CLSA-2026-1787063229
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1787063229.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1787063229
- Upstream
- Published
- 2026-08-18T14:27:22Z
- Modified
- 2026-10-26T09:31:52Z
- Summary
- Fix CVE(s): CVE-2025-8732, CVE-2026-0989, CVE-2026-0990, CVE-2026-0992
- Details
-
- SECURITY UPDATE: uncontrolled recursion in SGML catalog parsing
- debian/patches/CVE-2025-8732.patch: thread a depth counter through xmlParseSGMLCatalog() and xmlExpandCatalog() in catalog.c and bail out past MAX_CATAL_DEPTH, and register expanded catalog filenames in the SGML hash table before recursing so a repeated CATALOG directive is only followed once, to prevent stack exhaustion and exponential re-parsing on self-referencing SGML CATALOG entries. Add test files result/catalogs/recursive, test/catalogs/recursive.script and test/catalogs/recursive.sgml
- CVE-2025-8732
- SECURITY UPDATE: uncontrolled recursion in the RelaxNG parser via nested
schema includes
- debian/patches/CVE-2026-0989.patch: add an include depth limit to the RelaxNG parser context in relaxng.c, defaulting to 1000 and overridable via the RNG_INCLUDE_LIMIT environment variable or the new xmlRelaxParserSetIncLImit() entry point in include/libxml/relaxng.h, and make xmlRelaxNGIncludePush() failures propagate. Add coverage in runtest.c and test/relaxng/include/include-limit*.rng
- debian/libxml2.symbols: add the new xmlRelaxParserSetIncLImit symbol
- CVE-2026-0989
- SECURITY UPDATE: uncontrolled recursion in XML catalog URI resolution
- debian/patches/CVE-2026-0990.patch: add a MAX_CATAL_DEPTH guard to xmlCatalogListXMLResolveURI() in catalog.c and stop clobbering the catalog entry used for depth bookkeeping while walking the entry list, to prevent stack exhaustion on a self-referencing delegateURI entry
- CVE-2026-0990
- SECURITY UPDATE: uncontrolled resource consumption via repeated
nextCatalog entries
- debian/patches/CVE-2026-0992.patch: ignore duplicate nextCatalog entries in xmlParseXMLCatalogNode() in catalog.c, to prevent redundant exponential traversal of catalog chains. Guard the new loop against a NULL entry so a nextCatalog element without a 'catalog' attribute is still skipped with an error instead of crashing
- CVE-2026-0992
- SECURITY UPDATE: uncontrolled recursion in SGML catalog parsing
- References