CVE-2026-0989
ADVISORY - nistSummary
A flaw was identified in the RelaxNG parser of libxml2 related to how external schema inclusions are handled. The parser does not enforce a limit on inclusion depth when resolving nested directives. Specially crafted or overly complex schemas can cause excessive recursion during parsing. This may lead to stack exhaustion and application crashes, creating a denial-of-service risk.
EPSS Score: 0.00455 (0.377)
Common Weakness Enumeration (CWE)
ADVISORY - nist
Uncontrolled Recursion
ADVISORY - redhat
Uncontrolled Recursion
Alpine
CREATED
UPDATED
ADVISORY IDCVE-2026-0989
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-
| Package | Type | OS Name | OS Version | Affected Ranges | Fix Versions |
|---|---|---|---|---|---|
| alpine/libxml2 | apk | alpine | 3.23 | <=2.13.9-r1 | Not yet available |
| alpine/libxml2 | apk | alpine | 3.19 | <=2.10.0-r0 | Not yet available |
| alpine/libxml2 | apk | alpine | 3.19 | <=2.10.3-r0 | Not yet available |
| alpine/libxml2 | apk | alpine | 3.19 | <=2.10.4-r0 | Not yet available |
| alpine/libxml2 | apk | alpine | 3.19 | <=2.11.6-r0 | Not yet available |
| alpine/libxml2 | apk | alpine | 3.19 | <=2.11.7-r0 | Not yet available |
| alpine/libxml2 | apk | alpine | 3.19 | <=2.11.8-r0 | Not yet available |
| alpine/libxml2 | apk | alpine | 3.19 | <=2.11.8-r1 | Not yet available |
| alpine/libxml2 | apk | alpine | 3.19 | <=2.11.8-r2 | Not yet available |
| alpine/libxml2 | apk | alpine | 3.19 | <=2.11.8-r3 | Not yet available |
| alpine/libxml2 | apk | alpine | 3.19 | <=2.9.10-r4 | Not yet available |
| alpine/libxml2 | apk | alpine | 3.19 | <=2.9.10-r5 | Not yet available |
| alpine/libxml2 | apk | alpine | 3.19 | <=2.9.11-r0 | Not yet available |
| alpine/libxml2 | apk | alpine | 3.19 | <=2.9.13-r0 | Not yet available |
| alpine/libxml2 | apk | alpine | 3.19 | <=2.9.14-r0 | Not yet available |
| alpine/libxml2 | apk | alpine | 3.19 | <=2.9.4-r1 | Not yet available |
| alpine/libxml2 | apk | alpine | 3.19 | <=2.9.4-r2 | Not yet available |
| alpine/libxml2 | apk | alpine | 3.19 | <=2.9.4-r4 | Not yet available |
| alpine/libxml2 | apk | alpine | 3.19 | <=2.9.8-r1 | Not yet available |
| alpine/libxml2 | apk | alpine | 3.19 | <=2.9.8-r3 | Not yet available |
| alpine/libxml2 | apk | alpine | 3.20 | <=2.10.0-r0 | Not yet available |
| alpine/libxml2 | apk | alpine | 3.20 | <=2.10.3-r0 | Not yet available |
| alpine/libxml2 | apk | alpine | 3.20 | <=2.10.4-r0 | Not yet available |
| alpine/libxml2 | apk | alpine | 3.20 | <=2.12.10-r0 | Not yet available |
| alpine/libxml2 | apk | alpine | 3.20 | <=2.12.5-r0 | Not yet available |
| alpine/libxml2 | apk | alpine | 3.20 | <=2.12.7-r0 | Not yet available |
| alpine/libxml2 | apk | alpine | 3.20 | <=2.12.7-r1 | Not yet available |
| alpine/libxml2 | apk | alpine | 3.20 | <=2.12.7-r2 | Not yet available |
| alpine/libxml2 | apk | alpine | 3.20 | <=2.12.7-r3 | Not yet available |
| alpine/libxml2 | apk | alpine | 3.20 | <=2.9.10-r4 | Not yet available |
| alpine/libxml2 | apk | alpine | 3.20 | <=2.9.10-r5 | Not yet available |
| alpine/libxml2 | apk | alpine | 3.20 | <=2.9.11-r0 | Not yet available |
| alpine/libxml2 | apk | alpine | 3.20 | <=2.9.13-r0 | Not yet available |
| alpine/libxml2 | apk | alpine | 3.20 | <=2.9.14-r0 | Not yet available |
| alpine/libxml2 | apk | alpine | 3.20 | <=2.9.4-r1 | Not yet available |
| alpine/libxml2 | apk | alpine | 3.20 | <=2.9.4-r2 | Not yet available |
| alpine/libxml2 | apk | alpine | 3.20 | <=2.9.4-r4 | Not yet available |
| alpine/libxml2 | apk | alpine | 3.20 | <=2.9.8-r1 | Not yet available |
| alpine/libxml2 | apk | alpine | 3.20 | <=2.9.8-r3 | Not yet available |
| alpine/libxml2 | apk | alpine | 3.24 | <=2.13.9-r2 | Not yet available |
| alpine/libxml2 | apk | alpine | 3.21 | <=2.10.0-r0 | Not yet available |
| alpine/libxml2 | apk | alpine | 3.21 | <=2.10.3-r0 | Not yet available |
| alpine/libxml2 | apk | alpine | 3.21 | <=2.10.4-r0 | Not yet available |
| alpine/libxml2 | apk | alpine | 3.21 | <=2.12.5-r0 | Not yet available |
| alpine/libxml2 | apk | alpine | 3.21 | <=2.12.7-r0 | Not yet available |
| alpine/libxml2 | apk | alpine | 3.21 | <=2.13.4-r3 | Not yet available |
| alpine/libxml2 | apk | alpine | 3.21 | <=2.13.4-r4 | Not yet available |
| alpine/libxml2 | apk | alpine | 3.21 | <=2.13.4-r5 | Not yet available |
| alpine/libxml2 | apk | alpine | 3.21 | <=2.13.4-r6 | Not yet available |
| alpine/libxml2 | apk | alpine | 3.21 | <=2.13.9-r0 | Not yet available |
| alpine/libxml2 | apk | alpine | 3.21 | <=2.13.9-r1 | Not yet available |
| alpine/libxml2 | apk | alpine | 3.21 | <=2.9.10-r4 | Not yet available |
| alpine/libxml2 | apk | alpine | 3.21 | <=2.9.10-r5 | Not yet available |
| alpine/libxml2 | apk | alpine | 3.21 | <=2.9.11-r0 | Not yet available |
| alpine/libxml2 | apk | alpine | 3.21 | <=2.9.13-r0 | Not yet available |
| alpine/libxml2 | apk | alpine | 3.21 | <=2.9.14-r0 | Not yet available |
| alpine/libxml2 | apk | alpine | 3.21 | <=2.9.4-r1 | Not yet available |
| alpine/libxml2 | apk | alpine | 3.21 | <=2.9.4-r2 | Not yet available |
| alpine/libxml2 | apk | alpine | 3.21 | <=2.9.4-r4 | Not yet available |
| alpine/libxml2 | apk | alpine | 3.21 | <=2.9.8-r1 | Not yet available |
| alpine/libxml2 | apk | alpine | 3.21 | <=2.9.8-r3 | Not yet available |
| alpine/libxml2 | apk | alpine | 3.23 | <=2.13.9-r0 | Not yet available |
| alpine/libxml2 | apk | alpine | 3.22 | <=2.10.0-r0 | Not yet available |
| alpine/libxml2 | apk | alpine | 3.22 | <=2.10.3-r0 | Not yet available |
| alpine/libxml2 | apk | alpine | 3.22 | <=2.10.4-r0 | Not yet available |
| alpine/libxml2 | apk | alpine | 3.22 | <=2.12.5-r0 | Not yet available |
| alpine/libxml2 | apk | alpine | 3.22 | <=2.12.7-r0 | Not yet available |
| alpine/libxml2 | apk | alpine | 3.22 | <=2.13.6-r0 | Not yet available |
| alpine/libxml2 | apk | alpine | 3.22 | <=2.13.8-r0 | Not yet available |
| alpine/libxml2 | apk | alpine | 3.22 | <=2.13.9-r0 | Not yet available |
| alpine/libxml2 | apk | alpine | 3.22 | <=2.13.9-r1 | Not yet available |
| alpine/libxml2 | apk | alpine | 3.22 | <=2.9.10-r4 | Not yet available |
| alpine/libxml2 | apk | alpine | 3.22 | <=2.9.10-r5 | Not yet available |
| alpine/libxml2 | apk | alpine | 3.22 | <=2.9.11-r0 | Not yet available |
| alpine/libxml2 | apk | alpine | 3.22 | <=2.9.13-r0 | Not yet available |
| alpine/libxml2 | apk | alpine | 3.22 | <=2.9.14-r0 | Not yet available |
| alpine/libxml2 | apk | alpine | 3.22 | <=2.9.4-r1 | Not yet available |
| alpine/libxml2 | apk | alpine | 3.22 | <=2.9.4-r2 | Not yet available |
| alpine/libxml2 | apk | alpine | 3.22 | <=2.9.4-r4 | Not yet available |
| alpine/libxml2 | apk | alpine | 3.22 | <=2.9.8-r1 | Not yet available |
| alpine/libxml2 | apk | alpine | 3.22 | <=2.9.8-r3 | Not yet available |
| alpine/libxml2 | apk | alpine | edge | <=2.10.0-r0 | Not yet available |
| alpine/libxml2 | apk | alpine | edge | <=2.10.1-r0 | Not yet available |
| alpine/libxml2 | apk | alpine | edge | <=2.10.2-r0 | Not yet available |
| alpine/libxml2 | apk | alpine | edge | <=2.10.2-r1 | Not yet available |
| alpine/libxml2 | apk | alpine | edge | <=2.10.3-r0 | Not yet available |
| alpine/libxml2 | apk | alpine | edge | <=2.10.3-r1 | Not yet available |
| alpine/libxml2 | apk | alpine | edge | <=2.10.3-r2 | Not yet available |
| alpine/libxml2 | apk | alpine | edge | <=2.10.4-r0 | Not yet available |
| alpine/libxml2 | apk | alpine | edge | <=2.10.4-r1 | Not yet available |
| alpine/libxml2 | apk | alpine | edge | <=2.10.4-r2 | Not yet available |
| alpine/libxml2 | apk | alpine | edge | <=2.11.0-r0 | Not yet available |
| alpine/libxml2 | apk | alpine | edge | <=2.11.0-r1 | Not yet available |
| alpine/libxml2 | apk | alpine | edge | <=2.11.0-r2 | Not yet available |
| alpine/libxml2 | apk | alpine | edge | <=2.11.0-r3 | Not yet available |
| alpine/libxml2 | apk | alpine | edge | <=2.11.1-r0 | Not yet available |
| alpine/libxml2 | apk | alpine | edge | <=2.11.2-r0 | Not yet available |
| alpine/libxml2 | apk | alpine | edge | <=2.11.3-r0 | Not yet available |
| alpine/libxml2 | apk | alpine | edge | <=2.11.3-r1 | Not yet available |
| alpine/libxml2 | apk | alpine | edge | <=2.11.4-r0 | Not yet available |
| alpine/libxml2 | apk | alpine | edge | <=2.11.5-r0 | Not yet available |
| alpine/libxml2 | apk | alpine | edge | <=2.11.6-r0 | Not yet available |
| alpine/libxml2 | apk | alpine | edge | <=2.12.3-r0 | Not yet available |
| alpine/libxml2 | apk | alpine | edge | <=2.12.4-r0 | Not yet available |
| alpine/libxml2 | apk | alpine | edge | <=2.12.5-r0 | Not yet available |
| alpine/libxml2 | apk | alpine | edge | <=2.12.6-r0 | Not yet available |
| alpine/libxml2 | apk | alpine | edge | <=2.12.6-r2 | Not yet available |
| alpine/libxml2 | apk | alpine | edge | <=2.12.7-r0 | Not yet available |
| alpine/libxml2 | apk | alpine | edge | <=2.12.8-r0 | Not yet available |
| alpine/libxml2 | apk | alpine | edge | <=2.13.4-r0 | Not yet available |
| alpine/libxml2 | apk | alpine | edge | <=2.13.4-r1 | Not yet available |
| alpine/libxml2 | apk | alpine | edge | <=2.13.4-r2 | Not yet available |
| alpine/libxml2 | apk | alpine | edge | <=2.13.4-r3 | Not yet available |
| alpine/libxml2 | apk | alpine | edge | <=2.13.6-r0 | Not yet available |
| alpine/libxml2 | apk | alpine | edge | <=2.13.7-r0 | Not yet available |
| alpine/libxml2 | apk | alpine | edge | <=2.13.7-r1 | Not yet available |
| alpine/libxml2 | apk | alpine | edge | <=2.13.8-r0 | Not yet available |
| alpine/libxml2 | apk | alpine | edge | <=2.13.9-r0 | Not yet available |
| alpine/libxml2 | apk | alpine | edge | <=2.13.9-r1 | Not yet available |
| alpine/libxml2 | apk | alpine | edge | <=2.13.9-r2 | Not yet available |
| alpine/libxml2 | apk | alpine | edge | <=2.9.10-r4 | Not yet available |
| alpine/libxml2 | apk | alpine | edge | <=2.9.10-r5 | Not yet available |
| alpine/libxml2 | apk | alpine | edge | <=2.9.10-r7 | Not yet available |
| alpine/libxml2 | apk | alpine | edge | <=2.9.11-r0 | Not yet available |
| alpine/libxml2 | apk | alpine | edge | <=2.9.13-r0 | Not yet available |
| alpine/libxml2 | apk | alpine | edge | <=2.9.14-r0 | Not yet available |
| alpine/libxml2 | apk | alpine | edge | <=2.9.14-r1 | Not yet available |
| alpine/libxml2 | apk | alpine | edge | <=2.9.4-r1 | Not yet available |
| alpine/libxml2 | apk | alpine | edge | <=2.9.4-r2 | Not yet available |
| alpine/libxml2 | apk | alpine | edge | <=2.9.4-r4 | Not yet available |
| alpine/libxml2 | apk | alpine | edge | <=2.9.8-r1 | Not yet available |
| alpine/libxml2 | apk | alpine | edge | <=2.9.8-r3 | Not yet available |
Severity and metrics
No CVSS data available from this advisory.
NIST
CREATED
UPDATED
ADVISORY IDCVE-2026-0989
EXPLOITABILITY SCORE
2.2
EXPLOITS FOUND
COMMON WEAKNESS ENUMERATION (CWE)
CVSS SCORE
3.7lowDebian
CREATED
UPDATED
ADVISORY IDCVE-2026-0989
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-
Ubuntu
CREATED
UPDATED
ADVISORY IDCVE-2026-0989
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-
CVSS SCORE
N/AmediumAmazon
CREATED
UPDATED
ADVISORY IDALAS2-2026-3145
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-
CVSS SCORE
N/AlowAmazon
CREATED
UPDATED
ADVISORY IDALAS2023-2026-1397
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-
CVSS SCORE
N/AlowRed Hat
CREATED
UPDATED
ADVISORY IDCVE-2026-0989
EXPLOITABILITY SCORE
2.2
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)
CVSS SCORE
3.7lowPhoton
CREATED
UPDATED
ADVISORY ID
CVE-2026-0989
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-