Release date:
2026-09-17 10:18:46 UTC
Description:
- CVE-2024-56171: use-after-free after xmlSchemaItemListAdd in the XML Schema
identity-constraint code (xmlSchemaIDCFillNodeTables,
xmlSchemaBubbleIDCNodeTables)
- CVE-2026-6653: use-after-free in xmlParseInternalSubset; xmlPushInput()
returned -1 for a parameter entity input it had already pushed, so the caller
freed an input stream that ctxt->input still pointed at. Reachable through the
entity amplification check carried by 2.10.2 for CVE-2021-3541, which this
keeps in place. Also guards the xmlSkipBlankChars() loop on XML_PARSER_EOF
(upstream e129c1d1), without which the same document spins at 100% CPU once
the input is no longer freed
Updated packages:
-
alt-libxml2-2.10.2-7.el10.x86_64.rpm
sha:bd45e79cc007d6b5f87666000adb1476e01ff4cdbb19225dedc8eed59534b5ed
-
alt-libxml2-devel-2.10.2-7.el10.x86_64.rpm
sha:b4abbad08a73c9edc83bd6dfeeb21bb8ab28ba9fc64b6905bbf0090f1b651ca1
-
alt-libxml2-static-2.10.2-7.el10.x86_64.rpm
sha:182a5151f2282860413018f94ee6259d481b1540bdfb10eda11ccdddff4106b2
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
