AZL-99702

See a problem?

Import Source

https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-99702.json

JSON Data

https://api.osv.dev/v1/vulns/AZL-99702

Upstream

CVE-2026-86144

Published

2026-09-05T05:17:13Z

Modified

2026-09-06T14:18:06.580047339Z

Summary

CVE-2026-86144 affecting package libxml2 2.11.5-10

Details

In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, the XMLPARSENONET flag, if (without it) a custom resource loader accesses the internet and triggers XML external entity injection, SSRF, or a denial of service (e.g., for an attacker-controlled internet resource that is intentionally slow).

References

https://nvd.nist.gov/vuln/detail/CVE-2026-86144

Affected packages

Azure Linux:3 / libxml2

Package

Name: libxml2
Purl: pkg:rpm/azure-linux/libxml2

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Last affected

2.11.5-10

Database specific

source

"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-99702.json"