CVE-2026-74860 | BDVDB-2026-369913 Detail
Red HatRed Hat Enterprise Linux 10
Description#
A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition (DTD) with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callback handler, where a string is freed twice. This flaw can lead to a denial of service (DoS) due to a reproducible crash in Python applications using the libxml2 SAX bindings.
Impact#
Per CVSS v3.1: confidentiality impact high, integrity impact high, availability impact high. Attack vector: network.
Weaknesses#
- CWE-763 Release of Invalid Pointer or Reference
References#
- https://access.redhat.com/errata/RHSA-2026:64463
- https://access.redhat.com/errata/RHSA-2026:71585
- https://access.redhat.com/errata/RHSA-2026:71586
- https://access.redhat.com/errata/RHSA-2026:71641
- https://access.redhat.com/errata/RHSA-2026:72470
- https://access.redhat.com/errata/RHSA-2026:72475
- https://access.redhat.com/errata/RHSA-2026:72476
- https://access.redhat.com/errata/RHSA-2026:79357
- https://access.redhat.com/errata/RHSA-2026:82939
- https://access.redhat.com/errata/RHSA-2026:89750
- https://access.redhat.com/errata/RHSA-2026:89759
- https://access.redhat.com/errata/RHSA-2026:90309
- https://access.redhat.com/errata/RHSA-2026:91202
- https://access.redhat.com/errata/RHSA-2026:91204
- https://access.redhat.com/errata/RHSA-2026:91206
Show all 40
- https://access.redhat.com/errata/RHSA-2026:91207
- https://access.redhat.com/errata/RHSA-2026:91217
- https://access.redhat.com/errata/RHSA-2026:91218
- https://access.redhat.com/errata/RHSA-2026:91219
- https://access.redhat.com/errata/RHSA-2026:91224
- https://access.redhat.com/errata/RHSA-2026:91232
- https://access.redhat.com/errata/RHSA-2026:91233
- https://access.redhat.com/errata/RHSA-2026:91234
- https://access.redhat.com/errata/RHSA-2026:91235
- https://access.redhat.com/errata/RHSA-2026:91236
- https://access.redhat.com/errata/RHSA-2026:91237
- https://access.redhat.com/errata/RHSA-2026:91238
- https://access.redhat.com/errata/RHSA-2026:91241
- https://access.redhat.com/errata/RHSA-2026:91242
- https://access.redhat.com/errata/RHSA-2026:91243
- https://access.redhat.com/errata/RHSA-2026:91244
- https://access.redhat.com/errata/RHSA-2026:91245
- https://access.redhat.com/errata/RHSA-2026:91246
- https://access.redhat.com/errata/RHSA-2026:91248
- https://access.redhat.com/errata/RHSA-2026:91249
- https://access.redhat.com/errata/RHSA-2026:92352
- https://access.redhat.com/errata/RHSA-2026:92589
- https://access.redhat.com/errata/RHSA-2026:93463
- https://access.redhat.com/errata/RHSA-2026:93473
- https://access.redhat.com/errata/RHSA-2026:93791
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.