High severity8.5NVD Advisory· Published Sep 8, 2026· Updated Oct 14, 2026
CVE-2026-74860
CVE-2026-74860
Description
A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition (DTD) with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callback handler, where a string is freed twice. This flaw can lead to a denial of service (DoS) due to a reproducible crash in Python applications using the libxml2 SAX bindings.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
5- osv-coords4 versionspkg:rpm/almalinux/libxml2pkg:rpm/almalinux/libxml2-staticpkg:rpm/almalinux/libxml2-develpkg:rpm/almalinux/python3-libxml2
< 2.9.13-14.el9_8.5+ 3 more
- (no CPE)range: < 2.9.13-14.el9_8.5
- (no CPE)range: < 2.12.5-10.el10_2.4
- (no CPE)range: < 2.9.13-14.el9_8.5
- (no CPE)range: < 2.9.13-14.el9_8.5
Patches
Vulnerability mechanics
References
11- access.redhat.com/errata/RHSA-2026:64463nvd
- access.redhat.com/errata/RHSA-2026:71585nvd
- access.redhat.com/errata/RHSA-2026:71586nvd
- access.redhat.com/errata/RHSA-2026:71641nvd
- access.redhat.com/errata/RHSA-2026:72470nvd
- access.redhat.com/errata/RHSA-2026:72475nvd
- access.redhat.com/errata/RHSA-2026:72476nvd
- access.redhat.com/errata/RHSA-2026:79357nvd
- access.redhat.com/errata/RHSA-2026:82939nvd
- access.redhat.com/security/cve/CVE-2026-74860nvd
- bugzilla.redhat.com/show_bug.cginvd
News mentions
0No linked articles in our index yet.