CVE-2026-86144 Overview
CVE-2026-86144 affects libxml2 versions before 2.15.4. The vulnerability resides in the XInclude processing logic, where xmlXIncludeProcess and xmlXIncludeProcessTree fail to propagate parseFlags to nested parsing operations. Applications relying on flags such as XML_PARSE_NONET to block network access lose that protection during XInclude expansion. The flaw is tracked under [CWE-669: Incorrect Resource Transfer Between Spheres].
Attackers can leverage the missing flag propagation to trigger XML External Entity (XXE) injection, Server-Side Request Forgery (SSRF), or denial of service through attacker-controlled slow internet resources. Exploitation requires a custom resource loader that reaches the network when XML_PARSE_NONET is expected to be honored.
Critical Impact
Applications relying on XML_PARSE_NONET to sandbox XML parsing may inadvertently perform network requests during XInclude processing, exposing internal services to SSRF and enabling denial-of-service conditions.
Affected Products
- GNOME libxml2 versions prior to 2.15.4
- Applications embedding libxml2 that call xmlXIncludeProcess or xmlXIncludeProcessTree
- Downstream distributions and language bindings packaging libxml2 <= 2.15.3
Discovery Timeline
- 2026-09-05 - CVE-2026-86144 published to NVD
- 2026-09-08 - Last updated in NVD database
Technical Details for CVE-2026-86144
Vulnerability Analysis
The libxml2 library exposes xmlXIncludeProcess and xmlXIncludeProcessTree to expand XInclude directives inside XML documents. Callers configure parser behavior through parseFlags, including XML_PARSE_NONET to disable network fetches. Prior to version 2.15.4, these entry points did not forward parseFlags to the internal XInclude context.
As a result, sub-documents referenced by <xi:include href="..."/> are parsed with default options. A custom resource loader registered through xmlSetExternalEntityLoader may then honor network URIs even when the caller explicitly disabled network I/O. This creates a boundary violation between the caller's security policy and the library's actual behavior.
The impact classes include XXE, SSRF against metadata endpoints or internal HTTP services, and denial of service via slow-responding remote resources.
Root Cause
The root cause is a missing assignment of parseFlags when constructing the XInclude processing context. The public wrappers accepted the flag argument but did not store it where the recursive include logic could read it, causing the internal parser to fall back to defaults.
Attack Vector
An attacker supplies a crafted XML document containing XInclude directives that reference an attacker-controlled URL. When the victim application processes the document through xmlXIncludeProcess, the library issues network requests despite the caller passing XML_PARSE_NONET. The attacker then exfiltrates data via XXE, pivots to internal services via SSRF, or stalls the parser with a slow response.
+<?xml version="1.0"?>
+<doc xmlns:xi="http://www.w3.org/2001/XInclude">
+ Network access is not allowed
+</doc>
Source: GNOME libxml2 commit b63cd51. This test fixture from the security patch verifies that XInclude processing now respects the XML_PARSE_NONET flag and refuses network access.
Detection Methods for CVE-2026-86144
Indicators of Compromise
- Outbound HTTP or HTTPS requests originating from processes that parse untrusted XML but should not require network egress.
- DNS lookups from XML-processing services targeting attacker-controlled or metadata-service hostnames (for example, 169.254.169.254).
- Unexpected connections initiated during document ingestion pipelines that use libxml2 XInclude features.
Detection Strategies
- Inventory installed libxml2 versions across hosts and containers and flag anything below 2.15.4.
- Review application code and third-party dependencies for calls to xmlXIncludeProcess and xmlXIncludeProcessTree, especially where XML_PARSE_NONET is expected to enforce network isolation.
- Instrument XML ingestion services with network egress monitoring to detect deviations from expected traffic patterns.
Monitoring Recommendations
- Correlate process-level network telemetry with XML parsing workloads to identify anomalous outbound connections.
- Alert on requests to cloud metadata endpoints from application workloads that should not access them.
- Log XInclude processing errors and slow parsing operations that may indicate exploitation attempts against remote resources.
How to Mitigate CVE-2026-86144
Immediate Actions Required
- Upgrade libxml2 to version 2.15.4 or later on all systems.
- Rebuild and redeploy applications that statically link libxml2 against the patched release.
- Audit custom resource loaders registered via xmlSetExternalEntityLoader to enforce network denial independently of parseFlags.
Patch Information
The fix is available in libxml2 2.15.4. Review the upstream fix in the GNOME libxml2 commit b63cd51 and the full change set between releases in the libxml2 v2.15.3 to v2.15.4 comparison.
Workarounds
- Disable XInclude processing on untrusted input by not calling xmlXIncludeProcess or xmlXIncludeProcessTree until libxml2 is upgraded.
- Enforce network isolation for XML-processing workloads at the container or firewall layer to block outbound requests regardless of parser flags.
- Replace the default external entity loader with a strict allowlist implementation that refuses network URIs.
# Verify installed libxml2 version and update to a fixed release
xml2-config --version
# Debian/Ubuntu
sudo apt update && sudo apt install --only-upgrade libxml2
# RHEL/Fedora
sudo dnf update libxml2
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
