CVE-2026-0990 in libxml2
Summary
by MITRE • 01/15/2026
A flaw was found in libxml2, an XML parsing library. This uncontrolled recursion vulnerability occurs in the xmlCatalogXMLResolveURI function when an XML catalog contains a delegate URI entry that references itself. A remote attacker could exploit this configuration-dependent issue by providing a specially crafted XML catalog, leading to infinite recursion and call stack exhaustion. This ultimately results in a segmentation fault, causing a Denial of Service (DoS) by crashing affected applications.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 06/29/2026
The vulnerability identified as CVE-2026-0990 represents a critical security flaw within libxml2, a widely deployed XML parsing library that forms the backbone of numerous applications across diverse computing environments. This issue manifests as an uncontrolled recursion condition that specifically targets the xmlCatalogXMLResolveURI function, demonstrating how seemingly innocuous XML catalog configurations can become vectors for sophisticated attack exploitation. The flaw operates under the principle of self-referential delegation where an XML catalog entry contains a delegate URI that points back to itself, creating a recursive loop that can consume system resources without bounds.
The technical implementation of this vulnerability resides in the catalog resolution mechanism of libxml2, where the library attempts to resolve URIs through a hierarchical catalog system that supports delegation. When a delegate URI entry references itself, the resolution process enters an infinite loop that continues until system resources are exhausted. This recursive behavior constitutes a classic stack overflow scenario that can be triggered through carefully crafted XML catalog files, making the vulnerability particularly dangerous in environments where external XML catalog inputs are processed without proper validation. The vulnerability maps directly to CWE-674, which defines "Uncontrolled Recursion" as a weakness that occurs when a function or method does not properly check for recursive calls that could lead to stack exhaustion.
The operational impact of CVE-2026-0990 extends far beyond simple service disruption, as it enables remote attackers to execute Denial of Service attacks against applications that rely on libxml2 for XML processing. The segmentation fault that results from call stack exhaustion can crash entire applications, potentially affecting critical infrastructure components that depend on XML parsing for configuration management, data exchange, and document processing. This vulnerability particularly affects web applications, enterprise software, and systems that process user-provided XML content, as these environments often lack proper input validation controls. The attack vector is particularly insidious because it can be exploited through legitimate XML catalog functionality, making it difficult to detect through traditional network monitoring or intrusion detection systems.
Mitigation strategies for this vulnerability should focus on both immediate defensive measures and long-term architectural improvements. The most effective immediate solution involves upgrading to patched versions of libxml2 where the recursion depth is properly bounded and validated. Organizations should implement input validation controls that monitor for self-referential URI entries in XML catalogs and reject suspicious configurations. The implementation of resource limits and timeout mechanisms around XML processing operations can provide additional protection layers. From an ATT&CK framework perspective, this vulnerability aligns with the T1499.004 technique for "Resource Hijacking" and represents a classic example of how seemingly benign functionality can be weaponized for system compromise. Network administrators should consider implementing XML content filtering and sandboxing mechanisms to prevent malicious XML catalog files from reaching vulnerable applications, while also ensuring that all systems processing XML content undergo regular vulnerability assessments to identify similar recursion vulnerabilities in other libraries and components.