Back Linuxsecurity

Fedora 44 XMLStarlet Critical XML Entity Issue Vuln 2026

Linuxsecurity •LinuxSecurity Advisories • June 11, 2026

Fixes XML external entity vulnerability. For more information, refer to

* Wed May 27 2026 Vitezslav Crhonek - 1.6.1-30 - Fix XXE (XML External Entity) vulnerability

Fedora Update Notification FEDORA-2026-dbf44e0b72 2026-06-11 00:54:51.286484+00:00 Name : xmlstarlet Product : Fedora 44 Version : 1.6.1 Release : 30.fc44 URL : Summary : Command Line XML Toolkit Description : XMLStarlet is a set of command line utilities which can be used to transform, query, validate, and edit XML documents and files using simple set of shell commands in similar way it is done for plain text files using UNIX grep, sed, awk, diff, patch, join, etc commands.

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-dbf44e0b72' at the command line. For more information, refer to the dnf documentation available at

Get the latest Linux and open source security news straight to your inbox.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical XML Entity Vulnerabilities Fixed in Fedora 43 and 44 Updates On June 11, 2026, Fedora released updates for XMLStarlet in versions 43 and 44 to address XML External Entity (XXE) vulnerabilities. These vulnerabilities could allow attackers to exploit XML parsing features, potentially leading to unauthorized access to sensitive data. The updates were made available by Vitezslav Crhonek and are crucial for users of Fedora 43 and 44. Users are advised to upgrade using the 'dnf' update program. The vulnerabilities were identified in version 1.6.1-30 of XMLStarlet, which is a command-line toolkit for XML processing. The updates are essential for maintaining security and preventing potential exploitation. No specific CVEs were mentioned in the articles, but the nature of the vulnerabilities suggests a significant risk if left unpatched. 2 sources 61

Fedora 44 XMLStarlet Critical XML Entity Issue Vuln 2026

The full story

Extracted Entities

CWE Weaknesses (1)

Platforms (1)