Bug 2429933 (CVE-2026-0989)

Summary:	CVE-2026-0989 libxml2: Unbounded RelaxNG Include Recursion Leading to Stack Overflow
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	adudiak, caswilli, crizzo, csutherl, gtanzill, jbuscemi, jclere, jmitchel, kaycoth, kshier, pbohmill, pjindal, plodge, stcannon, szappis, teagle, vchlup, yguenane
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was identified in the RelaxNG parser of libxml2 related to how external schema inclusions are handled. The parser does not enforce a limit on inclusion depth when resolving nested <include> directives. Specially crafted or overly complex schemas can cause excessive recursion during parsing. This may lead to stack exhaustion and application crashes, creating a denial-of-service risk.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2429936, 2429937, 2429938, 2429939, 2429940, 2429941, 2429942, 2429943, 2429944, 2429945, 2429946, 2429947
Bug Blocks:

Description OSIDB Bzimport 2026-01-15 12:53:01 UTC

Uncontrolled recursion vulnerability in the RelaxNG include handling logic of the libxml2 XML parsing library. The issue arises from the absence of limits on recursive <include> directive resolution. When a deeply nested chain of included RelaxNG schema files is processed, the parser enters unbounded recursion, eventually exhausting the system call stack. This results in a stack overflow and application crash. Exploitation requires attacker-controlled schema input and primarily impacts availability by causing a denial of service.