEBIAN-12-CVE-2026-74860","ROOT-OS-DEBIAN-13-CVE-2026-74860","UBUNTU-CVE-2026-74860"],"analysis":{"component_type":"library","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"yes","non_default_config":true,"product_category":"libxml2 Python bindings","requires_auth":"low_privilege","summary":"A double-free vulnerability in libxml2 Python bindings allows remote attackers to cause a denial of service via crafted XML documents.","user_interaction":"not_required","vuln_class":"use_after_free"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"redhat","cpe":[],"cvss":{"score":8.5,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"cwes":[{"id":"CWE-763","name":"Release of Invalid Pointer or Reference"}],"description":"A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition (DTD) with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callback handler, where a string is freed twice. This flaw can lead to a denial of service (DoS) due to a reproducible crash in Python applications using the libxml2 SAX bindings.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Libxml2: double-free/uaf in libxml2 python bindings","id":"CVE-2026-74860","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"use_after_free","year":"2026"},"n_packages":0,"n_references":38,"next":{"headline":"Authentication Bypass in sogo_yhn","id":"CVE-2026-74864"},"packages":[],"prev":{"headline":"Gnome-tweaks: path traversal in theme installer","id":"CVE-2026-74859"},"products":["Cert Manager support for Red Hat OpenShift release 1.20","Red Hat Cost Management On-Premise 1","Red Hat Enterprise Linux 10","Red Hat Enterprise Linux 10.0 Extended Update Support","Red Hat Enterprise Linux 6","Red Hat Enterprise Linux 7","Red Hat Enterprise Linux 8","Red Hat Enterprise Linux 9","Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions","Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions","Red Hat Enterprise Linux 9.6 Extended Update Support","Red Hat Hardened Images","Red Hat OpenShift AI 3.0","Red Hat OpenShift AI 3.4","Red Hat OpenShift AI 3.5","Red Hat OpenShift Container Platform 4","Red Hat Update Infrastructure 5"],"published":"2026-09-08","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-10-29","vendors":["Red Hat"]},"summary":"A double-free vulnerability in libxml2 Python bindings allows remote attackers to cause a denial of service via crafted XML documents.","url":"https://insights.sbomify.com/CVE-2026-74860/"}