A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition (DTD) with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callback handler, where a string is freed twice. This flaw can lead to a denial of service (DoS) due to a reproducible crash in Python applications using the libxml2 SAX bindings.

rocky_linux RLSA-2026:71641: RLSA-2026:71641: libxml2 security update (Important)

The version of libxml2 installed on the remote host is prior to 2.9.1-6. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3940 advisory.

    A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this     vulnerability by providing a specially crafted XML document containing a Document Type Definition (DTD)     with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callback     handler, where a string is freed twice. This flaw can lead to a denial of service (DoS) due to a     reproducible crash in Python applications using the libxml2 SAX bindings. (CVE-2026-74860)

    In libxml2 before 2.15.4, xmlFAParsePosCharGroup has an out-of-bounds read, aka an out-of-bounds read in     the NXT macro in xmlregexp. (CVE-2026-86137)

    In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based     buffer overflow. (CVE-2026-86138)

    In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-based buffer overflow.
    (CVE-2026-86140)

    In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of     xmlXPtrEval xpointer length saturation. (CVE-2026-86142)

    In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes     negative lengths to reach write callbacks, aka a lack of a check for integer overflow before calling     writecallback. This has security relevance for many types of uses of that length value within a callback.
    (CVE-2026-86143)

    In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate     parseFlags. This has security relevance for, for example, the XML_PARSE_NONET flag, if (without it) a     custom resource loader accesses the internet and triggers XML external entity injection, SSRF, or a denial     of service (e.g., for an attacker-controlled internet resource that is intentionally slow).
    (CVE-2026-86144)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1925:10 advisory.

    * libxml2: libxml2: Arbitrary code execution via heap-based buffer overflow (CVE-2026-86138)
      * libxml2: libxml2: Data integrity issues due to integer overflow in write callbacks (CVE-2026-86143)
      * libxml2: libxml2: Arbitrary code execution via stack-based buffer overflow in xmlSnprintfElements     (CVE-2026-86140)
      * libxml2: libxml2: Information disclosure, SSRF, or denial of service due to improper parseFlags     propagation. (CVE-2026-86144)
      * libxml2: double-free/UAF in libxml2 Python bindings (CVE-2026-74860)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-71641 advisory.

    - Fix CVE-2026-86144 (RHEL-256306)
    - Fix CVE-2026-86140 (RHEL-256021)
    - Fix CVE-2026-74860 (RHEL-255956)
    - Fix CVE-2026-86143 (RHEL-256895)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:71585 advisory.

    * libxml2: libxml2: Arbitrary code execution via heap-based buffer overflow (CVE-2026-86138)

    * libxml2: libxml2: Data integrity issues due to integer overflow in write callbacks (CVE-2026-86143)

    * libxml2: libxml2: Arbitrary code execution via stack-based buffer overflow in xmlSnprintfElements     (CVE-2026-86140)

    * libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation     (CVE-2026-86142)

    * libxml2: libxml2: Information disclosure, SSRF, or denial of service due to improper parseFlags     propagation. (CVE-2026-86144)

    * libxml2: double-free/UAF in libxml2 Python bindings (CVE-2026-74860)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-71586 advisory.

    - Fix CVE-2026-86144 (RHEL-256302)
    - Fix CVE-2026-86140 (RHEL-256024)
    - Fix CVE-2026-74860 (RHEL-255957)
    - Fix CVE-2026-86142 (RHEL-256368)
    - Fix CVE-2026-86143 (RHEL-256896)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-71585 advisory.

    - Fix CVE-2026-86144 (RHEL-256304)
    - Fix CVE-2026-86140 (RHEL-256027)
    - Fix CVE-2026-74860 (RHEL-256120)
    - Fix CVE-2026-86142 (RHEL-256365)
    - Fix CVE-2026-86143 (RHEL-256901)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:71586 advisory.

    * libxml2: libxml2: Arbitrary code execution via heap-based buffer overflow (CVE-2026-86138)

    * libxml2: libxml2: Data integrity issues due to integer overflow in write callbacks (CVE-2026-86143)

    * libxml2: libxml2: Arbitrary code execution via stack-based buffer overflow in xmlSnprintfElements     (CVE-2026-86140)

    * libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation     (CVE-2026-86142)

    * libxml2: libxml2: Information disclosure, SSRF, or denial of service due to improper parseFlags     propagation. (CVE-2026-86144)

    * libxml2: double-free/UAF in libxml2 Python bindings (CVE-2026-74860)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8787-1 advisory.

    It was discovered that libxml2 incorrectly handled certain XML elements under certain circumstances. An     attacker could possibly use this issue to cause libxml2 to crash or execute arbitrary code.
    (CVE-2026-86140)

    It was discovered that libxml2 incorrectly handled certain XML documents when used with Python bindings. A     remote attacker could possibly use this issue to cause applications using libxml2 to crash, resulting in a     denial of service. (CVE-2026-74860)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:71585 advisory.

    The libxml2 library is a development toolbox providing the implementation of various XML standards.

    Security Fix(es):

    * libxml2: libxml2: Arbitrary code execution via heap-based buffer overflow (CVE-2026-86138)

    * libxml2: libxml2: Data integrity issues due to integer overflow in write callbacks (CVE-2026-86143)

    * libxml2: libxml2: Arbitrary code execution via stack-based buffer overflow in xmlSnprintfElements     (CVE-2026-86140)

    * libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation     (CVE-2026-86142)

    * libxml2: libxml2: Information disclosure, SSRF, or denial of service due to improper parseFlags     propagation. (CVE-2026-86144)

    * libxml2: double-free/UAF in libxml2 Python bindings (CVE-2026-74860)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:71641 advisory.

    The libxml2 library is a development toolbox providing the implementation of various XML standards.

    Security Fix(es):

    * libxml2: libxml2: Arbitrary code execution via heap-based buffer overflow (CVE-2026-86138)

    * libxml2: libxml2: Data integrity issues due to integer overflow in write callbacks (CVE-2026-86143)

    * libxml2: libxml2: Arbitrary code execution via stack-based buffer overflow in xmlSnprintfElements     (CVE-2026-86140)

    * libxml2: libxml2: Information disclosure, SSRF, or denial of service due to improper parseFlags     propagation. (CVE-2026-86144)

    * libxml2: double-free/UAF in libxml2 Python bindings (CVE-2026-74860)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:71586 advisory.

    The libxml2 library is a development toolbox providing the implementation of various XML standards.

    Security Fix(es):

    * libxml2: libxml2: Arbitrary code execution via heap-based buffer overflow (CVE-2026-86138)

    * libxml2: libxml2: Data integrity issues due to integer overflow in write callbacks (CVE-2026-86143)

    * libxml2: libxml2: Arbitrary code execution via stack-based buffer overflow in xmlSnprintfElements     (CVE-2026-86140)

    * libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation     (CVE-2026-86142)

    * libxml2: libxml2: Information disclosure, SSRF, or denial of service due to improper parseFlags     propagation. (CVE-2026-86144)

    * libxml2: double-free/UAF in libxml2 Python bindings (CVE-2026-74860)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this     vulnerability by providing a specially crafted XML document containing a Document Type Definition (DTD)     with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callback     handler, where a string is freed twice. This flaw can lead to a denial of service (DoS) due to a     reproducible crash in Python applications using the libxml2 SAX bindings. (CVE-2026-74860)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
351063	Amazon Linux 2 : libxml2 (ALAS-2026-3940)	Nessus	Amazon Linux Local Security Checks	Local	high
350877	MiracleLinux 8 : libxml2-2.9.7-21.el8_10.9 (AXSA:2026-1925:10)	Nessus	Miracle Linux Local Security Checks	Local	high
350754	Oracle Linux 8 : libxml2 (ELSA-2026-71641)	Nessus	Oracle Linux Local Security Checks	Local	high
350693	RockyLinux 9 : libxml2 (RLSA-2026:71585)	Nessus	Rocky Linux Local Security Checks	Local	high
350317	Oracle Linux 10 : libxml2 (ELSA-2026-71586)	Nessus	Oracle Linux Local Security Checks	Local	high
350316	Oracle Linux 9 : libxml2 (ELSA-2026-71585)	Nessus	Oracle Linux Local Security Checks	Local	high
350314	RockyLinux 10 : libxml2 (RLSA-2026:71586)	Nessus	Rocky Linux Local Security Checks	Local	high
350304	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : libxml2 vulnerabilities (USN-8787-1)	Nessus	Ubuntu Local Security Checks	Local	high
349918	RHEL 9 : libxml2 (RHSA-2026:71585)	Nessus	Red Hat Local Security Checks	Local	high
349735	RHEL 8 : libxml2 (RHSA-2026:71641)	Nessus	Red Hat Local Security Checks	Local	high
349734	RHEL 10 : libxml2 (RHSA-2026:71586)	Nessus	Red Hat Local Security Checks	Local	high
343836	Linux Distros Unpatched Vulnerability : CVE-2026-74860	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-74860

high

Tenable Plugins

Coming Soon

high

high

high

high

high

high

high

high

high

high

high

high