THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-86144 (MEDIUM 5.6) — In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, the XML_PARSE_NONET flag, if (without it) a custom resource loader accesses the internet and triggers XML external entity

[NVD] CVE-2026-86144 (MEDIUM 5.6) — In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, the XML_PARSE_NONET flag, if (without it) a custom resource loader accesses the internet and triggers XML external entity

mednvdPublished 2026-09-05

CVE-2026-86144 CVSS: 5.6 MEDIUM Published: 2026-09-05T05:17:13.407

In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, the XML_PARSE_NONET flag, if (without it) a custom resource loader accesses the internet and triggers XML external entity injection, SSRF, or a denial of service (e.g., for

Indicators of compromise

CVE-2026-86144cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-86144