{"id":"CLSA-2026-1787063229","summary":"Fix CVE(s): CVE-2025-8732, CVE-2026-0989, CVE-2026-0990, CVE-2026-0992","details":"   * SECURITY UPDATE: uncontrolled recursion in SGML catalog parsing\n     - debian/patches/CVE-2025-8732.patch: thread a depth counter through\n       xmlParseSGMLCatalog() and xmlExpandCatalog() in catalog.c and bail out\n       past MAX_CATAL_DEPTH, and register expanded catalog filenames in the\n       SGML hash table before recursing so a repeated CATALOG directive is\n       only followed once, to prevent stack exhaustion and exponential\n       re-parsing on self-referencing SGML CATALOG entries. Add test files\n       result/catalogs/recursive, test/catalogs/recursive.script and\n       test/catalogs/recursive.sgml\n     - CVE-2025-8732\n   * SECURITY UPDATE: uncontrolled recursion in the RelaxNG parser via nested\n     schema includes\n     - debian/patches/CVE-2026-0989.patch: add an include depth limit to the\n       RelaxNG parser context in relaxng.c, defaulting to 1000 and overridable\n       via the RNG_INCLUDE_LIMIT environment variable or the new\n       xmlRelaxParserSetIncLImit() entry point in include/libxml/relaxng.h, and\n       make xmlRelaxNGIncludePush() failures propagate. Add coverage in\n       runtest.c and test/relaxng/include/include-limit*.rng\n     - debian/libxml2.symbols: add the new xmlRelaxParserSetIncLImit symbol\n     - CVE-2026-0989\n   * SECURITY UPDATE: uncontrolled recursion in XML catalog URI resolution\n     - debian/patches/CVE-2026-0990.patch: add a MAX_CATAL_DEPTH guard to\n       xmlCatalogListXMLResolveURI() in catalog.c and stop clobbering the\n       catalog entry used for depth bookkeeping while walking the entry list,\n       to prevent stack exhaustion on a self-referencing delegateURI entry\n     - CVE-2026-0990\n   * SECURITY UPDATE: uncontrolled resource consumption via repeated\n     nextCatalog entries\n     - debian/patches/CVE-2026-0992.patch: ignore duplicate nextCatalog\n       entries in xmlParseXMLCatalogNode() in catalog.c, to prevent redundant\n       exponential traversal of catalog chains. Guard the new loop against a\n       NULL entry so a nextCatalog element without a 'catalog' attribute is\n       still skipped with an error instead of crashing\n     - CVE-2026-0992","modified":"2026-10-26T09:31:52.918506425Z","published":"2026-08-18T14:27:22Z","upstream":["CVE-2025-8732","CVE-2026-0989","CVE-2026-0990","CVE-2026-0992"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/debian10els/CLSA-2026-1787063229.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-8732"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0989"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0990"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0992"}],"affected":[{"package":{"name":"libxml2","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/libxml2?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.10+dfsg-5ubuntu0.20.04.10+tuxcare.els7"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1787063229.json"}},{"package":{"name":"libxml2-dev","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/libxml2-dev?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.10+dfsg-5ubuntu0.20.04.10+tuxcare.els7"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1787063229.json"}},{"package":{"name":"libxml2-doc","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/libxml2-doc?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.10+dfsg-5ubuntu0.20.04.10+tuxcare.els7"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1787063229.json"}},{"package":{"name":"libxml2-utils","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/libxml2-utils?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.10+dfsg-5ubuntu0.20.04.10+tuxcare.els7"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1787063229.json"}},{"package":{"name":"python-libxml2","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/python-libxml2?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.10+dfsg-5ubuntu0.20.04.10+tuxcare.els7"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1787063229.json"}},{"package":{"name":"python3-libxml2","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/python3-libxml2?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.10+dfsg-5ubuntu0.20.04.10+tuxcare.els7"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1787063229.json"}}],"schema_version":"1.9.0"}