VulnerabilityAwaiting Analysis

CVE-2026-86144

This has security relevance for, for example, the XML_PARSE_NONET flag, if (without it) a custom resource loader accesses the internet and triggers XML external entity injection, SSRF, or a denial of service (e.g., for an attacker-controlled internet…

MEDIUM 5.6EPSS 0.16%

Does this matter?

Lower severity and a low EPSS score (0.16%). Track it; it rarely justifies an emergency change on its own.

Description

In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, the XML_PARSE_NONET flag, if (without it) a custom resource loader accesses the internet and triggers XML external entity injection, SSRF, or a denial of service (e.g., for an attacker-controlled internet resource that is intentionally slow).

CVSS 3.1: 5.6 MEDIUMCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
EPSS: 0.16% probability · 6th percentile
CISA KEV: Not listed
Weakness: CWE-669
Source: cve@mitre.org

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.