CVE-2026-6653

CriticalCVSS 9.8/10Last modified Jul 14, 2026

Description

Use After Free in libxml2's xmlParseInternalSubset from GNOME libxml2 version 2.9.11 to 2.11.0 allows a remote attacker to cause a denial-of-service via maliciously crafted XML input with improper entity resolution handling.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416 CWE-611

Affected software

No affected versions have been published.

Timeline

Published: Jun 22, 2026
Last modified: Jul 14, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-66545.1Double-Free / Use-After-Free (UAF) in the `IntoIter::drop` and `ThinVec::clear` functions in the thin_vec crate. A panic in `ptr::drop_in_pl CVE-2026-66567.5Crypt::Password versions through 0.28 for Perl are susceptible to timing attacks. The check_password method uses the built-in eq operator. CVE-2026-665639.8Unauthenticated PHP Object Injection in Windsor <= 2.10 versions.CVE-2026-665649.8Unauthenticated PHP Object Injection in ShiftCV <= 3.0.14 versions.CVE-2026-665659.8Unauthenticated PHP Object Injection in FC United <= 1.1.1 versions.CVE-2026-665668.1Unauthenticated Local File Inclusion in Ambient <= 1.7 versions.CVE-2026-665679.8Unauthenticated PHP Object Injection in Anesta <= 1.5.3 versions.CVE-2026-665689.8Unauthenticated PHP Object Injection in Original <= 1.9.0 versions.CVE-2026-665699.8Unauthenticated PHP Object Injection in Kicker <= 2.2.1 versions.CVE-2026-66578.8A vulnerability in jupyter-server versions 1.12.0 through 2.17.0 allows an attacker to bypass CORS origin validation when the `allow_origin_CVE-2026-665717.1Unauthenticated Cross Site Request Forgery (CSRF) in Asset CleanUp: Page Speed Booster <= 1.4.0.5 versions.CVE-2026-665726.5Contributor Cross Site Scripting (XSS) in JetBlog <= 2.4.10 versions.