Linux · Security advisory · September 24, 2026
ELSA-2026-71585: Security update for 3 packages
ELSA-2026-71585, released September 24, 2026, fixes 6 CVEs across 3 products. None of them is reported as exploited. Patch Radar priority: High.
High
CVEs closed
6
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0066
51st percentile
Priority of the 6 CVEs
Patch now 0
Urgent 0
High 6
Routine 0
Fixed package versions
| Product | Release | Fixed in |
|---|---|---|
| libxml2 | ol 9 | 0:2.9.13-14.el9_8.5 |
| libxml2-devel | ol 9 | 0:2.9.13-14.el9_8.5 |
| python3-libxml2 | ol 9 | 0:2.9.13-14.el9_8.5 |
CVEs this fix closes
| Priority | CVE | Title | Impact | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| High | CVE-2026-74860 | libxml2: A flaw was found in libxml2 with Python bindings enabled | 8.5 | 0.0066 | None reported | |
| High | CVE-2026-86143 | In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks, aka a lack of a check for integer overflow before calling writecallback. This has security relevance for many types of uses of that length value within a callback. | 8.5 | 0.0019 | None reported | |
| High | CVE-2026-86144 | In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, the XML_PARSE_NONET flag, if (without it) a custom resource loader accesses the internet and triggers XML external entity injection, SSRF, or a denial of service (e.g., for an attacker-controlled internet resource that is intentionally slow). | 8.5 | 0.0019 | None reported | |
| High | CVE-2026-86140 | In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-based buffer overflow. | 8.5 | 0.0016 | None reported | |
| High | CVE-2026-86142 | In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation. | 8.5 | 0.0016 | None reported | |
| High | CVE-2026-86138 | In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based buffer overflow. | 8.5 | 0.0013 | None reported |
Showing 1 to 6 of 6
1