SUSE-SU-2026:0391-1

Details

This update for libxml2 fixes the following issues:

CVE-2026-0989: Fixed call stack exhaustion leading to application crash due to RelaxNG parser not limiting the recursion depth when resolving <include> directives (bsc#1256805)

Affected Packages

libxml2

SUSE Linux Enterprise Micro 5.5openSUSE Leap 15.6

Fixed in:

2.10.3-150500.5.35.1

libxml2-2

SUSE Linux Enterprise Micro 5.5openSUSE Leap 15.6

Fixed in:

2.10.3-150500.5.35.1

libxml2-python

SUSE Linux Enterprise Micro 5.5openSUSE Leap 15.6

Fixed in:

2.10.3-150500.5.35.1

libxml2-tools

SUSE Linux Enterprise Micro 5.5openSUSE Leap 15.6

Fixed in:

2.10.3-150500.5.35.1

python3-libxml2

SUSE Linux Enterprise Micro 5.5openSUSE Leap 15.6

Fixed in:

2.10.3-150500.5.35.1

libxml2-2-32bit

openSUSE Leap 15.6

Fixed in:

2.10.3-150500.5.35.1

libxml2-devel

openSUSE Leap 15.6

Fixed in:

2.10.3-150500.5.35.1

libxml2-devel-32bit

openSUSE Leap 15.6

Fixed in:

2.10.3-150500.5.35.1

libxml2-doc

openSUSE Leap 15.6

Fixed in:

2.10.3-150500.5.35.1

python311-libxml2

openSUSE Leap 15.6

Fixed in:

2.10.3-150500.5.35.1

References

REPORT

https://bugzilla.suse.com/1256805

WEB

https://www.suse.com/security/cve/CVE-2026-0989

ADVISORY

https://www.suse.com/support/update/announcement/2026/suse-su-20260391-1/