Red Hat Ships Important libxml2 Update Fixing Eight Flaws Across Enterprise Linux 9 4 SAP Systems
Red Hat has published security advisory RHSA-2026:89750, an Important-rated update for the libxml2 XML parsing library used across Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions and related extended-support channels. The advisory bundles fixes for eight separate CVEs: CVE-2026-6653, CVE-2026-11979, CVE-2026-74860, CVE-2026-86138, CVE-2026-86140, CVE-2026-86142, CVE-2026-86143 and CVE-2026-86144. The affected product set is unusually broad for a single errata and covers Red Hat Enterprise Linux Server AUS 9.4 on x86_64, RHEL for x86_64 and Power LE under Update Services for SAP Solutions 9.4, RHEL for ARM 64 and IBM Z under the four-years-of-updates stream, and the Extended Life Cycle variants for x86_64, ARM 64, ppc64le and s390x. The fixed package set is libxml2-2.9.13-13.el9_4.10, including the libxml2, libxml2-devel and python3-libxml2 subpackages. Because libxml2 is a shared dependency rather than an application in its own right, any service on these hosts that parses XML, including SAP-adjacent middleware, web servers and Python tooling, inherits the exposure.
Red Hat has not published exploitation details or proof-of-concept material for any of the eight issues, so the mechanics below are limited to what the advisory and the linked Bugzilla entries actually describe. Five of the flaws are memory-safety defects reachable through parser input. CVE-2026-6653 is a use-after-free that a crafted XML document can trigger to cause a denial of service, while CVE-2026-86138 is a heap-based buffer overflow and CVE-2026-86140 a stack-based buffer overflow in xmlSnprintfElements, both described as capable of leading to arbitrary code execution. CVE-2026-86142 is a further heap overflow in xmlXPtrEval arising from length saturation when handling xpointer expressions, and CVE-2026-11979 is a buffer overflow in the bundled xmlcatalog command-line utility that can likewise end in arbitrary code execution. The remaining three are of a different character: CVE-2026-86143 is an integer overflow in write callbacks that can corrupt output and produce data integrity problems, CVE-2026-86144 stems from improper parseFlags propagation and can result in information disclosure, server-side request forgery or denial of service, and CVE-2026-74860 is a double-free and use-after-free condition in the libxml2 Python bindings. In each case the trigger is parser input, meaning the practical attack surface is wherever an application on the host accepts XML it did not author.
The strategic weight here comes from where these systems sit rather than from the sophistication of the bugs. The listed channels are AUS, E4S and Extended Life Cycle streams, which exist precisely because the workloads running on them, typically SAP estates, cannot be rebased on a newer minor release at short notice. Those hosts frequently sit deep inside production, process XML-formatted business documents and interchange payloads, and are patched on long, change-controlled cycles. The SSRF and information-disclosure potential in CVE-2026-86144 is notable in that context, since a parser that can be coaxed into fetching remote resources on a segmented SAP network is a useful pivot, and the integrity flaw in CVE-2026-86143 is the kind of defect that corrupts records quietly rather than announcing itself. On current exploitation status, none of the eight CVEs carries evidence of in-the-wild use: FIRST EPSS places CVE-2026-74860 at a 0.5 percent probability of exploitation in the next 30 days, CVE-2026-6653 at 0.4 percent, CVE-2026-11979, CVE-2026-86140, CVE-2026-86142, CVE-2026-86143 and CVE-2026-86144 at 0.2 percent each, and CVE-2026-86138 at 0.1 percent. Red Hat rates the aggregate update Important and has made fixed packages available for every affected architecture, with per-CVE CVSS base scores published on the individual CVE pages rather than in the errata itself.
Attack Surface
Server OS, Web Application, Supply Chain (Third-party vendors)
Tactics
Initial Access, Execution, Impact
Techniques
- T1190 – Exploit Public-Facing Application
- T1203 – Exploitation for Client Execution
- T1499 – Endpoint Denial of Service
- T1059 – Command and Scripting Interpreter
SuperPRO's Threat Countermeasures Procedures
- Install libxml2-2.9.13-13.el9_4.10 (and the matching libxml2-devel and python3-libxml2 subpackages) on all RHEL 9.4 AUS, Update Services for SAP Solutions and Extended Life Cycle hosts, then confirm with rpm -q libxml2 python3-libxml2 that the installed release is 13.el9_4.10 or later.
- Scope the estate against the exact channels named in RHSA-2026:89750 before patching: RHEL Server AUS 9.4 x86_64, RHEL for x86_64 and Power LE E4S 9.4, RHEL for ARM 64 and IBM z Systems 9.4 four-year streams, and the Extended Life Cycle variants for x86_64, aarch64, ppc64le and s390x. Entitlement to the correct AUS/E4S/ELS repository is required, per Red Hat article 11258.
- After the RPM transaction, identify and restart every running process still mapping the old libxml2.so.2 image using needs-restarting -r or lsof +c 0 | grep libxml2, since long-lived SAP middleware, httpd and Python daemons will otherwise keep the vulnerable library resident in memory.
- Restrict invocation of the xmlcatalog utility to trusted catalog files and remove it from any automated or network-fed job pipeline until patched hosts are confirmed, as CVE-2026-11979 is a buffer overflow in that specific binary leading to arbitrary code execution.
- In applications linking libxml2, disable network-based entity and resource loading by passing XML_PARSE_NONET and avoiding XML_PARSE_NOENT / DTD loading flags, which limits the server-side request forgery and information-disclosure path described for CVE-2026-86144 (improper parseFlags propagation).
- Audit container images and application bundles that ship their own copy of libxml2 2.9.13 rather than consuming the host RPM, using commands such as podman run –rm <image> rpm -q libxml2, and rebuild those images against the patched 13.el9_4.10 package.
- Enable alerting on repeated SIGSEGV or abort crashes from XML-handling processes (httpd workers, python3 processes importing libxml2, SAP interface jobs) via systemd-coredump or auditd, as the use-after-free and overflow defects in CVE-2026-6653, CVE-2026-86138, CVE-2026-86140 and CVE-2026-86142 typically surface first as parser crash loops.
