CVE catalog

CVE-2026-41066

lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.0, using either of the two parsers in the default configuration (with resolve_entities=True) allows untrusted XML inp

[CVE catalog]

Severity
High · CVSS 8.2CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.32% · Oct 27, 2026

lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.0, using either of the two parsers in the default configuration (with resolve_entities=True) allows untrusted XML input to read local files. Setting the resolve_entities option explicitly to resolve_entities='internal' or resolve_entities=False disables the local file access. This vulnerability is fixed in 6.1.0.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlxmlsid6.1.3-1.1fixed
Debianlxmlforky6.1.3-1fixed
Debianlxmltrixie5.4.0-1vulnerable
Debianlxmlbookworm4.9.2-1vulnerable
Debianlxmlbookworm-security4.9.2-1+deb12u1fixed
CpelxmlNot reportedNot reportedvulnerable
CpelxmlNot reported6.1.0fixed
PyPIlxmlNot reported6.1.0fixed
Ubuntulxmlnoble5.2.1-1ubuntu0.2fixed
Ubuntupython-lxml-docnoble5.2.1-1ubuntu0.2fixed
Ubuntupython3-lxmlnoble5.2.1-1ubuntu0.2fixed
Ubuntulxmlpro4.4.1-1vulnerable
Ubuntulxmlpro4.4.1-1build1vulnerable
Ubuntulxmlpro4.4.2-1vulnerable
Ubuntulxmlpro4.5.0-1vulnerable
Ubuntulxmlpro4.5.0-1ubuntu0.1vulnerable
Ubuntulxmlpro4.5.0-1ubuntu0.2vulnerable
Ubuntulxmlpro4.5.0-1ubuntu0.3vulnerable
Ubuntulxmlpro4.5.0-1ubuntu0.5vulnerable
Ubuntulxmlpro4.5.0-1ubuntu0.5+esm1fixed
Ubuntulxml22.044.6.3+dfsg-0.1vulnerable
Ubuntulxml22.044.6.4-1vulnerable
Ubuntulxml22.044.6.4-1ubuntu1vulnerable
Ubuntulxml22.044.7.1-1vulnerable
Ubuntulxml22.044.8.0-1vulnerable
Ubuntulxml22.044.8.0-1build1vulnerable
Ubuntulxml22.044.8.0-1ubuntu0.1fixed
Ubuntulxml24.044.9.3-1vulnerable
Ubuntulxml24.044.9.3-1build1vulnerable
Ubuntulxml24.044.9.4-1vulnerable
Ubuntulxml24.045.1.0-1vulnerable
Ubuntulxml24.045.1.0-1build1vulnerable
Ubuntulxml24.045.1.0-1build2vulnerable
Ubuntulxml24.045.2.1-1vulnerable
Ubuntulxml24.045.2.1-1ubuntu0.2fixed
Ubuntulxml26.046.0.1-1vulnerable
Ubuntulxml26.046.0.1-1build1vulnerable
Ubuntulxml26.046.0.2-1vulnerable
Ubuntulxml26.046.0.2-1build1vulnerable
Ubuntulxml26.046.0.2-1ubuntu0.1fixed
Ubuntulxmlpro4.4.1-1vulnerable
Ubuntulxmlpro4.4.1-1build1vulnerable
Ubuntulxmlpro4.4.2-1vulnerable
Ubuntulxmlpro4.5.0-1vulnerable
Ubuntulxmlpro4.5.0-1ubuntu0.1vulnerable
Ubuntulxmlpro4.5.0-1ubuntu0.2vulnerable
Ubuntulxmlpro4.5.0-1ubuntu0.3vulnerable
Ubuntulxmlpro4.5.0-1ubuntu0.5vulnerable
Ubuntulxmlpro4.5.0-1ubuntu0.5+esm1fixed
Ubuntulxml22.044.6.3+dfsg-0.1vulnerable
Ubuntulxml22.044.6.4-1vulnerable
Ubuntulxml22.044.6.4-1ubuntu1vulnerable
Ubuntulxml22.044.7.1-1vulnerable
Ubuntulxml22.044.8.0-1vulnerable
Ubuntulxml22.044.8.0-1build1vulnerable
Ubuntulxml22.044.8.0-1ubuntu0.1fixed
Ubuntulxml24.044.9.3-1vulnerable
Ubuntulxml24.044.9.3-1build1vulnerable
Ubuntulxml24.044.9.4-1vulnerable
Ubuntulxml24.045.1.0-1vulnerable
Ubuntulxml24.045.1.0-1build1vulnerable
Ubuntulxml24.045.1.0-1build2vulnerable
Ubuntulxml24.045.2.1-1vulnerable
Ubuntulxml24.045.2.1-1ubuntu0.2fixed
Ubuntulxml25.105.3.2-1vulnerable
Ubuntulxml25.105.4.0-1vulnerable
Ubuntulxml25.105.4.0-1build1vulnerable
Ubuntulxml25.106.0.1-1vulnerable
Ubuntulxml26.046.0.1-1vulnerable
Ubuntulxml26.046.0.1-1build1vulnerable
Ubuntulxml26.046.0.2-1vulnerable
Ubuntulxml26.046.0.2-1build1vulnerable
Ubuntulxml26.046.0.2-1ubuntu0.1fixed
Alpinepy3-lxml3.246.1.0-r0fixed
Susepython3-lxmllinux enterprise server ltss extended security 12 sp53.6.1-3.9.1fixed
Susepython3-lxmllinux enterprise micro 5.54.9.1-150500.3.7.1fixed
Susepython3-lxmllinux enterprise module for basesystem 15 sp74.9.1-150500.3.7.1fixed
Susepython-lxmllinux enterprise module for python 3 15 sp74.9.3-150400.8.11.1fixed
Susepython-lxmllinux enterprise server ltss extended security 12 sp53.6.1-8.8.1fixed
Susepython-lxmllinux enterprise micro 5.34.7.1-150200.3.15.1fixed
Susepython-lxmllinux enterprise micro 5.44.7.1-150200.3.15.1fixed
Opensusepython-lxmltumbleweed6.1.0-1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlxmlsourcesid6.1.0-1not yet assignedNot reportedNot reported
Debianlxmlsourceforky6.1.0-1not yet assignedNot reportedNot reported
Debianlxmlsourcetrixie(unfixed)not yet assignedNot reportedNot reported
Debianlxmlsourcebookworm4.9.2-1+deb12u1not yet assignedNot reportedNot reported
CpelxmlcpeNot reported6.1.0Not reportedNot reportedNot reported
PyPIlxmlPyPINot reported6.1.0Not reportedGHSA-VFMQ-68HX-4JFWNot reported
Ubuntulxmldebnoble5.2.1-1ubuntu0.2Not reportedNot reportedNot reported
Ubuntupython-lxml-docdebnoble5.2.1-1ubuntu0.2Not reportedNot reportedNot reported
Ubuntupython3-lxmldebnoble5.2.1-1ubuntu0.2Not reportedNot reportedNot reported
Ubuntulxmldebpro4.5.0-1ubuntu0.5+esm1Not reportedUSN-8897-1Not reported
Ubuntulxmldeb22.044.8.0-1ubuntu0.1Not reportedUSN-8897-1Not reported
Ubuntulxmldeb24.045.2.1-1ubuntu0.2Not reportedUSN-8897-1Not reported
Ubuntulxmldeb26.046.0.2-1ubuntu0.1Not reportedUSN-8897-1Not reported
Ubuntulxmldebpro4.5.0-1ubuntu0.5+esm1Not reportedUBUNTU-CVE-2026-41066Not reported
Ubuntulxmldeb22.044.8.0-1ubuntu0.1Not reportedUBUNTU-CVE-2026-41066Not reported
Ubuntulxmldeb24.045.2.1-1ubuntu0.2Not reportedUBUNTU-CVE-2026-41066Not reported
Ubuntulxmldeb26.046.0.2-1ubuntu0.1Not reportedUBUNTU-CVE-2026-41066Not reported
Alpinepy3-lxmlapk3.246.1.0-r0Not reportedALPINE-CVE-2026-41066Not reported
Susepython3-lxmlrpmlinux enterprise server ltss extended security 12 sp53.6.1-3.9.1Not reportedSUSE-SU-2026:2752-1Not reported
Susepython3-lxmlrpmlinux enterprise micro 5.54.9.1-150500.3.7.1Not reportedSUSE-SU-2026:2754-1Not reported
Susepython3-lxmlrpmlinux enterprise module for basesystem 15 sp74.9.1-150500.3.7.1Not reportedSUSE-SU-2026:2754-1Not reported
Susepython-lxmlrpmlinux enterprise module for python 3 15 sp74.9.3-150400.8.11.1Not reportedSUSE-SU-2026:2729-1Not reported
Susepython-lxmlrpmlinux enterprise server ltss extended security 12 sp53.6.1-8.8.1Not reportedSUSE-SU-2026:2728-1Not reported
Susepython-lxmlrpmlinux enterprise micro 5.34.7.1-150200.3.15.1Not reportedSUSE-SU-2026:2488-1Not reported
Susepython-lxmlrpmlinux enterprise micro 5.44.7.1-150200.3.15.1Not reportedSUSE-SU-2026:2488-1Not reported
Opensusepython-lxmlrpmtumbleweed6.1.0-1.1Not reportedOPENSUSE-SU-2026:10596-1Not reported

Notes

[trixie] lxml: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [python3-lxml]Affected

    Source package: [lxml]

    Details (2)

    • 4.9.2-1+b1 · amd64 · bookworm

      Affected · Fixed: 4.9.2-1+deb12u1

      nvd · lxml · debian · bookworm; nvd · lxml · debian · 12

    • 4.9.2-1+b1 · arm64 · bookworm

      Affected · Fixed: 4.9.2-1+deb12u1

      nvd · lxml · debian · bookworm; nvd · lxml · debian · 12

  • [python-lxml-doc]Affected

    Source package: [lxml]

    Details (2)

    • 4.9.2-1 · all · bookworm

      Affected · Fixed: 4.9.2-1+deb12u1

      nvd · lxml · debian · bookworm; nvd · lxml · debian · 12

    • 4.9.2-1 · all · bookworm

      Affected · Fixed: 4.9.2-1+deb12u1

      nvd · lxml · debian · bookworm; nvd · lxml · debian · 12

[Debian 13 (Trixie)]

  • [python3-lxml]Affected

    Source package: [lxml]

    Details (2)

    • 5.4.0-1 · amd64 · trixie

      Affected

      nvd · lxml · debian · 13

    • 5.4.0-1 · arm64 · trixie

      Affected

      nvd · lxml · debian · 13

  • [python-lxml-doc]Affected

    Source package: [lxml]

    Details (2)

    • 5.4.0-1 · all · trixie

      Affected

      nvd · lxml · debian · 13

    • 5.4.0-1 · all · trixie

      Affected

      nvd · lxml · debian · 13

[openSUSE Tumbleweed]

  • [python313-lxml]Unknown

    Source package: [python-lxml]

    Details (1)

    • 6.1.1-2.2 · x86_64 · tumbleweed

      Unknown · Fixed: 6.1.0-1.1

      Version impact unknown

      nvd · python-lxml · opensuse · tumbleweed

  • [python313-lxml-devel]Unknown

    Source package: [python-lxml]

    Details (1)

    • 6.1.1-2.2 · x86_64 · tumbleweed

      Unknown · Fixed: 6.1.0-1.1

      Version impact unknown

      nvd · python-lxml · opensuse · tumbleweed

  • [python314-lxml]Unknown

    Source package: [python-lxml]

    Details (1)

    • 6.1.1-2.2 · x86_64 · tumbleweed

      Unknown · Fixed: 6.1.0-1.1

      Version impact unknown

      nvd · python-lxml · opensuse · tumbleweed

  • [python314-lxml-devel]Unknown

    Source package: [python-lxml]

    Details (1)

    • 6.1.1-2.2 · x86_64 · tumbleweed

      Unknown · Fixed: 6.1.0-1.1

      Version impact unknown

      nvd · python-lxml · opensuse · tumbleweed

  • [python-lxml-doc]Unknown

    Source package: [python-lxml]

    Details (1)

    • 6.1.1-2.2 · noarch · tumbleweed

      Unknown · Fixed: 6.1.0-1.1

      Version impact unknown

      nvd · python-lxml · opensuse · tumbleweed

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]