libxml2-2.9.7-21.el8_10.8

The libxml2 library is a development toolbox providing the implementation of various XML standards.

Security Fix(es):

* libxml2: mingw-libxml2: libxml2: Denial of Service via crafted XML input due to use-after-free (CVE-2026-6653)

Bug Fix(es) and Enhancement(s):

* libxml2: CVE-2025-9714 fix (RHEL-119279) backported wrong upstream commit ? dyn:map recursion still crashes (JIRA:RHEL-249282)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

CVE-2025-9714
Uncontrolled recursion in XPath evaluation in libxml2 up to and including version 2.9.14 allows a local attacker to cause a stack overflow via crafted expressions. XPath processing functions `xmlXPathRunEval`, `xmlXPathCtxtCompile`, and `xmlXPathEvalExpr` were resetting recursion depth to zero before making potentially recursive calls. When such functions were called recursively this could allow for uncontrolled recursion and lead to a stack overflow. These functions now preserve recursion depth across recursive calls, allowing recursion depth to be controlled.
CVE-2026-6653
Use After Free in libxml2's xmlParseInternalSubset from GNOME libxml2 version 2.9.11 to 2.11.0 allows a remote attacker to cause a denial-of-service via maliciously crafted XML input with improper entity resolution handling.