Release date:
2026-09-17 11:07:00 UTC
Description:
- CVE-2024-56171: use-after-free after xmlSchemaItemListAdd in the XML Schema
identity-constraint code (xmlSchemaIDCFillNodeTables,
xmlSchemaBubbleIDCNodeTables)
- CVE-2026-6653: use-after-free in xmlParseInternalSubset; xmlPushInput()
returned -1 for a parameter entity input it had already pushed, so the caller
freed an input stream that ctxt->input still pointed at. Reachable through the
entity amplification check carried by 2.10.2 for CVE-2021-3541, which this
keeps in place. Also guards the xmlSkipBlankChars() loop on XML_PARSER_EOF
(upstream e129c1d1), without which the same document spins at 100% CPU once
the input is no longer freed
Updated packages:
-
alt-libxml2-2.10.2-7.el9.x86_64.rpm
sha:b4be19cec42a2a95cf54ea78ffaa4f5975e28dd4f3cd00c5ab89d15b9793b841
-
alt-libxml2-devel-2.10.2-7.el9.x86_64.rpm
sha:01d2ed494b4288882f6616759d66704098f3df08060e3f797a17d84673576155
-
alt-libxml2-static-2.10.2-7.el9.x86_64.rpm
sha:20cd05856fdb12dbb4909f234151ca9ac51263b8f10f8943d63eec4d469fb4c4
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
