Security update for libxml2 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2026:0568-1 Final 1 1 2026-02-17T12:26:27Z current 2026-02-17T12:26:27Z 2026-02-17T12:26:27Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for libxml2 This update for libxml2 fixes the following issues: - CVE-2026-0990: Fixed a call stack overflow leading to application crash due to infinite recursion in `xmlCatalogXMLResolveURI`. (bsc#1256807, bsc#1256811) - CVE-2026-0992: Fixed an excessive resource consumption when processing XML catalogs due to exponential behavior. (bsc#1256809, bsc#1256812) - CVE-2026-1757: Fixed a memory leak in the `xmllint` interactive shell. (bsc#1257594, bsc#1257595) - CVE-2025-10911: Fixed a use-after-free with key data stored cross-RVT. (bsc#1250553) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Container suse/sle-micro-rancher/5.2:latest-2026-568,SUSE-2026-568,SUSE-SUSE-MicroOS-5.2-2026-568,openSUSE-SLE-15.6-2026-568 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2026/suse-su-20260568-1/ Link for SUSE-SU-2026:0568-1 https://lists.suse.com/pipermail/sle-security-updates/2026-February/024333.html E-Mail link for SUSE-SU-2026:0568-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1250553 SUSE Bug 1250553 https://bugzilla.suse.com/1256807 SUSE Bug 1256807 https://bugzilla.suse.com/1256808 SUSE Bug 1256808 https://bugzilla.suse.com/1256809 SUSE Bug 1256809 https://bugzilla.suse.com/1256811 SUSE Bug 1256811 https://bugzilla.suse.com/1256812 SUSE Bug 1256812 https://bugzilla.suse.com/1257593 SUSE Bug 1257593 https://bugzilla.suse.com/1257594 SUSE Bug 1257594 https://bugzilla.suse.com/1257595 SUSE Bug 1257595 https://www.suse.com/security/cve/CVE-2025-10911/ SUSE CVE CVE-2025-10911 page https://www.suse.com/security/cve/CVE-2026-0990/ SUSE CVE CVE-2026-0990 page https://www.suse.com/security/cve/CVE-2026-0992/ SUSE CVE CVE-2026-0992 page https://www.suse.com/security/cve/CVE-2026-1757/ SUSE CVE CVE-2026-1757 page Container suse/sle-micro-rancher/5.2:latest SUSE Linux Enterprise Micro 5.2 openSUSE Leap 15.6 libxml2-2-2.9.7-150000.3.94.1 libxml2-2-32bit-2.9.7-150000.3.94.1 libxml2-2-64bit-2.9.7-150000.3.94.1 libxml2-devel-2.9.7-150000.3.94.1 libxml2-devel-32bit-2.9.7-150000.3.94.1 libxml2-devel-64bit-2.9.7-150000.3.94.1 libxml2-doc-2.9.7-150000.3.94.1 libxml2-tools-2.9.7-150000.3.94.1 python2-libxml2-python-2.9.7-150000.3.94.1 python3-libxml2-python-2.9.7-150000.3.94.1 libxml2-2-2.9.7-150000.3.94.1 as a component of Container suse/sle-micro-rancher/5.2:latest libxml2-2-2.9.7-150000.3.94.1 as a component of SUSE Linux Enterprise Micro 5.2 libxml2-tools-2.9.7-150000.3.94.1 as a component of SUSE Linux Enterprise Micro 5.2 python3-libxml2-python-2.9.7-150000.3.94.1 as a component of SUSE Linux Enterprise Micro 5.2 python3-libxml2-python-2.9.7-150000.3.94.1 as a component of openSUSE Leap 15.6 A use-after-free vulnerability was found in libxslt while parsing xsl nodes that may lead to the dereference of expired pointers and application crash. CVE-2025-10911 Container suse/sle-micro-rancher/5.2:latest:libxml2-2-2.9.7-150000.3.94.1 SUSE Linux Enterprise Micro 5.2:libxml2-2-2.9.7-150000.3.94.1 SUSE Linux Enterprise Micro 5.2:libxml2-tools-2.9.7-150000.3.94.1 SUSE Linux Enterprise Micro 5.2:python3-libxml2-python-2.9.7-150000.3.94.1 openSUSE Leap 15.6:python3-libxml2-python-2.9.7-150000.3.94.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260568-1/ https://www.suse.com/security/cve/CVE-2025-10911.html CVE-2025-10911 https://bugzilla.suse.com/1250553 SUSE Bug 1250553 A flaw was found in libxml2, an XML parsing library. This uncontrolled recursion vulnerability occurs in the xmlCatalogXMLResolveURI function when an XML catalog contains a delegate URI entry that references itself. A remote attacker could exploit this configuration-dependent issue by providing a specially crafted XML catalog, leading to infinite recursion and call stack exhaustion. This ultimately results in a segmentation fault, causing a Denial of Service (DoS) by crashing affected applications. CVE-2026-0990 Container suse/sle-micro-rancher/5.2:latest:libxml2-2-2.9.7-150000.3.94.1 SUSE Linux Enterprise Micro 5.2:libxml2-2-2.9.7-150000.3.94.1 SUSE Linux Enterprise Micro 5.2:libxml2-tools-2.9.7-150000.3.94.1 SUSE Linux Enterprise Micro 5.2:python3-libxml2-python-2.9.7-150000.3.94.1 openSUSE Leap 15.6:python3-libxml2-python-2.9.7-150000.3.94.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260568-1/ https://www.suse.com/security/cve/CVE-2026-0990.html CVE-2026-0990 https://bugzilla.suse.com/1256806 SUSE Bug 1256806 A flaw was found in the libxml2 library. This uncontrolled resource consumption vulnerability occurs when processing XML catalogs that contain repeated <nextCatalog> elements pointing to the same downstream catalog. A remote attacker can exploit this by supplying crafted catalogs, causing the parser to redundantly traverse catalog chains. This leads to excessive CPU consumption and degrades application availability, resulting in a denial-of-service condition. CVE-2026-0992 Container suse/sle-micro-rancher/5.2:latest:libxml2-2-2.9.7-150000.3.94.1 SUSE Linux Enterprise Micro 5.2:libxml2-2-2.9.7-150000.3.94.1 SUSE Linux Enterprise Micro 5.2:libxml2-tools-2.9.7-150000.3.94.1 SUSE Linux Enterprise Micro 5.2:python3-libxml2-python-2.9.7-150000.3.94.1 openSUSE Leap 15.6:python3-libxml2-python-2.9.7-150000.3.94.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260568-1/ https://www.suse.com/security/cve/CVE-2026-0992.html CVE-2026-0992 https://bugzilla.suse.com/1256808 SUSE Bug 1256808 A flaw was identified in the interactive shell of the xmllint utility, part of the libxml2 project, where memory allocated for user input is not properly released under certain conditions. When a user submits input consisting only of whitespace, the program skips command execution but fails to free the allocated buffer. Repeating this action causes memory to continuously accumulate. Over time, this can exhaust system memory and terminate the xmllint process, creating a denial-of-service condition on the local system. CVE-2026-1757 Container suse/sle-micro-rancher/5.2:latest:libxml2-2-2.9.7-150000.3.94.1 SUSE Linux Enterprise Micro 5.2:libxml2-2-2.9.7-150000.3.94.1 SUSE Linux Enterprise Micro 5.2:libxml2-tools-2.9.7-150000.3.94.1 SUSE Linux Enterprise Micro 5.2:python3-libxml2-python-2.9.7-150000.3.94.1 openSUSE Leap 15.6:python3-libxml2-python-2.9.7-150000.3.94.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260568-1/ https://www.suse.com/security/cve/CVE-2026-1757.html CVE-2026-1757 https://bugzilla.suse.com/1257593 SUSE Bug 1257593