CVE-2026-6653 and the long tail of entity-handling bugs in libxml2

When the Ubuntu report for this defect was filed, the reporter noted that the bug is similar to a much older vulnerability, and the issue title links it to the patch lineage of CVE-2021-3541. That parallel explains why this class of defect keeps resurfacing in the same parser routine.

Why the comparison holds

CVE-2021-3541 was an entity-handling problem in libxml2 that led to a fix in the parser's declaration logic. CVE-2026-6653 is a use-after-free in xmlParseInternalSubset, recorded with CWE-416 and CWE-611, and the CNA maps its impact class to CAPEC-242 code injection.

The common element is not the symptom but the location. Both defects sit where the parser reconciles entity declarations with the content that references them. That code has to retain object identity across recursive expansion and across partially processed error states, and each hardening change alters which object is freed when.

What changed in the record this time

This defect was found by fuzzing a shipping package, libxml2 2.9.14+dfsg-1.3ubuntu3.7 on Ubuntu 24.04.3 LTS, with a 1915-byte document that declares chained entities. The reporter confirmed the bug is absent from the latest development version, which is why the fix is expressed as 2.11.0 or later rather than a narrow backport identifier.

The affected range is recorded as 2.9.11 before 2.11.0, with everything else unaffected by default. Severity is split: 7.0 under CVSS 4.0 from the CNA with high attack complexity and proof-of-concept maturity, and 9.8 under NVD's CVSS 3.1 analysis. CISA's SSVC points record exploitation as none and automatable as no.

The maintenance lesson

Entity handling is a recurring fault line, so the durable control is to constrain it. Deployments that do not require external entity resolution should disable it, and every deployment should be able to say which libxml2 version its parser actually loads.

CERT-Bund's product references, which include Red Hat Enterprise Linux, Rocky Linux, Oracle Linux, Amazon Linux 2, IBM Security Verify Access and IBM Power HMC, show how far a single upstream routine propagates. The fix travels through many release processes.

Sizing the surface

The verified ZoomEye product query banner="libxml2" returned 341 matching assets on 2026-10-27. The figure counts fingerprinted assets rather than confirmed vulnerable installations and should be quoted that way.

Search dork: banner="libxml2"

ZoomEye search link: https://www.zoomeye.ai/searchResult?q=YmFubmVyPSJsaWJ4bWwyIg%3D%3D