CVE-2026-0992: libxml2: catalog loop DoS in ML platform images

This is a low-severity (CVSS 2.9) denial-of-service flaw in libxml2, where crafted XML catalogs with repeated <nextCatalog> entries pointing to the same downstream catalog force the parser to redundantly traverse catalog chains and burn CPU. The blast radius is wide because libxml2 is a base-image dependency: 695 downstream dependents are tracked, and Red Hat lists dozens of OpenShift AI (rhoai) operator and controller images, including KServe, KubeRay, MLflow, Model Registry and Notebook controllers, plus OpenShift CoreOS nodes. Exploitation likelihood is low: the attack vector is local with high complexity, there is no EPSS score, no public exploit, no Nuclei template, and it is not in CISA KEV. Treat it as routine patch hygiene: apply Red Hat errata RHSA-2026:7519 and rebuild or pull updated rhoai images in the normal maintenance cycle, prioritizing components that parse untrusted XML or catalogs.

No confirmed active exploitation of CVE-2026-0992 has been reported, but organizations should still patch proactively.

1) Apply Red Hat errata RHSA-2026:7519 and update to the patched libxml2 build; pull refreshed rhoai operator and component images and OpenShift CoreOS releases containing the fix. 2) Inventory container images and SBOMs for libxml2 to identify unpatched workloads. 3) Do not allow untrusted users or inputs to supply XML catalogs or set XML_CATALOG_FILES; restrict write access to catalog files. 4) Set CPU limits and requests on pods so a runaway parser cannot starve neighbours. 5) Alert on sustained high CPU in operator and controller pods and on repeated restarts. 6) Track the upstream issue (GNOME/libxml2 #1019) and Red Hat Bugzilla 2429975 for further fixes.

This vulnerability affects the following AI/ML architecture patterns: Model serving, MLOps platforms, Training pipelines, Notebook and workbench environments, Kubernetes operators and controllers, Container base images.

CVE-2026-0992 has a CVSS v3.1 base score of 2.9 (LOW).