RHSA-2026:61234HighCVSS 7.4

Red Hat Security Advisory: xmlrpc-c security update

Published
August 31, 2026
Last Modified
November 5, 2026

🔗 CVE IDs covered (1)

CVE-2026-15928 →

📋 Description

CVE-2026-15928 — xmlrpc-c: XMLRPC-C Library: Cross-Site Scripting in error page component

🎯 Affected products56

  • Red Hat Enterprise Linux Server (v. 7 ELS)
  • Red Hat Enterprise Linux Server Optional (v. 7 ELS)
  • xmlrpc-c-0:1.32.5-1905.svn2451.el7_9.1.i686 as a component of Red Hat Enterprise Linux Server (v. 7 ELS)
  • xmlrpc-c-0:1.32.5-1905.svn2451.el7_9.1.ppc as a component of Red Hat Enterprise Linux Server (v. 7 ELS)
  • xmlrpc-c-0:1.32.5-1905.svn2451.el7_9.1.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7 ELS)
  • xmlrpc-c-0:1.32.5-1905.svn2451.el7_9.1.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7 ELS)
  • xmlrpc-c-0:1.32.5-1905.svn2451.el7_9.1.s390 as a component of Red Hat Enterprise Linux Server (v. 7 ELS)
  • xmlrpc-c-0:1.32.5-1905.svn2451.el7_9.1.s390x as a component of Red Hat Enterprise Linux Server (v. 7 ELS)
  • xmlrpc-c-0:1.32.5-1905.svn2451.el7_9.1.src as a component of Red Hat Enterprise Linux Server (v. 7 ELS)
  • xmlrpc-c-0:1.32.5-1905.svn2451.el7_9.1.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7 ELS)
  • xmlrpc-c-apps-0:1.32.5-1905.svn2451.el7_9.1.ppc64 as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)
  • xmlrpc-c-apps-0:1.32.5-1905.svn2451.el7_9.1.ppc64le as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)
  • xmlrpc-c-apps-0:1.32.5-1905.svn2451.el7_9.1.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)
  • xmlrpc-c-apps-0:1.32.5-1905.svn2451.el7_9.1.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)
  • xmlrpc-c-c++-0:1.32.5-1905.svn2451.el7_9.1.i686 as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)
  • xmlrpc-c-c++-0:1.32.5-1905.svn2451.el7_9.1.ppc as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)
  • xmlrpc-c-c++-0:1.32.5-1905.svn2451.el7_9.1.ppc64 as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)
  • xmlrpc-c-c++-0:1.32.5-1905.svn2451.el7_9.1.ppc64le as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)
  • xmlrpc-c-c++-0:1.32.5-1905.svn2451.el7_9.1.s390 as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)
  • xmlrpc-c-c++-0:1.32.5-1905.svn2451.el7_9.1.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)
  • xmlrpc-c-c++-0:1.32.5-1905.svn2451.el7_9.1.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)
  • xmlrpc-c-client++-0:1.32.5-1905.svn2451.el7_9.1.i686 as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)
  • xmlrpc-c-client++-0:1.32.5-1905.svn2451.el7_9.1.ppc as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)
  • xmlrpc-c-client++-0:1.32.5-1905.svn2451.el7_9.1.ppc64 as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)
  • xmlrpc-c-client++-0:1.32.5-1905.svn2451.el7_9.1.ppc64le as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)
  • xmlrpc-c-client++-0:1.32.5-1905.svn2451.el7_9.1.s390 as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)
  • xmlrpc-c-client++-0:1.32.5-1905.svn2451.el7_9.1.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)
  • xmlrpc-c-client++-0:1.32.5-1905.svn2451.el7_9.1.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)
  • xmlrpc-c-client-0:1.32.5-1905.svn2451.el7_9.1.i686 as a component of Red Hat Enterprise Linux Server (v. 7 ELS)
  • xmlrpc-c-client-0:1.32.5-1905.svn2451.el7_9.1.ppc as a component of Red Hat Enterprise Linux Server (v. 7 ELS)
  • +26 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: To mitigate this issue, ensure that applications utilizing the XMLRPC-C library do not directly expose its error pages to end-users via a web browser. Configure web servers or application frontends to intercept and sanitize or replace error responses originating from XMLRPC-C before they are rendered client-side. Alternatively, restrict XMLRPC-C deployments to backend services that do not present error output in a user-facing web interface.

🔗 References (4)