CVE-2026-74860: libxml2: DTD double-free crashes Python SAX apps

HIGH

Published September 8, 2026

CISO Take

CVE-2026-74860 is a double-free in libxml2's Python SAX bindings. A crafted XML document with a DTD containing enumerated attribute values causes a string to be freed twice in the attributeDecl callback. The documented impact is a reproducible crash (denial of service), although the CVSS 8.5 score with a changed scope and high confidentiality and integrity impact is higher than the description supports. This is a general-purpose parsing library rather than an AI-specific flaw. It matters to AI teams because Red Hat lists it in OpenShift AI (RHOAI) KServe controllers, model-serving API images and the rhai base images for CUDA, ROCm, TPU, Gaudi and Neuron. There is no CISA KEV listing, no public exploit, no Nuclei template and no EPSS data, so the likelihood of exploitation looks low today. Exploitation also needs high complexity and low privileges. Apply the Red Hat errata (RHSA-2026:64463, 71585, 71586, 71641, 72470, 72475, 72476, 79357, 82939, 89750), rebuild affected images, and prioritize services that parse untrusted XML through the libxml2 Python SAX bindings.

Sources:NVDRed Hat Security Advisories (access.redhat.com)ATLAS

What is the risk?

Moderate overall risk, with a high CVSS base score (8.5) driven by a scope-changed vector. The confirmed impact is availability loss from a process crash. A double-free is a memory-corruption primitive, so the stated C:H/I:H ratings cannot be dismissed outright, but no code execution or data disclosure has been described. Exploitation likelihood is low: attack complexity is high, low privileges are required, no public exploit or scanner template exists, the CVE is not in KEV, and EPSS is not available. Exposure is limited to services that feed attacker-controlled XML with DTDs into the libxml2 Python SAX API. Package risk score is 0/100 and 14 downstream dependents are tracked, so the blast radius is mostly through container base images.

How does the attack unfold?

Initial Access

Attacker submits a crafted XML document with a DTD to a network-facing service that parses XML via libxml2 Python bindings.

AML.T0049

Exploitation

The SAX attributeDecl callback processes enumerated attribute values and frees the same string twice, corrupting memory.

Impact

The Python process crashes, interrupting model-serving or controller workloads until restarted.

AML.T0029

Initial Access

Attacker submits a crafted XML document with a DTD to a network-facing service that parses XML via libxml2 Python bindings.

AML.T0049

Exploitation

The SAX attributeDecl callback processes enumerated attribute values and frees the same string twice, corrupting memory.

Impact

The Python process crashes, interrupting model-serving or controller workloads until restarted.

AML.T0029

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Llama Stack	pip	—	No patch
8.4K14 dependentsPushed 5d ago33% patched~0d to patchFull package profile →
cert-manager/cert-manager-istio-csr-rhel9	—	—	No patch
cert-manager/cert-manager-operator-rhel9	—	—	No patch
cert-manager/jetstack-cert-manager-rhel9	—	—	No patch
container-tools:rhel8/podman	—	—	No patch
costmanagement/costmanagement-ui-rhel10	—	—	No patch
libxml2	—	—	No patch
libxml2-main	—	—	No patch
openshift/ose-rhel-coreos-8	—	—	No patch
openshift/ose-rhel-coreos-9	—	—	No patch
podman	—	—	No patch
rhai/base-image-cpu-rhel9	—	—	No patch
rhai/base-image-cuda-12.9-rhel9	—	—	No patch
rhai/base-image-cuda-13.0-rhel9	—	—	No patch
rhai/base-image-cuda-rhel9	—	—	No patch
rhai/base-image-gaudi-rhel9	—	—	No patch
rhai/base-image-neuron-rhel9	—	—	No patch
rhai/base-image-rocm-6.4-rhel9	—	—	No patch
rhai/base-image-rocm-7.1-rhel9	—	—	No patch
rhai/base-image-rocm-7.14-rhel9	—	—	No patch
rhai/base-image-rocm-rhel9	—	—	No patch
rhai/base-image-rubin-rhel9	—	—	No patch
rhai/base-image-spyre-rhel9	—	—	No patch
rhai/base-image-tpu-rhel9	—	—	No patch
rhoai/odh-kserve-controller-rhel9	—	—	No patch
rhoai/odh-kserve-llmisvc-controller-rhel9	—	—	No patch
rhoai/odh-model-serving-api-rhel9	—	—	No patch
rhui5/cds-kubernetes-rhel9	—	—	No patch
rhui5/cds-rhel9	—	—	No patch
rhui5/haproxy-rhel9	—	—	No patch
rhui5/installer-rhel9	—	—	No patch
rhui5/rhua-rhel9	—	—	No patch
swift-lang	—	—	No patch

How severe is it?

CVSS 3.1

8.5 / 10

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVNetwork

ACHigh

PRLow

UINone

SChanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Apply the relevant Red Hat errata (RHSA-2026:64463, 71585, 71586, 71641, 72470, 72475, 72476, 79357, 82939, 89750) and rebuild or pull updated images for RHOAI and rhai base images. 2) Inventory Python services that import libxml2 and use its SAX interface (for example import libxml2 with a custom SAX handler), and check container SBOMs for libxml2. 3) Where patching is delayed, reject or pre-filter XML containing DOCTYPE/DTD declarations at the ingress layer, or switch to a parser configured to disable DTD processing. 4) Run XML-handling workers under restart supervision (Kubernetes liveness and restart policies) and set resource limits to contain crash loops. 5) Detection: alert on repeated segfaults or SIGABRT/'double free' messages in container logs and on pod restarts of model-serving and controller workloads.

How is it classified?

DoSSupply ChainFrameworkInferenceAML.T0010.001- AI Software AML.T0029- Denial of AI Service AML.T0049- Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.10.3-Suppliers

NIST AI RMF

MANAGE 2.3-Responses to unknown risks and mechanisms for supersession or deactivation

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-74860?

Is CVE-2026-74860 actively exploited?

No confirmed active exploitation of CVE-2026-74860 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-74860?

1) Apply the relevant Red Hat errata (RHSA-2026:64463, 71585, 71586, 71641, 72470, 72475, 72476, 79357, 82939, 89750) and rebuild or pull updated images for RHOAI and rhai base images. 2) Inventory Python services that import libxml2 and use its SAX interface (for example `import libxml2` with a custom SAX handler), and check container SBOMs for libxml2. 3) Where patching is delayed, reject or pre-filter XML containing DOCTYPE/DTD declarations at the ingress layer, or switch to a parser configured to disable DTD processing. 4) Run XML-handling workers under restart supervision (Kubernetes liveness and restart policies) and set resource limits to contain crash loops. 5) Detection: alert on repeated segfaults or SIGABRT/'double free' messages in container logs and on pod restarts of model-serving and controller workloads.

What systems are affected by CVE-2026-74860?

This vulnerability affects the following AI/ML architecture patterns: model serving, container base images for GPU/accelerator workloads, Kubernetes-based ML platforms (OpenShift AI), ML pipeline orchestration.

What is the CVSS score for CVE-2026-74860?

CVE-2026-74860 has a CVSS v3.1 base score of 8.5 (HIGH).

What is the AI security impact?

Affected AI Architectures

model servingcontainer base images for GPU/accelerator workloadsKubernetes-based ML platforms (OpenShift AI)ML pipeline orchestration

MITRE ATLAS Techniques

AML.T0010.001AI Software

AML.T0029Denial of AI Service

AML.T0049Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.10.3

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition (DTD) with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callback handler, where a string is freed twice. This flaw can lead to a denial of service (DoS) due to a reproducible crash in Python applications using the libxml2 SAX bindings.

Exploitation Scenario

An attacker with low-privilege access to a service that accepts XML submissions, such as a model-registry or metadata ingestion endpoint, uploads a document with a DTD that declares enumerated attribute values. The backend Python component parses it with the libxml2 SAX bindings, and the attributeDecl callback frees the same string twice. The worker crashes. By resending the document, the attacker keeps the component in a crash loop and disrupts model serving or pipeline orchestration. Turning the double-free into code execution is not described and would require substantial additional expertise.

Weaknesses (CWE)

CWE-763Release of Invalid Pointer or Reference

CWE-763 — Release of Invalid Pointer or Reference: The product attempts to return a memory resource to the system, but it calls the wrong release function or calls the appropriate release function incorrectly.

[Implementation] Only call matching memory management functions. Do not mix and match routines. For example, when you allocate a buffer with malloc(), dispose of the original pointer with free().
[Implementation] When programming in C++, consider using smart pointers provided by the boost library to help correctly and consistently manage memory.

Source: MITRE CWE corpus.