Double-Free Vulnerability in libxml2 Affects Python Bindings
CVE-2026-74860
8.5HIGH
Key Information:
- Vendor
Red Hat
- Status
- Vendor
- CVE Published:
- 8 September 2026
What is CVE-2026-74860?
A flaw exists in libxml2 when the Python bindings are enabled. It allows a remote attacker to exploit the vulnerability by sending a specially crafted XML document that includes a Document Type Definition (DTD) with enumerated attribute values. This can trigger a double-free error in the SAX attributeDecl callback handler, which results in a string being freed twice. The consequence of this defect could lead to a denial of service (DoS) due to a crash in Python applications utilizing the libxml2 SAX bindings.
Affected Version(s)
Cert Manager support for Red Hat OpenShift release 1.20 1790589912
Cert Manager support for Red Hat OpenShift release 1.20 1790589914
Cert Manager support for Red Hat OpenShift release 1.20 1790589855