Skip to content
Advisories.
Red HatCVE-2026-74860

Red Hat libxml2 with Python bindings enabled: denial of service

High8.5CVE-2026-74860 · Published Sep 8, 2026 · updated Sep 24, 2026

A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition (DTD) with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callback handler, where a string is freed twice. This flaw can lead to a denial of service (DoS) due to a reproducible crash in Python applications using the libxml2 SAX bindings.

Red Hat advisory

Affected versions

PackageAffectedFixed in
Red Hat Enterprise Linux 10
Product
all versionsNo fix yet
Red Hat Enterprise Linux 6
Product
all versionsNo fix yet
Red Hat Enterprise Linux 7
Product
all versionsNo fix yet
Red Hat Enterprise Linux 8
Product
all versionsNo fix yet
Red Hat Enterprise Linux 9
Product
all versionsNo fix yet
Red Hat Hardened Images
Product
all versionsNo fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-763

More Red Hat advisories

All Red Hat
Advisory
Red Hat DPDK lib/vhost. Missing length validation: out-of-bounds read
Low3.3Sep 8
Red Hat gdk-pixbuf. This vulnerability: out-of-bounds read
Medium6.1Sep 8
Red Hat build of Apache Camel - HawtIO 4: improper privilege management
High8.2Sep 8
Red Hat build of Apache Camel - HawtIO 4: improper certificate validation
Critical9.9Sep 8
Red Hat Enterprise Linux: path traversal
Medium6.8Sep 8
Red Hat Dogtag PKI: code execution
High7.2Sep 8

Critical advisories by email

Wednesdays: the week’s critical and high advisories in the AI and data stack, with the fixed versions. Only in weeks that have some.

Double opt-in. Unsubscribe any time.