Denial-of-Service Flaw in libxml2's RelaxNG Parser

CVE-2026-0989

What is CVE-2026-0989?

A flaw in the RelaxNG parser of libxml2 pertains to improper handling of external schema inclusions. The parser lacks limitations on the depth of inclusion when processing nested directives. This can lead to excessive recursion in scenarios involving specially crafted schemas, resulting in stack exhaustion and application crashes. Consequently, this poses a denial-of-service risk, affecting applications reliant on libxml2 for XML parsing.

References