The vulnerability arises from unrestricted recursion in libxml2 when a self‑referencing delegate URI is present in an XML catalog. The bug causes infinite recursion in the xmlCatalogXMLResolveURI function, exhausting the call stack and ultimately resulting in a segmentation fault. This crash of the parsing library leads to a denial of service by terminating the affected application. The weakness is identified as CWE‑674 (Uncontrolled Recursion).

Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, Red Hat JBoss Core Services, Red Hat OpenShift Container Platform 4, and Red Hat Hummingbird 1 are affected. These systems rely on libxml2 for XML parsing and catalog processing.

The CVSS score of 5.9 indicates a medium severity. The EPSS score of less than 1% suggests a very low probability of exploitation in the current environment. The vulnerability is not listed in the CISA KEV catalog. An attacker would need remote or configuration access to supply a specially crafted XML catalog containing a self‑referencing delegate URI. If successful, the attacker could force the application to crash, denying service to legitimate users. The primary attack vector is remote or configuration-dependent input into the XML catalog system.