This vulnerability arises from the RelaxNG parser in libxml2 failing to limit the depth of nested <include> directives when processing external schema inclusions. Crafted or complex schemas can trigger excessive recursion, exhausting the stack and crashing the application, leading to denial-of-service. The issue affects Red Hat Hardened Images and is tracked as CVE-2026-0989 with a CVSS 3.7 (low) score. Red Hat has issued updated libxml2 RPMs (version 2.15.2-0.3.hum1) for multiple architectures to fix this flaw. The vendor advisory confirms the availability of these updates and provides guidance for applying them.

The impact is limited to denial-of-service caused by application crashes due to stack exhaustion from uncontrolled recursion in the RelaxNG parser. There is no confidentiality, integrity, or privilege escalation impact reported. The CVSS score of 3.7 reflects a low severity denial-of-service risk without other impacts.

Red Hat has released updated libxml2 packages that address this vulnerability. Users of Red Hat Hardened Images should apply the libxml2 RPM updates (libxml2-16-2.15.2-0.3.hum1 and related packages) as provided in the Red Hat advisory RHSA-2026:7519. Following the vendor's update instructions will mitigate the risk. No additional mitigation steps are indicated or required by the vendor.