A flaw exists in the interactive shell of the xmllint utility, part of libxml2, where memory allocated for user input is not released when the input consists only of whitespace. Repeated submissions cause increasing memory consumption, eventually exhausting system memory and terminating the xmllint process, creating a denial‑of‑service condition on the host.

The vulnerability affects Red Hat‑based products that ship the libxml2 package, including Red Hat Enterprise Linux releases 6 through 10, Red Hat Hardened Images, Red Hat JBoss Core Services, and Red Hat OpenShift Container Platform 4. No specific libxml2 version is cited, so any distribution containing the vulnerable code may be impacted if not yet patched.

The CVSS score of 6.2 classifies the issue as moderate severity, while the EPSS score of less than 1% indicates that exploitation is unlikely but possible. The vulnerability is not listed in the CISA KEV catalog. Triggering the flaw requires local or user‑level access to run the interactive xmllint shell; elevated privileges are not needed. The denial of service is confined to the host where the shell is executed, and no remote exploitation path is documented.