CVE-2026-74860 in Red Hat
Summary
by MITRE • 09/08/2026
A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition (DTD) with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callback handler, where a string is freed twice. This flaw can lead to a denial of service (DoS) due to a reproducible crash in Python applications using the libxml2 SAX bindings.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/08/2026
The vulnerability identified in libxml2 with Python bindings enabled represents a critical memory management error within the XML parsing engine, specifically affecting the Simple API for XML processing capabilities when integrated into Python environments. This flaw is rooted in the handling of Document Type Definitions that contain enumerated attribute values. When a remote attacker provides a specially crafted XML document featuring such DTD structures, the libxml2 library processes these definitions through its SAX callback handlers. The core technical failure occurs within the attributeDecl callback function, where memory allocation and deallocation logic fails to properly track reference counts or state transitions for specific string objects associated with enumerated attributes. This oversight results in a double-free condition, meaning that a single block of allocated heap memory is released twice by the application runtime.
From a technical perspective, this issue aligns closely with CWE-415, which describes Double Free vulnerabilities. In C-based libraries like libxml2, freeing memory more than once corrupts the internal data structures used by the memory allocator to manage free and busy blocks on the heap. This corruption is not merely theoretical; it leads directly to undefined behavior within the Python interpreter that hosts the library. Because Python relies heavily on stable memory management for its object lifecycle, a double-free in a C extension can cause immediate segmentation faults or other critical runtime errors. The vulnerability is particularly dangerous because it does not require complex exploitation techniques to trigger the crash; simply parsing the malformed XML document is sufficient to invoke the faulty code path and execute the erroneous free operation.
The operational impact of this vulnerability is primarily focused on denial of service rather than remote code execution, although the potential for more severe consequences cannot be entirely ruled out depending on the specific memory layout at runtime. For applications that utilize libxml2 via Python bindings to process untrusted or semi-trusted XML input from network sources, an attacker can reliably cause a reproducible crash by sending the crafted payload. This effectively disrupts service availability, as the application process terminates unexpectedly upon encountering the malformed document. In scenarios where such parsing occurs in web services, API gateways, or data ingestion pipelines, this flaw allows for straightforward denial-of-service attacks that require minimal effort from the adversary but result in significant operational downtime and potential loss of integrity if crash logs expose sensitive internal states.
Mitigation strategies must address both immediate remediation and long-term defensive posture. The primary solution is to upgrade libxml2 to a version where this double-free issue has been patched by the maintainers, ensuring that memory management for enumerated attribute declarations in DTDs is handled correctly without releasing freed pointers. For organizations unable to immediately patch their dependencies, implementing strict input validation at the network perimeter or application layer can help block XML documents containing suspiciously crafted DTD structures with enumerated attributes before they reach the vulnerable parser. Additionally, enabling core dump analysis and monitoring for abnormal process terminations in Python applications using libxml2 can aid in early detection of exploitation attempts. From a classification standpoint, this vulnerability is often associated with ATT&CK technique T1499, specifically endpoint denial of service via application exhaustion or crash, highlighting the importance of treating XML parsing libraries as potential attack surfaces that require rigorous sanitization and version control management to maintain system resilience against automated abuse.