CVE-2026-0990: 
NixOS vulnerability analysis and mitigation

CVE-2026-0990 is an uncontrolled recursion vulnerability in libxml2, an XML parsing library, affecting the xmlCatalogXMLResolveURI function. When an XML catalog contains a delegate URI entry that references itself, the function enters infinite recursion, exhausting the call stack and causing a segmentation fault, resulting in a Denial of Service (DoS). The vulnerability was published on January 15, 2026, and is classified as CWE-674 (Uncontrolled Recursion). It carries a CVSS v3.1 base score of 5.9 (Medium), assigned by Red Hat (Red Hat CVE, Red Hat Bugzilla). Affected platforms include libxml2 as shipped in Red Hat products, IBM AIX/VIOS, Microsoft Azure Linux 3 (libxml2 2.11.5-8/2.11.5-9), CBL-Mariner 2 (libxml2 2.10.4-10), and various Linux distributions (IBM Advisory, Microsoft MSRC).

The root cause is CWE-674 (Uncontrolled Recursion) in the xmlCatalogXMLResolveURI function of libxml2. When processing an XML catalog file, if a delegateURI entry references the same catalog (creating a cyclic reference), the function recursively resolves the same entry without detecting the cycle, leading to infinite recursion and eventual call stack exhaustion. Exploitation is network-based but configuration-dependent — the attacker must be able to supply or influence the XML catalog processed by the application (e.g., by providing a crafted catalog file). The issue was tracked upstream in the libxml2 GitLab issue tracker (Red Hat Bugzilla, libxml2 Issue).

Successful exploitation causes a segmentation fault in the affected application, resulting in a crash and Denial of Service. The impact is limited to availability — there is no confidentiality or integrity impact, as the vulnerability does not enable code execution or data disclosure. Applications that parse attacker-influenced XML catalogs (e.g., XML processing services, document converters, or any software using libxml2's catalog resolution) are at risk of being crashed remotely (Red Hat CVE, Red Hat Bugzilla).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-0990. The EPSS score is approximately 0.179%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires high attack complexity, as the attacker must control or influence the XML catalog file processed by the target application (Feedly).

1. Reconnaissance: Identify applications that use libxml2 for XML processing and rely on XML catalog resolution (e.g., XML validators, document processors, or services using xmlCatalogResolveURI).
2. Craft malicious XML catalog: Create an XML catalog file containing a delegateURI entry that references the catalog itself, establishing a cyclic reference:

<?xml version="1.0"?>
<!DOCTYPE catalog PUBLIC "-//OASIS//DTD XML Catalogs V1.1//EN"
  "http://www.oasis-open.org/committees/entity/release/1.1/catalog.dtd">
<catalog xmlns="urn:oasis:names:tc:entity:xmlns:xml:catalog">
  <delegateURI uriStartString="" catalog="file:///path/to/this/catalog.xml"/>
</catalog>

3. Deliver the catalog: Supply the crafted catalog to the target application through any available input vector (e.g., file upload, network share, or by placing it in a location the application reads catalogs from).
4. Trigger resolution: Cause the application to perform a URI resolution operation that invokes xmlCatalogXMLResolveURI, triggering the infinite recursion.
5. Achieve DoS: The application crashes with a segmentation fault due to call stack exhaustion, causing a Denial of Service (Red Hat Bugzilla, libxml2 Issue).

• Logs: Application crash logs or core dumps referencing xmlCatalogXMLResolveURI in the stack trace; segmentation fault signals (SIGSEGV) logged by the OS or application supervisor.
• Process: Unexpected termination of XML-processing applications or services; repeated process restarts by init systems (e.g., systemd reporting service failures).
• File System: Presence of unexpected or externally supplied XML catalog files (.xml files with delegateURI entries pointing to themselves) in directories read by the application.
• Network: Unusual delivery of XML catalog files via file upload endpoints or network shares to systems running libxml2-dependent services.

Red Hat has issued security advisory RHSA-2026:7519, providing updated libxml2 packages (version 2.15.2-0.3.hum1 for Red Hat Hardened Images) (Red Hat Errata). IBM has released fixes for AIX and VIOS (IBM Advisory). Microsoft has addressed the issue in Azure Linux 3 (libxml2 2.11.5-9) and CBL-Mariner 2 (Microsoft MSRC). Patches are also available for Mageia, Slackware, SUSE, Ubuntu, Debian, and Amazon Linux 2 via their respective security update channels. As a workaround where patching is not immediately possible, restrict the ability of untrusted users to supply or influence XML catalog files processed by the application.

The vulnerability received routine coverage across Linux distribution security channels, with advisories issued by Red Hat, IBM, Microsoft, Mageia, SUSE, Slackware, Ubuntu, Debian, and Amazon Linux. A blog post titled "Critical libxml2 Vulnerability Alert" was published shortly after disclosure, though the vulnerability's medium severity and limited exploitability kept broader community reaction subdued. No notable researcher commentary or significant social media discussion beyond standard vulnerability tracking has been observed.