CVE-2026-6732

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-6732
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-6732.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-6732
Downstream
ALPINE (1)
BELL (1)
DEBIAN (1)
ECHO (1)
JLSEC (1)
MGASA (1)
openSUSE (1)
RHSA (1)
ROOT (1)
SUSE (2)
UBUNTU (1)
Related
openSUSE (1)
SUSE (2)
Published
2026-04-23T22:19:34Z
Modified
2026-10-23T02:45:15Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Libxml2: libxml2: denial of service via crafted xsd-validated document
Details

A flaw was found in libxml2. This vulnerability occurs when the library processes a specially crafted XML Schema Definition (XSD) validated document that includes an internal entity reference. An attacker could exploit this by providing a malicious document, leading to a type confusion error that causes the application to crash. This results in a denial of service (DoS), making the affected system or application unavailable.

Database specific 
{
    "cna_assigner":  "redhat",
    "cwe_ids":  [
        "CWE-843"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/6xxx/CVE-2026-6732.json"
}
References

Affected packages

Git / gitlab.gnome.org/gnome/libxml2

Affected ranges

Type
GIT
Repo
https://gitlab.gnome.org/gnome/libxml2
Events
Introduced
cdd2575f7fbab1d8162600f4048bc37503c80e28
Fixed
c94eb0210183b9d7cb43f8e7fddc6be55843ef49
Introduced
2189b59b1005976970ebadb65edbb289f9e091ff
Last Affected
2189b59b1005976970ebadb65edbb289f9e091ff
Database specific
Show details 
{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "2.13.0"
                },
                {
                    "fixed":  "2.15.3"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "6.0"
                },
                {
                    "last_affected":  "6.0"
                }
            ],
            "source":  "CPE_STRING"
        }
    ]
}

Affected versions

6.*
6.0
Other
LIBXML2_6_0
v2.*
v2.13.0
v2.14.0
v2.15.0
v2.15.1
v2.15.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-6732.json"