Nixpkgs Security Tracker

Login with GitHub

Details of issue NIXPKGS-2026-0014

NIXPKGS-2026-0014
published on 16 Jan 2026
updated 6 days ago by @LeSuisse Activity log
  • Created automatic suggestion
  • @LeSuisse removed
    8 packages
    • libxml2Python
    • sbclPackages.cl-libxml2
    • perlPackages.AlienLibxml2
    • python312Packages.libxml2
    • python313Packages.libxml2
    • perl538Packages.AlienLibxml2
    • perl540Packages.AlienLibxml2
    • tests.pkg-config.defaultPkgConfigPackages."libxml-2.0"
  • @LeSuisse accepted as draft
  • @LeSuisse published on GitHub
Libxml2: libxml2: denial of service via crafted xml catalogs

A flaw was found in the libxml2 library. This uncontrolled resource consumption vulnerability occurs when processing XML catalogs that contain repeated <nextCatalog> elements pointing to the same downstream catalog. A remote attacker can exploit this by supplying crafted catalogs, causing the parser to redundantly traverse catalog chains. This leads to excessive CPU consumption and degrades application availability, resulting in a denial-of-service condition.

Affected products

rhcos
libxml2

Matching in nixpkgs

Package maintainers: 7