CVE-2026-0992: 
NixOS vulnerability analysis and mitigation

CVE-2026-0992 is an uncontrolled resource consumption (DoS) vulnerability in the libxml2 library affecting its XML catalog processing logic. The flaw occurs when parsing XML catalogs containing repeated <nextCatalog> elements that point to the same downstream catalog, causing the parser to redundantly traverse catalog chains and consume excessive CPU. It was published on January 15, 2026, by Red Hat, and affects libxml2 across multiple platforms including Red Hat Enterprise Linux, IBM AIX, Microsoft Azure Linux (azl3/cbl2 packages), Mageia, Slackware, Debian, and others. The CNA-assigned CVSS v3.1 base score is 2.9 (Low) (Red Hat CVE, Red Hat Bugzilla).

The root cause is classified as CWE-400 (Uncontrolled Resource Consumption). During entity resolution, libxml2's catalog-processing code fails to detect or limit repeated traversal of catalog chains when multiple <nextCatalog> entries reference the same downstream catalog file. This causes processing time to grow exponentially with chain depth, as the parser revisits the same catalog nodes redundantly. The attack vector is local (AV:L) with high attack complexity (AC:H), meaning an attacker must be able to supply a crafted XML catalog file to an application that uses libxml2 for catalog-based entity resolution. The upstream issue is tracked at the GNOME GitLab repository (Red Hat Bugzilla, GNOME GitLab).

Successful exploitation results in excessive CPU consumption on the affected host, degrading or denying availability of any application that processes attacker-controlled XML catalogs via libxml2. There is no confidentiality or integrity impact — the vulnerability is purely a denial-of-service condition. The scope is unchanged, meaning the impact is confined to the vulnerable component and does not enable lateral movement or data exfiltration (Red Hat CVE, Red Hat Bugzilla).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-0992. The EPSS score is approximately 0.051% (0.000510), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The high attack complexity and local attack vector further limit practical exploitability (Feedly).

Red Hat has issued a security advisory (RHSA-2026:7519) providing updated libxml2 packages (version 2.15.2-0.3.hum1) for Red Hat Hardened Images (Red Hat Errata). IBM has published a security bulletin addressing the vulnerability in AIX and VIOS (IBM Advisory). Microsoft has addressed affected Azure Linux packages (azl3_libxml2 ≥ 2.11.5-9, cbl2_libxml2 ≥ 2.10.4-10) (Microsoft MSRC). Additional distribution patches are available for Mageia, Slackware, Debian, SUSE, Amazon Linux 2, and Ubuntu. The primary remediation is to update libxml2 to the patched version provided by your distribution. As a workaround, applications should avoid processing untrusted or externally supplied XML catalog files.

Coverage of CVE-2026-0992 has been limited to routine security advisory aggregation across Linux distribution security channels (Mageia, Slackware, SUSE, Debian, Amazon Linux, Ubuntu) and vulnerability tracking platforms. No notable researcher commentary, vendor statements beyond patch advisories, or significant social media discussion has been identified for this low-severity vulnerability.