CVE-2026-0989: libxml2: unbounded RelaxNG include depth enables DoS

LOW

Published January 15, 2026

CISO Take

CVE-2026-0989 is a stack-exhaustion flaw in libxml2's RelaxNG parser: nested <include> directives are resolved with no depth limit, so a crafted schema can crash the process that parses it. It is rated low (CVSS 3.7, high attack complexity, availability impact only). It is not in CISA KEV, has no public exploit or Nuclei template, and has no EPSS score or SSVC decision. The AI relevance comes from reach rather than severity. libxml2 is bundled in dozens of Red Hat OpenShift AI (rhoai/odh-*) container images, including KServe controllers, MLflow, the model registry, the notebook controllers, and the Ray and training operators, and the package has 695 dependents. A crash would hit availability of ML platform components, and only where they parse untrusted RelaxNG schemas. Treat this as routine patch hygiene: apply Red Hat advisory RHSA-2026:7519 and the upstream libxml2 fix on the normal patch cycle, and prioritize any service that parses externally supplied XML schemas.

Sources:NVDRed Hat Security Advisory (access.redhat.com)Red Hat BugzillaGNOME libxml2 GitLabOpenSSFATLAS

What is the risk?

Low overall. The CVSS vector (AV:N/AC:H/PR:N/UI:N/A:L) shows a network-reachable flaw that is hard to exploit and affects only availability. Exploitation needs the target to parse an attacker-controlled RelaxNG schema, which most ML components never do. There is no KEV listing, public exploit, scanner template or EPSS score, so near-term exploitation likelihood looks minimal. The package risk score of 81/100, the OpenSSF Scorecard of 5.4/10 and 137 other CVEs in the same package point to a weak overall security posture for libxml2, and 695 dependents give wide exposure. Impact is limited to a crash of the parsing process, with no confidentiality or integrity loss.

How does the attack unfold?

Initial Access

The attacker finds an AI platform component that accepts or fetches external RelaxNG schemas for XML validation.

AML.T0049

Exploitation

The attacker supplies a schema with deeply nested <include> directives, which libxml2 resolves recursively without a depth limit.

Impact

Stack exhaustion crashes the parsing process, interrupting the ML service or pipeline that depends on it.

AML.T0029

Initial Access

The attacker finds an AI platform component that accepts or fetches external RelaxNG schemas for XML validation.

AML.T0049

Exploitation

The attacker supplies a schema with deeply nested <include> directives, which libxml2 resolves recursively without a depth limit.

Impact

Stack exhaustion crashes the parsing process, interrupting the ML service or pipeline that depends on it.

AML.T0029

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
MLflow	pip	—	No patch
28.6KOpenSSF 5.4695 dependentsPushed 5d ago15% patched~68d to patchFull package profile →
MLflow	pip	—	No patch
28.6KOpenSSF 5.4695 dependentsPushed 5d ago15% patched~68d to patchFull package profile →
MLflow	pip	—	No patch
28.6KOpenSSF 5.4695 dependentsPushed 5d ago15% patched~68d to patchFull package profile →
libxml2	—	—	No patch
libxml2-main	—	—	No patch
openshift/ose-rhel-coreos-8	—	—	No patch
openshift/ose-rhel-coreos-9	—	—	No patch
rhoai/odh-ai-gateway-operator-rhel9	—	—	No patch
rhoai/odh-core-bff-rhel9	—	—	No patch
rhoai/odh-dashboard-operator-rhel9	—	—	No patch
rhoai/odh-dashboard-rhel9	—	—	No patch
rhoai/odh-data-science-pipelines-operator-controller-rhel9	—	—	No patch
rhoai/odh-kf-notebook-controller-rhel9	—	—	No patch
rhoai/odh-kserve-controller-rhel9	—	—	No patch
rhoai/odh-kserve-llmisvc-controller-rhel9	—	—	No patch
rhoai/odh-kserve-module-operator-rhel9	—	—	No patch
rhoai/odh-kube-rbac-proxy-rhel9	—	—	No patch
rhoai/odh-kuberay-operator-controller-rhel9	—	—	No patch
rhoai/odh-llama-stack-k8s-operator-rhel9	—	—	No patch
rhoai/odh-maas-controller-rhel9	—	—	No patch
rhoai/odh-mod-arch-agent-ops-rhel9	—	—	No patch
rhoai/odh-mod-arch-automl-rhel9	—	—	No patch
rhoai/odh-mod-arch-autorag-rhel9	—	—	No patch
rhoai/odh-mod-arch-eval-hub-rhel9	—	—	No patch
rhoai/odh-mod-arch-gen-ai-rhel9	—	—	No patch
rhoai/odh-mod-arch-maas-rhel9	—	—	No patch
rhoai/odh-mod-arch-model-registry-rhel9	—	—	No patch
rhoai/odh-model-controller-rhel9	—	—	No patch
rhoai/odh-model-registry-operator-rhel9	—	—	No patch
rhoai/odh-model-serving-api-rhel9	—	—	No patch
rhoai/odh-notebook-controller-rhel9	—	—	No patch
rhoai/odh-ogx-k8s-operator-rhel9	—	—	No patch
rhoai/odh-ogx-module-operator-rhel9	—	—	No patch
rhoai/odh-training-operator-rhel9	—	—	No patch
rhoai/odh-trustyai-service-operator-rhel9	—	—	No patch
rhoai/odh-workbenches-operator-rhel9	—	—	No patch

How severe is it?

CVSS 3.1

3.7 / 10

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVNetwork

ACHigh

PRNone

UINone

SUnchanged

CNone

INone

ALow

What should I do?

1 step

1) Apply Red Hat advisory RHSA-2026:7519 and update the affected rhoai/* and openshift/ose-rhel-coreos images to the patched builds. Upgrade libxml2 to the upstream release that fixes GNOME/libxml2 issue 998 for self-built images. 2) Use SBOM or image scanning to find every container bundling libxml2, including transitive Python (lxml) and Go (cgo) users. 3) Where patching is delayed, do not accept or parse untrusted RelaxNG schemas, and validate or size-limit schema inputs at the boundary. 4) Set container memory and stack limits and liveness probes so crashes recover automatically. 5) Detection: alert on repeated crash loops or segfaults in components that parse XML, and on unusually deeply nested or large schema uploads.

How is it classified?

DoSFrameworkInferenceAML.T0029- Denial of AI Service AML.T0049- Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Procedures to respond to and recover from previously unknown risks

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-0989?

Is CVE-2026-0989 actively exploited?

No confirmed active exploitation of CVE-2026-0989 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-0989?

1) Apply Red Hat advisory RHSA-2026:7519 and update the affected rhoai/* and openshift/ose-rhel-coreos images to the patched builds. Upgrade libxml2 to the upstream release that fixes GNOME/libxml2 issue 998 for self-built images. 2) Use SBOM or image scanning to find every container bundling libxml2, including transitive Python (lxml) and Go (cgo) users. 3) Where patching is delayed, do not accept or parse untrusted RelaxNG schemas, and validate or size-limit schema inputs at the boundary. 4) Set container memory and stack limits and liveness probes so crashes recover automatically. 5) Detection: alert on repeated crash loops or segfaults in components that parse XML, and on unusually deeply nested or large schema uploads.

What systems are affected by CVE-2026-0989?

This vulnerability affects the following AI/ML architecture patterns: model serving, MLOps platforms, training pipelines, notebook and workbench environments, data ingestion pipelines, Kubernetes-based AI platforms.

What is the CVSS score for CVE-2026-0989?

CVE-2026-0989 has a CVSS v3.1 base score of 3.7 (LOW).

What is the AI security impact?

Affected AI Architectures

model servingMLOps platformstraining pipelinesnotebook and workbench environmentsdata ingestion pipelinesKubernetes-based AI platforms

MITRE ATLAS Techniques

AML.T0029Denial of AI Service

AML.T0049Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

A flaw was identified in the RelaxNG parser of libxml2 related to how external schema inclusions are handled. The parser does not enforce a limit on inclusion depth when resolving nested <include> directives. Specially crafted or overly complex schemas can cause excessive recursion during parsing. This may lead to stack exhaustion and application crashes, creating a denial-of-service risk.

Exploitation Scenario

An attacker who can submit XML schemas to an ML platform component that validates documents, such as a data ingestion pipeline, a model registry import or a custom validation step, uploads a RelaxNG schema with deeply nested <include> directives. The parser recurses until the stack is exhausted and the process crashes. By resubmitting the schema, the attacker can keep the component in a crash loop and degrade the availability of the pipeline or serving workflow that depends on it. Success depends on a reachable schema-parsing path and some level of access to supply the schema.

Weaknesses (CWE)

CWE-674Uncontrolled Recursion

CWE-674 — Uncontrolled Recursion: The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

[Implementation] Ensure that an end condition will be reached under all logic conditions. The end condition may include checking against the depth of recursion and exiting with an error if the recursion goes too deep. The complexity of the end condition contributes to the effectiveness of this action.
[Implementation] Increase the stack size.

Source: MITRE CWE corpus.