The vulnerability CVE-2026-0989 affects the RelaxNG parser component of libxml2 in Red Hat Hardened Images. It arises because the parser fails to enforce limits on the depth of nested <include> directives when resolving external schema inclusions. Crafted or complex schemas can trigger excessive recursion, causing stack exhaustion and application crashes. This leads to a denial-of-service impact without affecting confidentiality or integrity. Red Hat published security advisories and released updated libxml2 RPMs (version 2.15.2-0.3.hum1) for multiple architectures to fix this issue.

The vulnerability allows denial-of-service via application crashes caused by stack exhaustion during parsing of specially crafted RelaxNG schemas. There is no impact on confidentiality or integrity. The CVSS v3.1 base score is 3.7 (low), reflecting a network attack vector with high attack complexity and no privileges or user interaction required.

Red Hat has released updated libxml2 packages (libxml2-2.15.2-0.3.hum1 and related RPMs) that address this vulnerability. Applying these official updates to Red Hat Hardened Images will remediate the issue. Refer to the Red Hat advisory RHSA-2026:7519 for detailed update instructions. No additional mitigation is required beyond applying the vendor-provided fix.