{"affected":[{"defaultStatus":"affected","ecosystem":"https://catalog.redhat.com/software/containers/","packageName":"libxml2-main","product":"Red Hat Hardened Images","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"2.15.2-0.3.hum1","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"libxml2","product":"Red Hat Enterprise Linux 10","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"libxml2","product":"Red Hat Enterprise Linux 6","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"libxml2","product":"Red Hat Enterprise Linux 7","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"libxml2","product":"Red Hat Enterprise Linux 8","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"libxml2","product":"Red Hat Enterprise Linux 9","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","packageName":"libxml2","product":"Red Hat JBoss Core Services","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhoai/odh-ai-gateway-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unknown","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhoai/odh-core-bff-rhel9","product":"Red Hat OpenShift AI (RHOAI)","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhoai/odh-dashboard-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unknown","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhoai/odh-dashboard-rhel9","product":"Red Hat OpenShift AI (RHOAI)","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhoai/odh-data-science-pipelines-operator-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unknown","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhoai/odh-kf-notebook-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhoai/odh-kserve-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhoai/odh-kserve-llmisvc-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhoai/odh-kserve-module-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhoai/odh-kuberay-operator-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhoai/odh-kube-rbac-proxy-rhel9","product":"Red Hat OpenShift AI (RHOAI)","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhoai/odh-llama-stack-k8s-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhoai/odh-maas-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhoai/odh-mlflow-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhoai/odh-mlflow-rhel9","product":"Red Hat OpenShift AI (RHOAI)","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unknown","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhoai/odh-mod-arch-agent-ops-rhel9","product":"Red Hat OpenShift AI (RHOAI)","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unknown","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhoai/odh-mod-arch-automl-rhel9","product":"Red Hat OpenShift AI (RHOAI)","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unknown","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhoai/odh-mod-arch-autorag-rhel9","product":"Red Hat OpenShift AI (RHOAI)","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unknown","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhoai/odh-mod-arch-eval-hub-rhel9","product":"Red Hat OpenShift AI (RHOAI)","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unknown","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhoai/odh-mod-arch-gen-ai-rhel9","product":"Red Hat OpenShift AI (RHOAI)","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unknown","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhoai/odh-mod-arch-maas-rhel9","product":"Red Hat OpenShift AI (RHOAI)","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unknown","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhoai/odh-mod-arch-mlflow-rhel9","product":"Red Hat OpenShift AI (RHOAI)","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unknown","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhoai/odh-mod-arch-model-registry-rhel9","product":"Red Hat OpenShift AI (RHOAI)","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhoai/odh-model-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhoai/odh-model-registry-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhoai/odh-model-serving-api-rhel9","product":"Red Hat OpenShift AI (RHOAI)","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unknown","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhoai/odh-notebook-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhoai/odh-ogx-k8s-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhoai/odh-ogx-module-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhoai/odh-training-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhoai/odh-trustyai-service-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhoai/odh-workbenches-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift/ose-rhel-coreos-8","product":"Red Hat OpenShift Container Platform 4","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 4","source":"CNA: redhat","vendor":"Red Hat","versions":[]}],"cpeConfigurations":[{"negate":false,"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:redhat:hardened_images:-:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:redhat:jboss_core_services:-:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"OR"},{"negate":false,"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:ibm:vios:*:*:*:*:*:*:*:*","versionEndExcluding":"4.1.1.30","versionStartIncluding":"4.1.0","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:vios:4.1.2.0:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:o:ibm:aix:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2.5.12","versionStartIncluding":"7.2.5","vulnerable":true},{"criteria":"cpe:2.3:o:ibm:aix:*:*:*:*:*:*:*:*","versionEndExcluding":"7.3.3.3","versionStartIncluding":"7.3.2","vulnerable":true},{"criteria":"cpe:2.3:o:ibm:aix:7.3.4:*:*:*:*:*:*:*","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"OR"},{"negate":false,"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:*","versionEndExcluding":"2.15.2","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"OR"}],"cveId":"CVE-2026-0990","cwes":["CWE-674"],"description":"A flaw was found in libxml2, an XML parsing library. This uncontrolled recursion vulnerability occurs in the xmlCatalogXMLResolveURI function when an XML catalog contains a delegate URI entry that references itself. A remote attacker could exploit this configuration-dependent issue by providing a specially crafted XML catalog, leading to infinite recursion and call stack exhaustion. This ultimately results in a segmentation fault, causing a Denial of Service (DoS) by crashing affected applications.","epss":{"date":"2026-11-05","percentile":0.61524,"score":0.00955},"exploits":[{"kind":"exploit","source":"secalert@redhat.com","url":"https://gitlab.gnome.org/GNOME/libxml2/-/issues/1018"}],"kev":null,"metrics":[{"score":5.9,"severity":"medium","source":"CNA: redhat","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},{"score":5.9,"severity":"medium","source":"NVD: secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"}],"modifiedAt":1793951386646,"publishedAt":1768486806515,"references":[{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:7519"},{"source":"CNA: redhat","tags":["vdb-entry","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2026-0990"},{"source":"CNA: redhat","tags":["issue-tracking","x_refsource_REDHAT"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2429959"},{"source":"CNA: redhat","tags":[],"url":"https://gitlab.gnome.org/GNOME/libxml2/-/issues/1018"},{"source":"secalert@redhat.com","tags":["Third Party Advisory"],"url":"https://access.redhat.com/errata/RHSA-2026:7519"},{"source":"secalert@redhat.com","tags":["Third Party Advisory"],"url":"https://access.redhat.com/security/cve/CVE-2026-0990"},{"source":"secalert@redhat.com","tags":["Issue Tracking","Third Party Advisory"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2429959"},{"source":"secalert@redhat.com","tags":["Exploit","Issue Tracking","Third Party Advisory"],"url":"https://gitlab.gnome.org/GNOME/libxml2/-/issues/1018"}],"remediation":[{"kind":"workaround","source":"CNA: redhat","text":"Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}],"revision":"e2952196c207121abd12d6f21d070080d5ca7cce5f58e8fedf2800235e031900","sources":[{"modifiedAt":1793951386646,"name":"CNA: redhat","retrievedAt":1793952510890,"url":"https://www.cve.org/CVERecord?id=CVE-2026-0990"},{"modifiedAt":1793899047593,"name":"NVD","retrievedAt":1793902816816,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0990"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793898566766,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-0990"}],"ssvc":{"assessedAt":1768494680247,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Libxml2: libxml2: denial of service via uncontrolled recursion in xml catalog processing","updatedAt":1793952510890}