The advisory for CVE-2026-6653 lists libxml2 2.9.11 through versions before 2.11.0 as affected and names 2.11.0 as the fixed release. Reading that as a single package upgrade is the fastest way to leave the vulnerability in production, because most systems do not track libxml2 as a first-class dependency.

Where the library hides

libxml2 is a C library consumed by language runtimes, document converters, configuration parsers and management appliances. In a containerised estate it can appear three times in one request path: in the base image, in a runtime bundled with an application server, and in a statically linked tool invoked by a batch job.

An inventory that queries the package manager only reports the first layer. The CVE record's repo field points at the GNOME libxml2 project, which is accurate for upstream but not for the artefact actually deployed.

What the scoring record tells an inventory owner

NVD scores the flaw 9.8 under CVSS 3.1 with low attack complexity and no privileges required. The CNA record scores 7.0 under CVSS 4.0, marks attack complexity high, and states proof-of-concept maturity with a denial-of-service impact via crafted XML. CISA's SSVC decision points record exploitation as none, automatable as no and technical impact as partial.

The disagreement is a signal about assumptions, not about presence. A component inventory can confirm presence without resolving the scoring debate, and that is the step worth doing first.

Building the affected list

Start from the products CERT-Bund already references: Red Hat Enterprise Linux, Rocky Linux, Oracle Linux, Amazon Linux 2, IBM Security Verify Access and IBM Power Hardware Management Console. Each has a vendor build that carries the backport, and each has an owning team in most organisations.

Then enumerate the software that embeds libxml2 without naming it in a top-level dependency manifest. Document conversion pipelines are the usual offenders because they parse untrusted input by design.

Confirming exposure honestly

ZoomEye's verified product query banner="libxml2" returned 341 matching assets on 2026-10-27. The result identifies fingerprinted assets and says nothing about their installed version, so it belongs in the scoping section of an inventory, not the findings section.

Search dork: banner="libxml2"

ZoomEye search link: https://www.zoomeye.ai/searchResult?q=YmFubmVyPSJsaWJ4bWwyIg%3D%3D