AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

Red HatCVE-2026-74860

Red Hat libxml2 with Python bindings enabled: denial of service

Red Hat

CVE-2026-74860 · Published Sep 8, 2026 · updated Nov 6, 2026

High8.5
No fix yet
Red Hat advisory

A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition (DTD) with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callback handler, where a string is freed twice. This flaw can lead to a denial of service (DoS) due to a reproducible crash in Python applications using the libxml2 SAX bindings.

Affected versions

The source does not list versions here. See the source advisory for affected products and fixes.
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-763

More Red Hat advisories

All Red Hat
Low 3.3Sep 8Red Hat DPDK lib/vhost. Missing length validation: out-of-bounds readCVE-2026-86564no fix yetMedium 6.1Sep 8Red Hat gdk-pixbuf. This vulnerability: out-of-bounds readCVE-2026-18090no fix yetHigh 8.2Sep 8Red Hat build of Apache Camel - HawtIO 4: improper privilege managementCVE-2026-77968no fix yetCritical 9.9Sep 8Red Hat build of Apache Camel - HawtIO 4: improper certificate validationCVE-2026-78234no fix yetMedium 6.8Sep 8Red Hat Enterprise Linux: path traversalCVE-2026-74859no fix yetHigh 7.2Sep 8Red Hat Dogtag PKI: code executionCVE-2026-76561no fix yet