Vulnpedia
← All CVEs

CVE-2026-6653

HIGH 7 ALL-YEARS

Published 2026-06-22 · Last modified 2026-06-22 · canonical · NVD: Analyzed

Use After Free in libxml2's xmlParseInternalSubset from GNOME libxml2 version 2.9.11 to 2.11.0 allows a remote attacker to cause a denial-of-service via maliciously crafted XML input with improper entity resolution handling.

ELEVATED IMPACT

Severe if exploited (CVSS 7), but no confirmed exploitation. Patch on a normal cadence.

Exploitation likelihood

0.4%chance of exploitation in 30 days · 29th percentile

○ In CISA KEV○ Catalogued PoC◆ SSVC: exploitation none, automatable no

Impact if exploited

7CVSS 4.0 · HIGH · CNA

  • ConfidentialityHigh
  • IntegrityLow
  • AvailabilityLow

What an attacker needs

  • ✓Access: Reachable over the network — no local access needed
  • ✓Privileges: No account or privileges required
  • ✓User interaction: No user interaction needed
  • ⚠Complexity: Needs a race window or specific setup
  • ✓Requirements: No special attack requirements

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

No public PoC is currently catalogued.

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked weekly for the full archive, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Affected

Vendors Gnome Xmlsoft

Products Libxml2

Weakness (CWE)

  • CWE-416: Use after free
  • CWE-611: Improper Restriction of XML External Entity Processing

CVSS vector

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

References and research data (JSON)

Vendor product assessments

Showing 32 of 187 vendor product statements; 155 omitted. Read the full vendor advisory.

  • libxml2-debuginfo-0:2.9.7-21.el8_10.8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_10.8?arch=aarch64

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Updating to a fixed version of libxml2 (2.11.0 or later upstream, or a future RHEL errata) will fully resolve this issue.
    Red Hat · CVE-2026-6653 · Updated 2026-10-14T19:24:35+00:00
  • libxml2-devel-0:2.9.7-21.el8_10.8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_10.8?arch=ppc64le

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Updating to a fixed version of libxml2 (2.11.0 or later upstream, or a future RHEL errata) will fully resolve this issue.
    Red Hat · CVE-2026-6653 · Updated 2026-10-14T19:24:35+00:00
  • libxml2-debuginfo-0:2.9.13-14.el9_8.4.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_8.4?arch=s390x

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Updating to a fixed version of libxml2 (2.11.0 or later upstream, or a future RHEL errata) will fully resolve this issue.
    Red Hat · CVE-2026-6653 · Updated 2026-10-14T19:24:35+00:00
  • python3-libxml2-debuginfo-0:2.9.13-14.el9_8.4.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_8.4?arch=aarch64

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Updating to a fixed version of libxml2 (2.11.0 or later upstream, or a future RHEL errata) will fully resolve this issue.
    Red Hat · CVE-2026-6653 · Updated 2026-10-14T19:24:35+00:00
  • libxml2-debuginfo-0:2.9.7-21.el8_10.8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_10.8?arch=aarch64

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Updating to a fixed version of libxml2 (2.11.0 or later upstream, or a future RHEL errata) will fully resolve this issue.
    Red Hat · CVE-2026-6653 · Updated 2026-10-14T19:24:35+00:00
  • python3-libxml2-0:2.9.7-21.el8_10.8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_10.8?arch=s390x

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Updating to a fixed version of libxml2 (2.11.0 or later upstream, or a future RHEL errata) will fully resolve this issue.
    Red Hat · CVE-2026-6653 · Updated 2026-10-14T19:24:35+00:00
  • libxml2-0:2.9.13-14.el9_8.4.src as a component of Red Hat Enterprise Linux BaseOS (v. 9) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_8.4?arch=src

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Updating to a fixed version of libxml2 (2.11.0 or later upstream, or a future RHEL errata) will fully resolve this issue.
    Red Hat · CVE-2026-6653 · Updated 2026-10-14T19:24:35+00:00
  • python3-libxml2-0:2.9.13-14.el9_8.4.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_8.4?arch=aarch64

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Updating to a fixed version of libxml2 (2.11.0 or later upstream, or a future RHEL errata) will fully resolve this issue.
    Red Hat · CVE-2026-6653 · Updated 2026-10-14T19:24:35+00:00
  • registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9@sha256:78431228c2902c8b51c50d5f487d1789f35ac994e3089e6448234f8b13577233_arm64 as a component of Cert Manager support for Red Hat OpenShift release 1.17 · fixed

    Vendor assessment for this product only.

    pkg:oci/cert-manager-istio-csr-rhel9@sha256%3A78431228c2902c8b51c50d5f487d1789f35ac994e3089e6448234f8b13577233?arch=arm64&repository_url=registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9&tag=1791378395

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. The steps to apply the upgraded images are different depending on the installation plan approval policy you used when installing the cert-manager Operator for Red Hat OpenShift. - If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a new version of the Operator. No further action is required to upgrade. This is the default setting. - If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator. See https://docs.openshift.com/container-platform/latest/security/cert_manager_operator/index.html for additional information. Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Updating to a fixed version of libxml2 (2.11.0 or later upstream, or a future RHEL errata) will fully resolve this issue.
    Red Hat · CVE-2026-6653 · Updated 2026-10-14T19:24:35+00:00
  • registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:d2dc2603d281e2cef02fd3c2e8af210de2f223d3ace8946980b5d8c3e0745e76_amd64 as a component of Cert Manager support for Red Hat OpenShift release 1.17 · fixed

    Vendor assessment for this product only.

    pkg:oci/jetstack-cert-manager-rhel9@sha256%3Ad2dc2603d281e2cef02fd3c2e8af210de2f223d3ace8946980b5d8c3e0745e76?arch=amd64&repository_url=registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9&tag=1791371069

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. The steps to apply the upgraded images are different depending on the installation plan approval policy you used when installing the cert-manager Operator for Red Hat OpenShift. - If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a new version of the Operator. No further action is required to upgrade. This is the default setting. - If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator. See https://docs.openshift.com/container-platform/latest/security/cert_manager_operator/index.html for additional information. Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Updating to a fixed version of libxml2 (2.11.0 or later upstream, or a future RHEL errata) will fully resolve this issue.
    Red Hat · CVE-2026-6653 · Updated 2026-10-14T19:24:35+00:00
  • registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:4edc614409d7ea9eaa011e6904797947edee52b9788bd385a2094e51afdf1c4b_ppc64le as a component of Cert Manager support for Red Hat OpenShift release 1.18 · fixed

    Vendor assessment for this product only.

    pkg:oci/jetstack-cert-manager-acmesolver-rhel9@sha256%3A4edc614409d7ea9eaa011e6904797947edee52b9788bd385a2094e51afdf1c4b?arch=ppc64le&repository_url=registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9&tag=1791459707

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. The steps to apply the upgraded images are different depending on the installation plan approval policy you used when installing the cert-manager Operator for Red Hat OpenShift. - If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a new version of the Operator. No further action is required to upgrade. This is the default setting. - If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator. See https://docs.openshift.com/container-platform/latest/security/cert_manager_operator/index.html for additional information. Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Updating to a fixed version of libxml2 (2.11.0 or later upstream, or a future RHEL errata) will fully resolve this issue.
    Red Hat · CVE-2026-6653 · Updated 2026-10-14T19:24:35+00:00
  • registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9@sha256:97a48da1700e1a339a8ea36ece2927b870f12ca5c0aea5234216c7179d66f6f3_s390x as a component of Cert Manager support for Red Hat OpenShift release 1.20 · fixed

    Vendor assessment for this product only.

    pkg:oci/cert-manager-istio-csr-rhel9@sha256%3A97a48da1700e1a339a8ea36ece2927b870f12ca5c0aea5234216c7179d66f6f3?arch=s390x&repository_url=registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9&tag=1790223719

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. The steps to apply the upgraded images are different depending on the installation plan approval policy you used when installing the cert-manager Operator for Red Hat OpenShift. - If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a new version of the Operator. No further action is required to upgrade. This is the default setting. - If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator. See https://docs.openshift.com/container-platform/latest/security/cert_manager_operator/index.html for additional information. Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Updating to a fixed version of libxml2 (2.11.0 or later upstream, or a future RHEL errata) will fully resolve this issue.
    Red Hat · CVE-2026-6653 · Updated 2026-10-14T19:24:35+00:00
  • registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:e101d66f01828711216a9cd62f5e376e16d60976a2dd0b26d86d1207c830d2dc_s390x as a component of Cert Manager support for Red Hat OpenShift release 1.20 · fixed

    Vendor assessment for this product only.

    pkg:oci/cert-manager-operator-rhel9@sha256%3Ae101d66f01828711216a9cd62f5e376e16d60976a2dd0b26d86d1207c830d2dc?arch=s390x&repository_url=registry.redhat.io/cert-manager/cert-manager-operator-rhel9&tag=1790589855

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. The steps to apply the upgraded images are different depending on the installation plan approval policy you used when installing the cert-manager Operator for Red Hat OpenShift. - If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a new version of the Operator. No further action is required to upgrade. This is the default setting. - If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator. See https://docs.openshift.com/container-platform/latest/security/cert_manager_operator/index.html for additional information. Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Updating to a fixed version of libxml2 (2.11.0 or later upstream, or a future RHEL errata) will fully resolve this issue.
    Red Hat · CVE-2026-6653 · Updated 2026-10-14T19:24:35+00:00
  • registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9@sha256:6064f0ab2db9a4f10c7453060d8281b98ce8daefed74a79079731c861715dae2_arm64 as a component of Cert Manager support for Red Hat OpenShift release 1.20 · fixed

    Vendor assessment for this product only.

    pkg:oci/jetstack-cert-manager-rhel9@sha256%3A6064f0ab2db9a4f10c7453060d8281b98ce8daefed74a79079731c861715dae2?arch=arm64&repository_url=registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9&tag=1790223279

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. The steps to apply the upgraded images are different depending on the installation plan approval policy you used when installing the cert-manager Operator for Red Hat OpenShift. - If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a new version of the Operator. No further action is required to upgrade. This is the default setting. - If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator. See https://docs.openshift.com/container-platform/latest/security/cert_manager_operator/index.html for additional information. Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Updating to a fixed version of libxml2 (2.11.0 or later upstream, or a future RHEL errata) will fully resolve this issue.
    Red Hat · CVE-2026-6653 · Updated 2026-10-14T19:24:35+00:00
  • registry.redhat.io/rhui5/rhua-rhel9@sha256:ace80f39f33d921b97be5c74257b52d64170e4eac4b0e2db7d7d13a598d38450_amd64 as a component of Red Hat Update Infrastructure 5 · fixed

    Vendor assessment for this product only.

    pkg:oci/rhua-rhel9@sha256%3Aace80f39f33d921b97be5c74257b52d64170e4eac4b0e2db7d7d13a598d38450?arch=amd64&repository_url=registry.redhat.io/rhui5/rhua-rhel9&tag=1788880581

    • vendor fix: The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility. See the official documentation for more details. Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Updating to a fixed version of libxml2 (2.11.0 or later upstream, or a future RHEL errata) will fully resolve this issue.
    Red Hat · CVE-2026-6653 · Updated 2026-10-14T19:24:35+00:00
  • openshift/ose-rhel-coreos-8 as a component of Red Hat OpenShift Container Platform 4 · known affected

    Vendor assessment for this product only.

    pkg:oci/ose-rhel-coreos-8?repository_url=registry.redhat.io/openshift/ose-rhel-coreos-8

    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Updating to a fixed version of libxml2 (2.11.0 or later upstream, or a future RHEL errata) will fully resolve this issue.
    • none available: Fix deferred
    Red Hat · CVE-2026-6653 · Updated 2026-10-14T19:24:35+00:00
  • openshift/ose-rhel-coreos-9 as a component of Red Hat OpenShift Container Platform 4 · known affected

    Vendor assessment for this product only.

    pkg:oci/ose-rhel-coreos-9?repository_url=registry.redhat.io/openshift/ose-rhel-coreos-9

    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Updating to a fixed version of libxml2 (2.11.0 or later upstream, or a future RHEL errata) will fully resolve this issue.
    • none available: Fix deferred
    Red Hat · CVE-2026-6653 · Updated 2026-10-14T19:24:35+00:00
  • registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:a5f4c1a5cffdd4a0449fdf9b05815810e92d27601e9d683ed647ee1c2e5df4cf_ppc64le as a component of Cert Manager support for Red Hat OpenShift release 1.20 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/jetstack-cert-manager-acmesolver-rhel9@sha256%3Aa5f4c1a5cffdd4a0449fdf9b05815810e92d27601e9d683ed647ee1c2e5df4cf?arch=ppc64le&repository_url=registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9&tag=1790223630

    Red Hat · CVE-2026-6653 · Updated 2026-10-14T19:24:35+00:00
  • registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:c34db4a5a22ec01496292c66eee29ff041722ea90da13a886acbcba5f96dfb8f_amd64 as a component of Cert Manager support for Red Hat OpenShift release 1.20 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/jetstack-cert-manager-acmesolver-rhel9@sha256%3Ac34db4a5a22ec01496292c66eee29ff041722ea90da13a886acbcba5f96dfb8f?arch=amd64&repository_url=registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9&tag=1790223630

    Red Hat · CVE-2026-6653 · Updated 2026-10-14T19:24:35+00:00
  • registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:d86af8bb35aca6af6b12478d265eb7ed049c6f8ec9d67c04bd5013fdcdc8b170_s390x as a component of Cert Manager support for Red Hat OpenShift release 1.20 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/jetstack-cert-manager-acmesolver-rhel9@sha256%3Ad86af8bb35aca6af6b12478d265eb7ed049c6f8ec9d67c04bd5013fdcdc8b170?arch=s390x&repository_url=registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9&tag=1790223630

    Red Hat · CVE-2026-6653 · Updated 2026-10-14T19:24:35+00:00
  • registry.redhat.io/discovery/discovery-ui-rhel9@sha256:480c69f89b45c714ec13a7901bc8615a2fa3f4622c889cd023d80a6278855a58_arm64 as a component of Red Hat Discovery 2 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/discovery-ui-rhel9@sha256%3A480c69f89b45c714ec13a7901bc8615a2fa3f4622c889cd023d80a6278855a58?arch=arm64&repository_url=registry.redhat.io/discovery/discovery-ui-rhel9&tag=1788206196

    Red Hat · CVE-2026-6653 · Updated 2026-10-14T19:24:35+00:00
  • libxml2 as a component of Red Hat Enterprise Linux 10 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/libxml2

    Red Hat · CVE-2026-6653 · Updated 2026-10-14T19:24:35+00:00
  • libxml2-static as a component of Red Hat Enterprise Linux 10 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/libxml2-static

    Red Hat · CVE-2026-6653 · Updated 2026-10-14T19:24:35+00:00
  • libxml2.src as a component of Red Hat Enterprise Linux 10 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/libxml2?arch=src

    Red Hat · CVE-2026-6653 · Updated 2026-10-14T19:24:35+00:00
  • python3-libxml2 as a component of Red Hat Enterprise Linux 10 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/python3-libxml2

    Red Hat · CVE-2026-6653 · Updated 2026-10-14T19:24:35+00:00
  • libxml2-devel as a component of Red Hat Enterprise Linux 6 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/libxml2-devel

    Red Hat · CVE-2026-6653 · Updated 2026-10-14T19:24:35+00:00
  • libxml2-static as a component of Red Hat Enterprise Linux 6 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/libxml2-static

    Red Hat · CVE-2026-6653 · Updated 2026-10-14T19:24:35+00:00
  • libxml2.src as a component of Red Hat Enterprise Linux 6 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/libxml2?arch=src

    Red Hat · CVE-2026-6653 · Updated 2026-10-14T19:24:35+00:00
  • libxml2 as a component of Red Hat Enterprise Linux 7 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/libxml2

    Red Hat · CVE-2026-6653 · Updated 2026-10-14T19:24:35+00:00
  • libxml2-python as a component of Red Hat Enterprise Linux 7 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/libxml2-python

    Red Hat · CVE-2026-6653 · Updated 2026-10-14T19:24:35+00:00
  • libxml2.src as a component of Red Hat Enterprise Linux 7 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/libxml2?arch=src

    Red Hat · CVE-2026-6653 · Updated 2026-10-14T19:24:35+00:00
  • libxml2.src as a component of Red Hat Hardened Images · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/libxml2?arch=src

    Red Hat · CVE-2026-6653 · Updated 2026-10-14T19:24:35+00:00

Known Affected Software Configurations

VendorProductVersion range
XmlsoftLibxml2≥ 2.9.11 and ≤ 2.11.0

All CVSS metrics

  • HIGH 7 v4.0 · CNA Primary
    CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
  • HIGH 7 v4.0 · NVD Secondary
    CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  • CRITICAL 9.8 v3.1 · NVD Primary
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Exploit-tagged references (not proof of a PoC)

Advisories

Technical & other

Sources: NVD · CVE.org · All sources and attribution · EPSS