CVE-2026-74860: libxml2 Python Bindings DoS Vulnerability

CVE-2026-74860 Overview

CVE-2026-74860 is a double-free vulnerability in libxml2 when built with Python bindings enabled. A remote attacker can trigger the flaw by supplying a crafted XML document that contains a Document Type Definition (DTD) with enumerated attribute values. Processing the document causes the SAX attributeDecl callback handler to free the same string twice, corrupting the allocator state. The condition results in a reproducible crash in Python applications that consume XML through the libxml2 SAX bindings, producing a denial-of-service condition. The weakness is tracked as [CWE-763] (Release of Invalid Pointer or Reference).

Critical Impact
Remote attackers can crash any Python service that parses untrusted XML via the libxml2 SAX interface, disrupting availability of the affected process.

Affected Products

libxml2 builds with Python bindings enabled
Python applications using the libxml2 SAX bindings
Red Hat Enterprise Linux distributions shipping the affected libxml2 package (see Red Hat Security Advisory RHSA-2026:64463)

Discovery Timeline

2026-09-08 - CVE-2026-74860 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-74860

Vulnerability Analysis

The flaw resides in the SAX attributeDecl callback handler exposed through the libxml2 Python bindings. When the parser processes a DTD entry that declares an attribute with an enumerated value list, the handler releases a string buffer and later releases the same pointer a second time. The duplicated free operation corrupts heap metadata and terminates the parsing process. Because DTD content can be embedded directly inside XML documents accepted from untrusted sources, any Python service that routes such input into the SAX interface is reachable from the network. The result is a deterministic crash rather than silent memory corruption, which limits exploitation to denial of service under most build configurations.

Root Cause

The root cause is duplicate ownership of an allocated string within the attributeDecl SAX callback path. The handler frees an enumeration value string during teardown of the attribute declaration and then frees it again when the enclosing declaration structure is released, matching the [CWE-763] pattern of releasing a pointer that is no longer valid.

Attack Vector

An attacker delivers a specially crafted XML document containing a DTD with enumerated attribute values to any endpoint that parses XML with the libxml2 Python SAX bindings. No authentication to the parsing process itself is required at the protocol layer; the attacker only needs the ability to submit XML input. Successful exploitation crashes the process handling the request.

No verified public proof-of-concept code is available at the time of writing. Refer to Red Hat CVE-2026-74860 Details and Red Hat Bugzilla Issue #2529697 for further technical context.

Detection Methods for CVE-2026-74860

Indicators of Compromise

Unexpected termination of Python worker processes that parse XML, with crash signatures referencing libxml2 and xmlFree.
Core dumps or systemd service restarts correlated with inbound XML payloads containing DTD ATTLIST declarations that define enumerated values.
Repeated malformed XML submissions from a single source targeting endpoints that accept XML.

Detection Strategies

Inspect application and system logs for double free or corruption messages emitted by glibc when libxml2-linked Python processes abort.
Deploy web application firewall or reverse proxy rules that flag XML bodies containing inline DTDs with ATTLIST enumerations from untrusted clients.
Monitor software inventory for libxml2 package versions predating the vendor fix on hosts running Python XML workloads.

Monitoring Recommendations

Alert on repeated abnormal exits of the same Python service within a short interval, which is characteristic of a reproducible crash-based denial of service.
Correlate XML parsing errors with source IP addresses to identify probing activity.
Track patch state for libxml2 and its Python bindings across the fleet and generate deviations when hosts fall out of compliance.

How to Mitigate CVE-2026-74860

Immediate Actions Required

Apply the vendor-provided libxml2 update from Red Hat Security Advisory RHSA-2026:64463 or the equivalent update from your Linux distribution.
Restart all Python services that link against libxml2 after patching to ensure the updated library is loaded.
Restrict XML input to authenticated, trusted producers where operationally feasible until patches are deployed.

Patch Information

Red Hat has published fixed packages through Red Hat Security Advisory RHSA-2026:64463. Consult Red Hat CVE-2026-74860 Details for the mapping between affected components and fixed versions, and Red Hat Bugzilla Issue #2529697 for upstream tracking.

Workarounds

Disable acceptance of inline DTDs at the application layer, or reject XML documents that contain ATTLIST declarations, before they reach the SAX parser.
Switch affected code paths to a parser configuration that does not invoke the vulnerable attributeDecl SAX callback, such as a non-SAX interface, until the patch is applied.
Terminate parsing in an isolated worker process with automatic restart so that a crash does not degrade the parent service beyond a single request.

bash

# Example: update libxml2 on Red Hat Enterprise Linux and restart dependent services
sudo dnf update libxml2 python3-libxml2
sudo systemctl restart <your-python-xml-service>