{"id":"ECHO-e3c1-3a3b-83ba","summary":"Integer overflow in xmlURIEscapeStr (uri.c). Upstream fix\n(8edbbdb0) adds `if (len == 0) return(NULL);` after xmlStrlen to\ncatch overflow where xmlStrlen returns 0 for a non-empty input.\nDebian trixie's 2.9.14-based package already has the equivalent\nguard `if (!(len \u003e 0)) return(NULL);` at the same site, so the\nbot's CVE-2026-86139 backport (#21567) is a no-op cosmetic rewrite\nand is not carried. Verified against the deb13u3 source tree.\n","modified":"2026-09-08T10:45:14.037895052Z","published":"2026-09-05T13:04:05.274Z","withdrawn":"2026-09-08T10:27:57.100Z","upstream":["CVE-2026-86139"],"references":[{"type":"WEB","url":"https://advisory.echohq.com/cve/CVE-2026-86139"},{"type":"WEB","url":"https://advisory.echohq.com/cve/CVE-2026-86139"}],"affected":[{"package":{"name":"libxml2","ecosystem":"Echo","purl":"pkg:deb/echo/libxml2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12.7+dfsg+really2.9.14-2.1+deb13u3"}]}],"database_specific":{"source":"https://advisory.echohq.com/osv/ECHO-e3c1-3a3b-83ba.json"}}],"schema_version":"1.9.0"}