DEBIAN-CVE-2026-0992 - debian/libxml2
A flaw was found in the libxml2 library. This uncontrolled resource consumption vulnerability occurs when processing XML catalogs that contain repeated <nextCatalog> elements pointing to the same downstream catalog. A remote attacker can exploit this by supplying crafted catalogs, causing the parser to redundantly traverse catalog chains. This leads to excessive CPU consumption and degrades application availability, resulting in a denial-of-service condition.
CVSS 2.9 (LOW)
Evidence
- imported from OSV Debian, untriaged
History
- 2026-10-28: Awaiting approval - bulk import
- 2026-10-29: Awaiting triage - reclassified: OSV Debian bulk import, awaiting triage