RHSA-2026:61235HighCVSS 7.4

Red Hat Security Advisory: xmlrpc-c security update

Published
August 31, 2026
Last Modified
November 5, 2026

🔗 CVE IDs covered (1)

CVE-2026-15928 →

📋 Description

CVE-2026-15928 — xmlrpc-c: XMLRPC-C Library: Cross-Site Scripting in error page component

🎯 Affected products44

  • Red Hat Enterprise Linux BaseOS E4S (v.8.8)
  • Red Hat Enterprise Linux BaseOS TUS (v.8.8)
  • xmlrpc-c-0:1.51.0-8.el8_8.2.i686 as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.8)
  • xmlrpc-c-0:1.51.0-8.el8_8.2.i686 as a component of Red Hat Enterprise Linux BaseOS TUS (v.8.8)
  • xmlrpc-c-0:1.51.0-8.el8_8.2.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.8)
  • xmlrpc-c-0:1.51.0-8.el8_8.2.src as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.8)
  • xmlrpc-c-0:1.51.0-8.el8_8.2.src as a component of Red Hat Enterprise Linux BaseOS TUS (v.8.8)
  • xmlrpc-c-0:1.51.0-8.el8_8.2.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.8)
  • xmlrpc-c-0:1.51.0-8.el8_8.2.x86_64 as a component of Red Hat Enterprise Linux BaseOS TUS (v.8.8)
  • xmlrpc-c-apps-debuginfo-0:1.51.0-8.el8_8.2.i686 as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.8)
  • xmlrpc-c-apps-debuginfo-0:1.51.0-8.el8_8.2.i686 as a component of Red Hat Enterprise Linux BaseOS TUS (v.8.8)
  • xmlrpc-c-apps-debuginfo-0:1.51.0-8.el8_8.2.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.8)
  • xmlrpc-c-apps-debuginfo-0:1.51.0-8.el8_8.2.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.8)
  • xmlrpc-c-apps-debuginfo-0:1.51.0-8.el8_8.2.x86_64 as a component of Red Hat Enterprise Linux BaseOS TUS (v.8.8)
  • xmlrpc-c-c++-debuginfo-0:1.51.0-8.el8_8.2.i686 as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.8)
  • xmlrpc-c-c++-debuginfo-0:1.51.0-8.el8_8.2.i686 as a component of Red Hat Enterprise Linux BaseOS TUS (v.8.8)
  • xmlrpc-c-c++-debuginfo-0:1.51.0-8.el8_8.2.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.8)
  • xmlrpc-c-c++-debuginfo-0:1.51.0-8.el8_8.2.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.8)
  • xmlrpc-c-c++-debuginfo-0:1.51.0-8.el8_8.2.x86_64 as a component of Red Hat Enterprise Linux BaseOS TUS (v.8.8)
  • xmlrpc-c-client++-debuginfo-0:1.51.0-8.el8_8.2.i686 as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.8)
  • xmlrpc-c-client++-debuginfo-0:1.51.0-8.el8_8.2.i686 as a component of Red Hat Enterprise Linux BaseOS TUS (v.8.8)
  • xmlrpc-c-client++-debuginfo-0:1.51.0-8.el8_8.2.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.8)
  • xmlrpc-c-client++-debuginfo-0:1.51.0-8.el8_8.2.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.8)
  • xmlrpc-c-client++-debuginfo-0:1.51.0-8.el8_8.2.x86_64 as a component of Red Hat Enterprise Linux BaseOS TUS (v.8.8)
  • xmlrpc-c-client-0:1.51.0-8.el8_8.2.i686 as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.8)
  • xmlrpc-c-client-0:1.51.0-8.el8_8.2.i686 as a component of Red Hat Enterprise Linux BaseOS TUS (v.8.8)
  • xmlrpc-c-client-0:1.51.0-8.el8_8.2.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.8)
  • xmlrpc-c-client-0:1.51.0-8.el8_8.2.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.8)
  • xmlrpc-c-client-0:1.51.0-8.el8_8.2.x86_64 as a component of Red Hat Enterprise Linux BaseOS TUS (v.8.8)
  • xmlrpc-c-client-debuginfo-0:1.51.0-8.el8_8.2.i686 as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.8)
  • +14 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: To mitigate this issue, ensure that applications utilizing the XMLRPC-C library do not directly expose its error pages to end-users via a web browser. Configure web servers or application frontends to intercept and sanitize or replace error responses originating from XMLRPC-C before they are rendered client-side. Alternatively, restrict XMLRPC-C deployments to backend services that do not present error output in a user-facing web interface.

🔗 References (4)