libxml2 Python Bindings Double-Free DTD Enumerated Attribute During SAX Parsing, Causing Denial of Service with Scope Impact Scoring 8.5
Last refreshed2026-10-30
Status: UPDATED
| Advisory ID: CVE-2026-74860
Key Details
CVE
CVE-2026-74860
CVSS Score / Version
8.5 (High) / CVSS v3.1
Updated
2026-10-30
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS Prose
attack vector is network; attack complexity is high; privileges required is low; user interaction is none; scope is changed; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected products
see table below
Classified as
CWE-763 (Release of Invalid Pointer or Reference)
Exploitation prediction (EPSS)
0.45% probability of exploitation in the next 30 days (37% percentile) -- FIRST.org's EPSS model.
Affected Products, Subsystems & Sectors
Vendor
Product
Affected Versions
Patch Status
Red Hat
Red Hat Enterprise Linux 10
Red Hat
Red Hat Enterprise Linux 8
Red Hat
Red Hat Enterprise Linux 9
Red Hat
Red Hat Enterprise Linux 7
Red Hat
Red Hat Update Infrastructure 5
Red Hat
Red Hat Hardened Images
Red Hat
Cert Manager support for Red Hat OpenShift release 1.20
Red Hat
Red Hat Cost Management On-Premise 1
Subsystems
OT Supporting Infrastructure
Sectors
Multiple
What to Know
A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition (DTD) with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callback handler, where a string is freed twice. This flaw can lead to a denial of service (DoS) due to a reproducible crash in Python applications using the libxml2 SAX bindings. (NVD)
What to Do
Monitor Red Hat's web page for any future patch releases.