ALAS2027-2026-176

References: CVE-2026-86144  CVE-2026-86142  CVE-2026-86143  CVE-2026-11979  CVE-2026-86140  CVE-2026-86138  CVE-2026-86137  CVE-2026-74860 
FAQs regarding Amazon Linux ALAS/CVE Severity

Issue Overview:

Package updates are available for Amazon Linux 2027 that fix the following vulnerabilities:
CVE-2026-86144:
In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, the XML_PARSE_NONET flag, if (without it) a custom resource loader accesses the internet and triggers XML external entity injection, SSRF, or a denial of service (e.g., for an attacker-controlled internet resource that is intentionally slow).

CVE-2026-86143:
In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks, aka a lack of a check for integer overflow before calling writecallback. This has security relevance for many types of uses of that length value within a callback.

CVE-2026-86142:
In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation.

CVE-2026-86140:
In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-based buffer overflow.

CVE-2026-86138:
In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based buffer overflow.

CVE-2026-86137:
In libxml2 before 2.15.4, xmlFAParsePosCharGroup has an out-of-bounds read, aka an out-of-bounds read in the NXT macro in xmlregexp.

CVE-2026-74860:
A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition (DTD) with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callback handler, where a string is freed twice. This flaw can lead to a denial of service (DoS) due to a reproducible crash in Python applications using the libxml2 SAX bindings.

CVE-2026-11979:
libxml2 is vulnerable to multiple stack-based buffer overflows in the xmlcatalog utility when running in --shell mode. The usershell() function processes user input using fixed-size stack buffers without proper bounds checking.
By supplying an overly long input line, an attacker can overflow internal buffers (command, arg, and argv) during input parsing. This results in memory corruption within the stack frame.
Successful exploitation may cause a crash or potentially allow arbitrary code execution in the context of the xmlcatalog process.

This issue has been fixed in the commit c2e233fc.

NOTE:
The maintainers of this project did not agree that this issue is a vulnerability and considered it a bug.

Issue Correction:
Run dnf update libxml2 or dnf update --advisory ALAS2027-2026-176 to update your system.

New Packages:

aarch64:
    python3-libxml2-debuginfo-2.12.10-5.amzn2027.0.1.aarch64
    libxml2-static-2.12.10-5.amzn2027.0.1.aarch64
    libxml2-debugsource-2.12.10-5.amzn2027.0.1.aarch64
    libxml2-debuginfo-2.12.10-5.amzn2027.0.1.aarch64
    python3-libxml2-2.12.10-5.amzn2027.0.1.aarch64
    libxml2-2.12.10-5.amzn2027.0.1.aarch64
    libxml2-devel-2.12.10-5.amzn2027.0.1.aarch64

src:
    libxml2-2.12.10-5.amzn2027.0.1.src

x86_64:
    libxml2-static-2.12.10-5.amzn2027.0.1.x86_64
    libxml2-debuginfo-2.12.10-5.amzn2027.0.1.x86_64
    libxml2-debugsource-2.12.10-5.amzn2027.0.1.x86_64
    libxml2-2.12.10-5.amzn2027.0.1.x86_64
    python3-libxml2-debuginfo-2.12.10-5.amzn2027.0.1.x86_64
    python3-libxml2-2.12.10-5.amzn2027.0.1.x86_64
    libxml2-devel-2.12.10-5.amzn2027.0.1.x86_64