Critical Double-Free Vulnerability in libxml2 Affects Python Applications
Summary
DEBIAN-CVE-2026-74860: A flaw was found in libxml2 with Python bindings enabled. Affects libxml2 versions 2.12.3+dfsg-0exp1 – 2.9.14+dfsg-1.3~deb12u6. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libxml2 is a widely used XML parsing library that provides support for various programming languages, including Python. It is known for its efficiency and flexibility in handling XML documents. However, with the Python bindings enabled, libxml2 is susceptible to a critical vulnerability that can lead to application crashes and denial of service (DoS) attacks.
Vulnerability Detail
A flaw was identified in libxml2 when Python bindings are enabled, where a remote attacker can exploit this vulnerability by supplying a specially crafted XML document containing a Document Type Definition (DTD) with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callback handler, resulting in a string being freed twice. The consequences of this flaw include a reproducible crash in Python applications utilizing the libxml2 SAX bindings, leading to potential denial of service.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid processing untrusted XML documents that may contain DTDs with enumerated attribute values until the package is updated. This can help mitigate the risk of exploitation.
Conclusion
The identified vulnerability in libxml2 poses a significant risk to Python applications, leading to potential crashes and denial of service. It is crucial to update to the patched version to mitigate these risks and ensure the security of your applications.
See every vulnerability recorded for libxml2 →
FAQ
The CVSS score of this vulnerability is 8.5, indicating a high severity level.
All versions of libxml2 with Python bindings enabled are affected, particularly those in Debian 12, 13, and 14 prior to the fixed version.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The potential impacts include application crashes and denial of service (DoS) attacks, which can disrupt service availability.
Yes, Vulert provides a service that monitors and alerts in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for libxml2.
