CVE-2026-6653 in libxml2 is an SBOM problem before a patch problem

CVE-2026-6653 affects libxml2 from 2.9.11 through versions before 2.11.0, with 2.11.0 as the fixed release. NVD scores it 9.8 under CVSS 3.1, while the CNA scores 7.0 under CVSS 4.0 with high attack complexity and a denial-of-service impact via crafted XML. Because libxml2 is often embedded in base images, runtimes and statically linked tools, package-manager inventories miss most deployments.

• Affected: libxml2 2.9.11 through versions before 2.11.0
• NVD scores 9.8 (CVSS 3.1); CNA scores 7.0 (CVSS 4.0)
• CISA SSVC: exploitation none, automatable no, partial impact
• ZoomEye found 341 assets with banner="libxml2" on 2026-10-27