libxml2’s RelaxNG parser processes nested <include> directives without limiting recursion depth, allowing specially crafted or deeply nested schemas to trigger stack exhaustion. The resulting overflow causes the calling application to crash, leading to a denial‑of‑service condition. The weakness corresponds to CWE‑674, which describes uncontrolled recursion. This flaw does not provide code execution or data disclosure but can disrupt availability of any service that parses untrusted RelaxNG schemas.

The vulnerability affects multiple Red Hat products that bundle libxml2, including Red Hat Enterprise Linux releases 6 through 10, Red Hat Hardened Images, Red Hat JBoss Core Services, and Red Hat OpenShift Container Platform 4. The specific libxml2 version in use is not listed, but any installation of libxml2 on the affected Red Hat platforms is potentially susceptible.

With a CVSS score of 3.7, the vulnerability represents a low severity risk. The EPSS score of less than 1 % indicates an extremely low likelihood of exploitation. The CVE is not currently listed in the CISA KEV catalog. The likely attack vector involves an adversary supplying a malicious RelaxNG schema file to an application that processes such schemas with libxml2. No elevated privileges, network access, or local compromise are required beyond the ability to deliver an untrusted schema to the vulnerable process. If exploited, the outcome is a crash of the target application, which may affect service availability.