RHSA-2026:61316HighCVSS 7.4

Red Hat Security Advisory: xmlrpc-c security update

Published
August 31, 2026
Last Modified
November 5, 2026

🔗 CVE IDs covered (1)

CVE-2026-15928 →

📋 Description

CVE-2026-15928 — xmlrpc-c: XMLRPC-C Library: Cross-Site Scripting in error page component

🎯 Affected products88

  • Red Hat Enterprise Linux AppStream (v. 9)
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • xmlrpc-c-0:1.51.0-17.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • xmlrpc-c-0:1.51.0-17.el9_8.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • xmlrpc-c-0:1.51.0-17.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • xmlrpc-c-0:1.51.0-17.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • xmlrpc-c-0:1.51.0-17.el9_8.src as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • xmlrpc-c-0:1.51.0-17.el9_8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • xmlrpc-c-apps-debuginfo-0:1.51.0-17.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • xmlrpc-c-apps-debuginfo-0:1.51.0-17.el9_8.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • xmlrpc-c-apps-debuginfo-0:1.51.0-17.el9_8.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • xmlrpc-c-apps-debuginfo-0:1.51.0-17.el9_8.i686 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • xmlrpc-c-apps-debuginfo-0:1.51.0-17.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • xmlrpc-c-apps-debuginfo-0:1.51.0-17.el9_8.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • xmlrpc-c-apps-debuginfo-0:1.51.0-17.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • xmlrpc-c-apps-debuginfo-0:1.51.0-17.el9_8.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • xmlrpc-c-apps-debuginfo-0:1.51.0-17.el9_8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • xmlrpc-c-apps-debuginfo-0:1.51.0-17.el9_8.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • xmlrpc-c-c++-0:1.51.0-17.el9_8.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • xmlrpc-c-c++-0:1.51.0-17.el9_8.i686 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • xmlrpc-c-c++-0:1.51.0-17.el9_8.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • xmlrpc-c-c++-0:1.51.0-17.el9_8.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • xmlrpc-c-c++-0:1.51.0-17.el9_8.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • xmlrpc-c-c++-debuginfo-0:1.51.0-17.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • xmlrpc-c-c++-debuginfo-0:1.51.0-17.el9_8.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • xmlrpc-c-c++-debuginfo-0:1.51.0-17.el9_8.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • xmlrpc-c-c++-debuginfo-0:1.51.0-17.el9_8.i686 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • xmlrpc-c-c++-debuginfo-0:1.51.0-17.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • xmlrpc-c-c++-debuginfo-0:1.51.0-17.el9_8.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
  • xmlrpc-c-c++-debuginfo-0:1.51.0-17.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • +58 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: To mitigate this issue, ensure that applications utilizing the XMLRPC-C library do not directly expose its error pages to end-users via a web browser. Configure web servers or application frontends to intercept and sanitize or replace error responses originating from XMLRPC-C before they are rendered client-side. Alternatively, restrict XMLRPC-C deployments to backend services that do not present error output in a user-facing web interface.

🔗 References (4)