Hi,

The following vulnerability was published for libnxml.

CVE-2026-123202[0]:
| libnxml before 0.18.6 contains a stack-based buffer overflow
| vulnerability in src/nxml_parser.c that allows remote attackers to
| write past a 1024-byte stack buffer via long XML names. Attackers
| can supply XML or RSS feeds with a 1022-character element,
| attribute, DOCTYPE or entity name ending in a multi-byte UTF-8
| character to crash parsing applications.

Fixed by: https://github.com/bakulf/libnxml/commit/fbac242374883edf2ec14127ca6d2accf4704b6a (0.18.6)


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-123202
https://www.cve.org/CVERecord?id=CVE-2026-123202

Please adjust the affected versions in the BTS as needed.