CVE-2026-1757
Libxml2: memory leak leading to local denial of service in xmllint interactive shell
- State
- Published
- Severity
- 6.2 Medium
- Published
- Feb 2, 2026
- Updated
- Sep 1, 2026
- Reserved
- Feb 2, 2026
Description
A flaw was identified in the interactive shell of the xmllint utility, part of the libxml2 project, where memory allocated for user input is not properly released under certain conditions. When a user submits input consisting only of whitespace, the program skips command execution but fails to free the allocated buffer. Repeating this action causes memory to continuously accumulate. Over time, this can exhaust system memory and terminate the xmllint process, creating a denial-of-service condition on the local system.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 6.2 Medium | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | redhat |
Weaknesses
- CWE-401 Missing Release of Memory after Effective Lifetime
Affected Products
| Product | Versions |
|---|---|
Red Hat Hardened ImagesRed Hat |
|
Red Hat Enterprise Linux 10Red Hat | |
Red Hat Enterprise Linux 6Red Hat | |
Red Hat Enterprise Linux 7Red Hat | |
Red Hat Enterprise Linux 8Red Hat | |
Red Hat Enterprise Linux 9Red Hat | |
Red Hat JBoss Core ServicesRed Hat | |
Red Hat OpenShift Container Platform 4Red Hat | |
Red Hat OpenShift Container Platform 4Red Hat |
References
- RHSA-2026:7519vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-1757vdb-entry
- RHBZ#2435940issue-tracking
- https://gitlab.gnome.org/GNOME/libxml2/-/issues/1009
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.