XML External Entity Injection Vulnerability in libxml2 from GNOME

CVE-2026-86144

What is CVE-2026-86144?

The libxml2 library, specifically versions prior to 2.15.4, is susceptible to an XML external entity (XXE) injection vulnerability due to improper handling of the xinclude feature. The xmlXIncludeProcess and xmlXIncludeProcessTree functions fail to propagate key parsing flags, such as XML_PARSE_NONET, allowing an attacker to influence resource loading behavior. This misconfiguration may lead to unauthorized internet access, resulting in potential security issues including SSRF attacks or denial of service through slow or unresponsive external resources.

References