A flaw in the libxml2 library allows an attacker to trigger excessive CPU consumption by supplying XML catalogs that contain repeated <nextCatalog> elements that reference the same downstream catalog. A parser will repeatedly traverse the same catalog chain, leading to uncontrolled resource consumption and application availability degradation. This denial‑of‑service condition is a form of resource exhaustion (CWE‑400).

The vulnerability affects Red Hat ecosystems that use libxml2, including Red Hat Enterprise Linux 10, 6, 7, 8, and 9; Red Hat Hardened Images; Red Hat JBoss Core Services; and Red Hat OpenShift Container Platform 4. The specific libxml2 version numbers affected are not listed in the available CVE data.

The attack is remotely exploitable by supplying crafted XML catalogs, so an adversary with the ability to influence catalog inputs could trigger the denial of service. The CVSS score of 2.9 indicates low severity, and the EPSS of less than 1% suggests a very low likelihood of exploitation. The vulnerability is not included in the CISA KEV catalog. The absence of a vendor‑issued workaround means that protection relies on patching or mitigations at the application level.