CVE-2026-6653 is a critical (CVSS 9.8) use after free in libxml2's xmlParseInternalSubset, affecting versions 2.9.11 to 2.11.0. Crafted XML with improper entity handling can crash a parser. Use a libxml2 release newer than 2.11.0 or a distribution package that carries the fix, and rebuild images that bundle it.
What's affected
- Product: GNOME libxml2, the XML parsing library used by a very large number of programs and language bindings.
- Affected versions: 2.9.11 to 2.11.0, per the record.
- Fix: the Ubuntu bug lists libxml2 as Fix Released, and a comment on it says the problem was fixed upstream during the 2.11.0 release cycle by a rework of entity amplification checks. The range in the record ends at 2.11.0, so confirm with your distribution's tracker which exact build you need.
- Weaknesses: CWE-416 use after free and CWE-611 improper restriction of XML external entity reference.
- Severity: CVSS 3.1 9.8. The record describes the stated impact as denial of service through crafted XML input.
How to check if you're exposed
Check the library version on the system and the packages that provide it:
xmllint --version
dpkg -l | grep -E 'libxml2'
rpm -q libxml2
Distributions backport fixes without raising the upstream number, so a 2.9.14 package can include the fix. Compare the package version with your distribution's security tracker for CVE-2026-6653.
Many programs carry their own copy. Python's lxml wheels, some Ruby gems, Node native modules and container images may bundle libxml2. A dependency scan of the image or lock file is the reliable way to find these.
What to do now
- List hosts and images with libxml2, and the version of each.
- Install the distribution update that lists CVE-2026-6653 as fixed.
- For bundled copies, upgrade the package that ships libxml2 (for example lxml) to a build with a newer libxml2.
- Rebuild and redeploy container images.
- Restart services that parse XML so they load the new library.
- Where you can, limit the size and entity expansion of XML from untrusted sources.
Why it matters
A use after free means a program keeps using memory after it has been released. If the memory is reused for something else, the program can read or write data it should not. Here the trouble sits in the code that handles parameter entity references inside a document type declaration. The Ubuntu bug report describes a bug introduced by a patch for an older CVE (CVE-2021-3541) and notes that it does not exist in the latest development version.
The record says the realistic result is a denial of service. Memory errors can sometimes be worse, so the 9.8 score assumes the worst case. The CISA KEV flag is false and no exploitation is reported. The practical lesson is about reach: libxml2 sits underneath so many tools that a single version check on the host is not enough.
Try it yourself
This walkthrough shows how an inventory of your dependencies finds a library like libxml2 where it is bundled, not only where it is installed.
Click through it at your own pace, or open it full screen.
Quick check
Is 2.11.0 safe or affected?
The record's range ends at 2.11.0, while a comment on the Ubuntu bug says the fix landed during the 2.11.0 release. Confirm with your distribution before relying on either.
Why would a bundled copy matter?
Programs such as Python lxml can ship their own libxml2, so updating the system package does not touch them.
Sources
Last reviewed: 19 October 2026.
