CVE-2026-0990: libxml2 Denial of Service Vulnerability

CVE-2026-0990 Overview

A flaw was found in libxml2, an XML parsing library. This uncontrolled recursion vulnerability occurs in the xmlCatalogXMLResolveURI function when an XML catalog contains a delegate URI entry that references itself. A remote attacker could exploit this configuration-dependent issue by providing a specially crafted XML catalog, leading to infinite recursion and call stack exhaustion. This ultimately results in a segmentation fault, causing a Denial of Service (DoS) by crashing affected applications.

Critical Impact

Remote attackers can crash applications using libxml2 by providing maliciously crafted XML catalogs that trigger infinite recursion in the URI resolution process.

Affected Products

• libxml2 XML parsing library (affected versions to be confirmed by vendor)
• Applications and systems utilizing libxml2 for XML processing
• Linux distributions shipping vulnerable libxml2 packages

Discovery Timeline

• 2026-01-15 - CVE-2026-0990 published to NVD
• 2026-01-16 - Last updated in NVD database

Technical Details for CVE-2026-0990

Vulnerability Analysis

This vulnerability is classified as CWE-674 (Uncontrolled Recursion), a resource exhaustion flaw that occurs when software does not properly control the depth of recursion. In the case of CVE-2026-0990, the xmlCatalogXMLResolveURI function in libxml2 fails to detect and prevent circular references within XML catalog delegate URI entries.

When an XML catalog contains a delegate URI entry that points back to itself, the function enters an infinite recursive loop as it continuously attempts to resolve the self-referential URI. This unchecked recursion rapidly exhausts the call stack, ultimately triggering a segmentation fault and crashing the application.

The attack requires a network-accessible vector and depends on specific configuration conditions—namely, the presence of a vulnerable XML catalog configuration. While exploitation complexity is elevated due to these prerequisites, successful attacks can completely disable XML processing capabilities in affected applications.

Root Cause

The root cause lies in insufficient validation within the xmlCatalogXMLResolveURI function. The function does not implement proper cycle detection when processing delegate URI entries in XML catalogs. When encountering a delegate URI that creates a circular reference, the function recursively calls itself without any mechanism to track visited URIs or limit recursion depth, leading to unbounded stack growth.

Attack Vector

An attacker can exploit this vulnerability by crafting a malicious XML catalog file with a self-referential delegate URI entry. When libxml2 processes this catalog and attempts to resolve the cyclic URI reference, the xmlCatalogXMLResolveURI function enters infinite recursion.

The attack scenario involves:

1. Attacker creates an XML catalog containing a delegate URI entry pointing to itself
2. The malicious catalog is introduced to a system using libxml2 for XML processing
3. When URI resolution is triggered, the function recursively attempts to resolve the circular reference
4. The call stack grows unbounded until memory is exhausted
5. A segmentation fault occurs, crashing the application

For technical details on the vulnerability mechanism, refer to the Red Hat CVE-2026-0990 Advisory and Red Hat Bug Report #2429959.

Detection Methods for CVE-2026-0990

Indicators of Compromise

• Application crashes with segmentation fault during XML catalog resolution operations
• Sudden stack memory exhaustion in processes utilizing libxml2
• Unexpected termination of services that process XML data with catalog support enabled
• Core dumps showing deep recursion in xmlCatalogXMLResolveURI call stack

Detection Strategies

• Monitor for segmentation faults in applications using libxml2, particularly those processing XML catalogs
• Implement application crash monitoring with stack trace analysis to identify recursion patterns in XML parsing functions
• Audit XML catalog files for delegate URI entries containing circular or self-referential paths
• Use static analysis tools to scan XML catalogs for potential malicious configurations

Monitoring Recommendations

• Configure centralized logging to capture application crashes with detailed stack traces
• Implement resource usage alerts for abnormal stack memory consumption in XML processing services
• Deploy file integrity monitoring on XML catalog directories to detect unauthorized modifications
• Enable process monitoring to track abnormal termination patterns in libxml2-dependent applications

How to Mitigate CVE-2026-0990

Immediate Actions Required

• Update libxml2 to the latest patched version when available from your distribution vendor
• Review and audit XML catalog configurations for circular delegate URI references
• Consider disabling XML catalog support in applications where it is not required
• Implement input validation to reject XML catalogs from untrusted sources

Patch Information

Consult the Red Hat CVE-2026-0990 Advisory for the latest patch information and affected package versions. Monitor your Linux distribution's security advisories for updated libxml2 packages addressing this vulnerability.

Workarounds

• Disable XML catalog resolution functionality if not required by your application
• Implement strict input validation and sanitization for XML catalog files before processing
• Configure resource limits (e.g., ulimit -s) to prevent complete system resource exhaustion from stack overflow
• Use application sandboxing or containerization to isolate the impact of potential crashes

# Configuration example - Limit stack size to mitigate impact
# Add to application startup scripts
ulimit -s 8192

# Disable XML catalog processing via environment variable
export XML_CATALOG_FILES=""

# For applications supporting it, disable catalog processing
export LIBXML_NO_CATALOG=1