CVE-2026-86144

libxml2 before 2.15.4 fails to propagate parser flags in the xmlXIncludeProcess and xmlXIncludeProcessTree functions, so options such as XML_PARSE_NONET are not applied during XInclude processing. An application that relies on that flag to block network access, while using a custom resource loader that can reach the internet, can be tricked into fetching attacker-controlled external entities or remote resources. This enables XML external entity (XXE) injection, server-side request forgery (SSRF), and denial of service via deliberately slow attacker-controlled internet resources, with high impact to confidentiality, integrity, and availability (CVSS 3.1: 7.8). Any product that embeds a vulnerable libxml2 and calls the affected XInclude functions is affected, with the xmlsoft project as the maintaining vendor. No public proof-of-concept or confirmed in-the-wild exploitation is known, EPSS is low (0.2% in 30 days), and the issue is not listed in the CISA KEV catalog.

What to do: Upgrade libxml2 to 2.15.4 or later, or apply your Linux distribution's backported security patch. Developers whose code calls xmlXIncludeProcess or xmlXIncludeProcessTree should audit whether they rely on XML_PARSE_NONET for network isolation, and mitigate by restricting or hardening custom resource loaders, disabling XInclude on untrusted XML input, and enforcing egress filtering. Remember that bundled or vendored copies of libxml2 inside language bindings and third-party software may need separate updates from the OS package.