CVE-2026-0989: 
NixOS vulnerability analysis and mitigation

CVE-2026-0989 is a denial-of-service vulnerability in the RelaxNG parser of libxml2, caused by unbounded recursion when resolving nested <include> directives in external schema files. Disclosed on January 15, 2026, and assigned by Red Hat, the flaw affects libxml2 (xmlsoft) and downstream consumers including IBM AIX and VIOS. It carries a CVSS v3.1 base score of 3.7 (Low), reflecting network-reachable but high-complexity exploitation with limited availability impact (Red Hat CVE, Red Hat Bugzilla).

The root cause is CWE-674 (Uncontrolled Recursion): the RelaxNG parser in libxml2 does not enforce any depth limit when resolving nested <include> directives in schema files. An attacker who can supply a specially crafted or deeply nested RelaxNG schema to an application that parses it can trigger unbounded recursive function calls, ultimately exhausting the process stack and causing a crash. Exploitation requires attacker-controlled schema input — the parser must be directed to process the malicious schema, which is a meaningful precondition. The upstream issue is tracked at the GNOME GitLab repository (Red Hat Bugzilla, Red Hat CVE).

Successful exploitation results in a stack overflow and application crash, causing a denial of service. There is no confidentiality or integrity impact — the vulnerability is limited to availability. Applications and services that parse untrusted RelaxNG schemas using libxml2 (including those on IBM AIX, VIOS, and Linux distributions shipping libxml2) are at risk of process termination, which could disrupt dependent services (Red Hat Bugzilla, IBM Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-0989. The EPSS score is approximately 0.045%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires high attack complexity, as the attacker must control the schema input processed by a vulnerable application (Red Hat CVE).

Red Hat has issued a security advisory (RHSA-2026:7519) providing updated libxml2 packages, including version libxml2-2.15.2-0.3.hum1 for Red Hat Hardened Images (Red Hat Errata). IBM has published a security bulletin addressing the impact on AIX and VIOS (IBM Advisory). Patches have also been released for Ubuntu, Debian (DLA-4622-1), Mageia, SUSE, Amazon Linux 2 (ALAS2-2026-3145), and Slackware. As a workaround where patching is not immediately possible, avoid processing untrusted or externally supplied RelaxNG schemas with libxml2-based applications.

Coverage has been primarily limited to Linux distribution security advisories and vulnerability aggregators. No notable researcher commentary or significant social media discussion has been identified beyond routine patch announcements across Ubuntu, Debian, SUSE, Mageia, and Slackware channels.