Back Linuxsecurity

Oracle librsvg2 Update Fixes XML Entity Use-After

Linuxsecurity •LinuxSecurity Advisories • October 22, 2026

Running self-managed GitLab? Critical flaws could allow server code execution. Check the fixes. ×

[2.42.7-6] - CVE-2026-96889 librsvg2: Use-after-free when XML includes have duplicated entities duplicated entities - Resolves: RHEL-267981

librsvg2-2.42.7-6.el8_10.i686.rpm librsvg2-2.42.7-6.el8_10.x86_64.rpm librsvg2-devel-2.42.7-6.el8_10.i686.rpm librsvg2-devel-2.42.7-6.el8_10.x86_64.rpm librsvg2-tools-2.42.7-6.el8_10.x86_64.rpm

librsvg2-2.42.7-6.el8_10.aarch64.rpm librsvg2-devel-2.42.7-6.el8_10.aarch64.rpm librsvg2-tools-2.42.7-6.el8_10.aarch64.rpm

Related CVEs: CVE-2026-96889

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Oracle Updates Fix XML Entity Use-After-Free Vulnerability Oracle has released updates for the librsvg2 library to address an use-after-free vulnerability (CVE-2026-96889) affecting multiple versions of Oracle Linux. The flaw allows for potential server code execution when XML includes have duplicated entities. This vulnerability has a CVSS score of 7.8, indicating a high severity level. Users of Oracle Linux 8 and 10 are urged to apply the patches immediately to mitigate risks. The vulnerability was publicly disclosed on September 23, 2026, with proof-of-concept code available since September 22. Administrators running self-managed GitLab installations are particularly at risk. The updates include various RPM packages for different architectures, including x86_64 and aarch64. Failure to patch could lead to significant security breaches. 3 sources 65

Extracted Entities

Oracle librsvg2 Update Fixes XML Entity Use-After

The full story

Extracted Entities

CVEs (1)

CWE Weaknesses (1)

Platforms (1)