Debian libxml2 Critical Denial Service Threat DLA-4622-1 CVE-2025-8732

CVE-2025-8732

Catalog parsing functions were missing cycle detection. When a
catalog file contains a CATALOG directive pointing to itself,
`xmlExpandCatalog()` and `xmlParseSGMLCatalog()` recursively call
each other without bounds until stack overflow.

CVE-2026-0989

The RelaxNG parser does not limit the recursion depth when resolving
`` directives, which may lead to stack overflow on
malicious RelaxNG schema file.

CVE-2026-0990

Nick Wellnhofer discovered that `xmlCatalogXMLResolveURI()` will
recurse infinitely if a catalog has a URI delegate referencing
itself, eventually resulting in a call stack overflow.

CVE-2026-0992

Nick Wellnhofer discovered that processing a chain of XML catalogs
linked with `` and having the `` element
takes exponential time, leading to denial of service via resource
exhaustion.

CVE-2026-1757

The command parsing logic of the xmllint(1) interactive shell was
found to leak memory.