What is GHSA-xvw4-gjw8-rw38?

GHSA-xvw4-gjw8-rw38 is a security advisory published by GitHub Security Advisories with Medium severity. In libxml2 before 2.15.4, xmlURIEscapeStr in uri.c has an integer overflow.

Which CVE IDs does GHSA-xvw4-gjw8-rw38 cover?

GHSA-xvw4-gjw8-rw38 covers the following CVE IDs: CVE-2026-86139. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-xvw4-gjw8-rw38?

GHSA-xvw4-gjw8-rw38 has a CVSS v3 base score of 6.9, published by GitHub Security Advisories.

GHSA-xvw4-gjw8-rw38MediumCVSS 6.9

In libxml2 before 2.15.4, xmlURIEscapeStr in uri.c has an integer overflow.

Vendor

GitHub Security Advisories

Published

September 5, 2026

Last Modified

September 5, 2026

🔗 CVE IDs covered (1)

CVE-2026-86139 →

📋 Description

In libxml2 before 2.15.4, xmlURIEscapeStr in uri.c has an integer overflow.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-86139
https://github.com/GNOME/libxml2/commit/8edbbdb09f24d26a2f900141fddc2b9d014f53b0
https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4
https://github.com/advisories/GHSA-xvw4-gjw8-rw38