CVE-2026-86144: CWE-669 Incorrect Resource Transfer Between Spheres in xmlsoft libxml2

In libxml2 versions prior to 2.15.4, the functions xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This omission affects flags like XML_PARSE_NONET, which is intended to prevent network access during XML parsing. Without proper propagation, a custom resource loader may access external internet resources, potentially enabling XML external entity injection, SSRF, or denial of service attacks caused by slow or malicious external resources.

The vulnerability allows an attacker to bypass network access restrictions during XML processing, potentially leading to information disclosure (via XML external entity injection), SSRF, or denial of service conditions. The CVSS score of 5.6 (medium severity) reflects limited attack vector (local), high attack complexity, no privileges required, and impacts on confidentiality, integrity, and availability.

A fix is available in libxml2 version 2.15.4 and later. Users should upgrade to version 2.15.4 or newer to ensure parseFlags are properly propagated and network access restrictions are enforced during XML processing. No vendor advisory content was provided to indicate alternative mitigations or that no action is required.