CVE-2019-19956: xmlParseBalancedChunkMemoryRecover in parser.c in libxml2 before 2.9.10 has a memory leak related to newDoc...

Security readout for executives and security teams

CVE-2019-19956 is a libxml2 memory leak that can turn XML processing into a denial-of-service risk. An attacker who can make an exposed service parse crafted XML may be able to drive memory growth and disrupt availability. The source bundle does not show confirmed active exploitation. Exposure is likely where applications, OS packages, containers, appliances, or embedded products include libxml2 before 2.9.10 and parse untrusted XML. Debian, Ubuntu, Fedora, openSUSE, Oracle, NetApp, and Siemens references indicate broad downstream packaging impact, but product-specific exposure must be confirmed locally. Treat this as a high-priority availability risk for systems that process untrusted XML, especially public services. It is not evidenced as actively exploited in the provided sources, but patching should proceed through normal high-severity maintenance because libxml2 is widely reused. Mitigation focus: Update libxml2 using the relevant vendor security advisory or package channel.; Target libxml2 2.9.10 or a vendor-backported fixed package.; Prioritize internet-facing services that parse XML from untrusted sources..

Prepared

May 24, 2026, 09:01 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.