Description
A flaw was found in the interactive shell of the xmllint command-line tool, used for parsing XML files. When a user inputs an overly long command, the program does not check the input size properly, which can cause it to crash. This issue might allow attackers to run harmful code in rare configurations without modern protections.
Affected products
redhat: jboss core services; redhat: openshift container platform; redhat: enterprise linux; xmlsoft: libxml2
References10
- access.redhat.com/errata/RHSA-2026:36734
- access.redhat.com/errata/RHSA-2026:39304
- access.redhat.com/errata/RHSA-2026:39317
- access.redhat.com/errata/RHSA-2026:44481
- access.redhat.com/errata/RHSA-2026:46836
- access.redhat.com/errata/RHSA-2026:53371
- access.redhat.com/errata/RHSA-2026:58981
- access.redhat.com/errata/RHSA-2026:70596
- access.redhat.com/errata/RHSA-2026:70639
- access.redhat.com/errata/RHSA-2026:72394
Metrics
- CVSS 3.1
-
2.5
LOW
Score source: NVD
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L - EPSS — exploit probability
- 0% percentile: 25 · as of 7 November 2026
- CWE
- CWE-121
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.