security update for perl-XML-LibXML

CVE-2026-8177 is a vulnerability in the perl-XML-LibXML module, which provides a Perl interface to the GNOME libxml2 library for XML parsing and manipulation. The flaw allows reading out-of-bounds heap memory when parsing XML node names that contain truncated UTF-8 byte sequences, leading to a denial of service condition. This issue is tracked under bug bsc#1264715 and has been assigned a CWE-125 (Out-of-bounds Read). Red Hat has issued an important security advisory (RHSA-2026:39553) with patches for Red Hat Enterprise Linux 9 on multiple architectures. The vulnerability affects perl-XML-LibXML versions up to 2.0210 and earlier versions as specified by SUSE advisories.

The vulnerability allows an attacker to cause a denial of service by triggering a read out-of-bounds condition in the XML parser when processing malformed XML node names with truncated UTF-8 sequences. There are no known exploits in the wild. The impact is limited to denial of service and does not include code execution or data disclosure based on the available information.

An official security update is available from Red Hat and SUSE. Users should apply the vendor-provided patches to perl-XML-LibXML as per the advisories (e.g., Red Hat advisory RHSA-2026:39553). No additional mitigation actions are required beyond applying the update. Refer to the vendor advisories for detailed update instructions.