libxml2-16-2.14.5-4.1 on GA media SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2026:10213-1 Final 1 1 2026-02-17T00:00:00Z current 2026-02-17T00:00:00Z 2026-02-17T00:00:00Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z libxml2-16-2.14.5-4.1 on GA media These are all security issues fixed in the libxml2-16-2.14.5-4.1 package on the GA media of openSUSE Tumbleweed. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-Tumbleweed-2026-10213 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/security/rating/ SUSE Security Ratings https://www.suse.com/security/cve/CVE-2025-8732/ SUSE CVE CVE-2025-8732 page https://www.suse.com/security/cve/CVE-2026-0990/ SUSE CVE CVE-2026-0990 page https://www.suse.com/security/cve/CVE-2026-0992/ SUSE CVE CVE-2026-0992 page openSUSE Tumbleweed libxml2-16-2.14.5-4.1 libxml2-16-32bit-2.14.5-4.1 libxml2-devel-2.14.5-4.1 libxml2-devel-32bit-2.14.5-4.1 libxml2-doc-2.14.5-4.1 libxml2-tools-2.14.5-4.1 libxml2-16-2.14.5-4.1 as a component of openSUSE Tumbleweed libxml2-16-32bit-2.14.5-4.1 as a component of openSUSE Tumbleweed libxml2-devel-2.14.5-4.1 as a component of openSUSE Tumbleweed libxml2-devel-32bit-2.14.5-4.1 as a component of openSUSE Tumbleweed libxml2-doc-2.14.5-4.1 as a component of openSUSE Tumbleweed libxml2-tools-2.14.5-4.1 as a component of openSUSE Tumbleweed A vulnerability was found in libxml2 up to 2.14.5. It has been declared as problematic. This vulnerability affects the function xmlParseSGMLCatalog of the component xmlcatalog. The manipulation leads to uncontrolled recursion. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The code maintainer explains, that "[t]he issue can only be triggered with untrusted SGML catalogs and it makes absolutely no sense to use untrusted catalogs. I also doubt that anyone is still using SGML catalogs at all." CVE-2025-8732 openSUSE Tumbleweed:libxml2-16-2.14.5-4.1 openSUSE Tumbleweed:libxml2-16-32bit-2.14.5-4.1 openSUSE Tumbleweed:libxml2-devel-2.14.5-4.1 openSUSE Tumbleweed:libxml2-devel-32bit-2.14.5-4.1 openSUSE Tumbleweed:libxml2-doc-2.14.5-4.1 openSUSE Tumbleweed:libxml2-tools-2.14.5-4.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-8732.html CVE-2025-8732 https://bugzilla.suse.com/1247850 SUSE Bug 1247850 A flaw was found in libxml2, an XML parsing library. This uncontrolled recursion vulnerability occurs in the xmlCatalogXMLResolveURI function when an XML catalog contains a delegate URI entry that references itself. A remote attacker could exploit this configuration-dependent issue by providing a specially crafted XML catalog, leading to infinite recursion and call stack exhaustion. This ultimately results in a segmentation fault, causing a Denial of Service (DoS) by crashing affected applications. CVE-2026-0990 openSUSE Tumbleweed:libxml2-16-2.14.5-4.1 openSUSE Tumbleweed:libxml2-16-32bit-2.14.5-4.1 openSUSE Tumbleweed:libxml2-devel-2.14.5-4.1 openSUSE Tumbleweed:libxml2-devel-32bit-2.14.5-4.1 openSUSE Tumbleweed:libxml2-doc-2.14.5-4.1 openSUSE Tumbleweed:libxml2-tools-2.14.5-4.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2026-0990.html CVE-2026-0990 https://bugzilla.suse.com/1256806 SUSE Bug 1256806 A flaw was found in the libxml2 library. This uncontrolled resource consumption vulnerability occurs when processing XML catalogs that contain repeated <nextCatalog> elements pointing to the same downstream catalog. A remote attacker can exploit this by supplying crafted catalogs, causing the parser to redundantly traverse catalog chains. This leads to excessive CPU consumption and degrades application availability, resulting in a denial-of-service condition. CVE-2026-0992 openSUSE Tumbleweed:libxml2-16-2.14.5-4.1 openSUSE Tumbleweed:libxml2-16-32bit-2.14.5-4.1 openSUSE Tumbleweed:libxml2-devel-2.14.5-4.1 openSUSE Tumbleweed:libxml2-devel-32bit-2.14.5-4.1 openSUSE Tumbleweed:libxml2-doc-2.14.5-4.1 openSUSE Tumbleweed:libxml2-tools-2.14.5-4.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2026-0992.html CVE-2026-0992 https://bugzilla.suse.com/1256808 SUSE Bug 1256808