CVE detail
CVE-2026-0989
A flaw was identified in the RelaxNG parser of libxml2 related to how external schema inclusions are handled. The parser does not enforce a limit on inclusion depth when resolving nested <include> directives. Specially crafted or overly complex schemas can cause excessive recursion during parsing. This may lead to stack exhaustion and application crashes, creating a denial-of-service risk.
Buzz score
Why this CVE is surfacing
This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.
Buzz score components · mention 17.9 · diversity 16.5 · KEV 0.0 · OTX 0.0 · PoC 0.0
Why it matters now
Mention timeline
- Total mentions
- 1
- within the 30d window
- Peak daily
- 1
- highest bucket
Evidence
Source links by recency
5 source links · newest first
Information published.
vendormsrc.microsoft.comJun 28, 2026, 8:58 AM- https://gitlab.gnome.org/GNOME/libxml2/-/issues/998gitlab.gnome.org
No excerpt available.
Exploitgitlab.gnome.orgJan 15, 2026, 3:15 PM - https://bugzilla.redhat.com/show_bug.cgi?id=2429933bugzilla.redhat.com
No excerpt available.
Exploitbugzilla.redhat.comJan 15, 2026, 3:15 PM - https://access.redhat.com/security/cve/CVE-2026-0989access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comJan 15, 2026, 3:15 PM - https://access.redhat.com/errata/RHSA-2026:7519access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comJan 15, 2026, 3:15 PM
Exploit code
Public exploit repository references
Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.
0 repository references · best confidence N/A · max 0 stars
Related records
Similar CVEs
6 related CVEs with shared weakness or product evidence
- CVE-2026-0990CVSS 5.9 · Medium
A flaw was found in libxml2, an XML parsing library. This uncontrolled recursion vulnerability occurs in the xmlCatalogXMLResolveURI function when an XML catalog contains a delega…
- CVE-2026-6732CVSS 6.5 · Medium
A flaw was found in libxml2. This vulnerability occurs when the library processes a specially crafted XML Schema Definition (XSD) validated document that includes an internal enti…
- CVE-2026-0992CVSS 2.9 · Low
A flaw was found in the libxml2 library. This uncontrolled resource consumption vulnerability occurs when processing XML catalogs that contain repeated <nextCatalog> elements poin…
- CVE-2026-13757CVSS 6.2 · Medium
A flaw was found in p11-kit. The RPC message attribute parsing functions p11_rpc_message_get_attribute() and p11_rpc_message_get_attribute_array_value() form a mutually-recursive…
- CVE-2025-8732CVSS 1.9 · Low
A vulnerability was found in libxml2 up to 2.14.5. It has been declared as problematic. This vulnerability affects the function xmlParseSGMLCatalog of the component xmlcatalog. Th…
- CVE-2025-6170CVSS 2.5 · Low
A flaw was found in the interactive shell of the xmllint command-line tool, used for parsing XML files. When a user inputs an overly long command, the program does not check the i…