From deed3b7873dff30b7f87f7f33154c9932a772522 Mon Sep 17 00:00:00 2001 From: Daniel Garcia Moreno Date: Sun, 18 Jan 2026 19:47:11 +0100 Subject: [PATCH] catalog: Do not check value for duplication nextCatalog The value field stores the path as it appears in the catalog definition, the URL is built using xmlBuildURI that changes the relative paths to absolute. This change fixes the issue of using relative path to the same catalog in the same file. Fix https://gitlab.gnome.org/GNOME/libxml2/-/issues/1040 CVE: CVE-2026-0992 Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libxml2/-/commit/deed3b7873dff30b7f87f7f33154c9932a772522] Signed-off-by: Peter Marko --- catalog.c | 1 - 1 file changed, 1 deletion(-) diff --git a/catalog.c b/catalog.c index eb889162..ba9ee7ae 100644 --- a/catalog.c +++ b/catalog.c @@ -1299,7 +1299,6 @@ xmlParseXMLCatalogNode(xmlNodePtr cur, xmlCatalogPrefer prefer, while (prev != NULL) { if ((prev->type == XML_CATA_NEXT_CATALOG) && (xmlStrEqual (prev->URL, entry->URL)) && - (xmlStrEqual (prev->value, entry->value)) && (prev->prefer == entry->prefer) && (prev->group == entry->group)) { if (xmlDebugCatalogs)