Critical Vulnerabilities in XML::Parser Affect Multiple Ubuntu Releases

Severity: Medium (Score: 57.9)

Sources: Linuxsecurity, Ubuntu

Summary

On April 14, 2026, vulnerabilities were disclosed in the XML::Parser module affecting several Ubuntu releases, including 25.10, 24.04 LTS, and 22.04 LTS. The vulnerabilities, identified as CVE-2006-10002 and CVE-2006-10003, allow remote attackers to exploit improperly handled multi-byte UTF-8 characters and very deep element nesting in XML data. If successfully exploited, these vulnerabilities could lead to denial of service or arbitrary code execution. Users and automated systems tricked into processing specially crafted XML data are particularly at risk. A standard system update is recommended to mitigate these issues. The vulnerabilities were published on March 19, 2026, and are now being actively addressed by the community. Ubuntu Pro offers extended support for affected packages, ensuring security coverage for users. Key Points: • Two critical vulnerabilities in XML::Parser could lead to denial of service or code execution. • Affected Ubuntu versions include 25.10, 24.04 LTS, and 22.04 LTS. • Immediate system updates are recommended to mitigate these vulnerabilities.

Key Entities

• Denial of Service (attack_type)
• Zero-day Exploit (attack_type)
• CVE-2006-10002 (cve)
• CVE-2006-10003 (cve)
• Ubuntu (company)
• Ubuntu Pro (platform)