A security vulnerability (CVE-2026-49825) was identified in the python-lxml library's HTML cleaner component, where a missing xlink:href attribute allows a URL bypass. This issue affects Red Hat Enterprise Linux 7 Extended Lifecycle Support versions. Red Hat has issued an important security update to address this vulnerability.

Red Hat Security Advisory: python-lxml security update

A security vulnerability (CVE-2026-49825) was identified in the python-lxml package used in Red Hat Enterprise Linux 8.4. The issue is a URL bypass vulnerability in the lxml HTML Cleaner component caused by a missing xlink:href attribute. Red Hat has issued an important security update to address this vulnerability.

A security vulnerability (CVE-2026-49825) exists in the python-lxml library's HTML cleaning functionality due to a URL bypass via a missing xlink:href attribute. This flaw affects Red Hat Enterprise Linux 8.8 variants and is rated as important by Red Hat Product Security. A security update is available to address this issue.

A security vulnerability (CVE-2026-49825) exists in the python-lxml library's HTML cleaner component, where a URL bypass occurs due to a missing xlink:href attribute. This vulnerability affects Red Hat Enterprise Linux 8.6 variants and has been rated with an Important security impact by Red Hat. A security update addressing this issue is available from Red Hat.

A vulnerability was found in the lxml library used by Red Hat Quay 3.10.27, where missing xlink:href in lxml.html.defs.link_attrs allows attackers to bypass URL filtering. This can lead to URL bypass attacks in embedded content such as SVG or MathML, potentially causing information disclosure or arbitrary code execution in the user's browser context. Red Hat has released Quay 3.10.27 with bug fixes addressing this issue.

Red Hat Security Advisory: Red Hat Quay 3.10.27

A security vulnerability (CVE-2026-49825) has been identified in the python3.12-lxml package used in Red Hat Enterprise Linux 9.6 Extended Update Support. The issue is a URL bypass vulnerability in the lxml HTML cleaner component caused by a missing xlink:href attribute. This vulnerability has been rated as having an Important security impact by Red Hat. A security update addressing this flaw is available for affected Red Hat Enterprise Linux 9.6 variants.

Red Hat Security Advisory: python3.12-lxml security update

A security vulnerability (CVE-2026-49825) affecting the lxml library used in Python 3.12 has been identified and addressed by Red Hat. The flaw involves a URL bypass vulnerability in the lxml HTML cleaner component due to a missing xlink:href attribute. This vulnerability has been rated as having an important security impact by Red Hat and affects multiple Red Hat Enterprise Linux 9.4 variants. A security update is available to remediate this issue.

A security vulnerability (CVE-2026-49825) affecting the python-lxml package in Red Hat Enterprise Linux 8 has been identified and addressed. The flaw involves a URL bypass vulnerability in the lxml HTML Cleaner component due to a missing xlink:href attribute. Red Hat has issued an important security update to fix this issue in python-lxml version 4.2.3-5.el8_10. The vulnerability is rated as having a high security impact. No CVSS score is provided in the advisory. The update is available for multiple architectures including x86_64, s390x, ppc64le, and aarch64. Users of affected Red Hat Enterprise Linux 8 versions are advised to apply the update as detailed in the vendor advisory.

A security vulnerability (CVE-2026-49825) was identified in the python-lxml package used in Red Hat Enterprise Linux 9.6 Extended Update Support. The flaw involves a URL bypass vulnerability in the lxml HTML cleaner component due to a missing xlink:href attribute. Red Hat has issued an important security update to address this issue.

A security vulnerability (CVE-2026-49825) exists in the python-lxml package used in Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. The flaw is a URL bypass vulnerability in the lxml HTML cleaner component due to a missing xlink:href attribute. This vulnerability has been rated with an important security impact by Red Hat and is addressed in updated python-lxml packages for multiple architectures. Users of affected Red Hat Enterprise Linux 9.4 variants should apply the provided security update to remediate this issue.

A security vulnerability (CVE-2026-49825) was identified in the python-lxml library used in Red Hat Enterprise Linux 9.2. The flaw involves a URL bypass in the lxml HTML Cleaner component due to a missing xlink:href attribute. This vulnerability has been rated as important by Red Hat Product Security. An update to python-lxml version 4.6.5-3.el9_2.1 addresses this issue. The vulnerability affects multiple architectures of Red Hat Enterprise Linux 9.2, including x86_64, ppc64le, aarch64, and s390x.

A security vulnerability (CVE-2026-49825) was identified in the python-lxml package used in Red Hat Enterprise Linux 9. The issue is a URL bypass vulnerability in the lxml HTML cleaner component caused by a missing xlink:href attribute. Red Hat has issued an important security update to address this vulnerability in python-lxml. The update is available for multiple architectures and variants of Red Hat Enterprise Linux 9. No public exploit or active exploitation in the wild is currently known.

A security vulnerability (CVE-2026-49825) exists in the python3.12-lxml package used in Red Hat Enterprise Linux 9. The flaw is a URL bypass vulnerability in the lxml HTML Cleaner component caused by a missing xlink:href attribute check. Red Hat has issued an important security update to address this issue.

lxml

lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.1, link attributes in ``lxml.html.defs.link_attrs`` were missing ``xlink:href``, which can be used for URL bypass attacks in embedded SVG/MathML/etc. content. This vulnerability was fixed in lxml 6.1.1 and lxml_html_clean 0.4.5.

Search: CVE-2026-49825