Add a patch to fix CVE-2026-24400 by enabling secure XML
parsing features in XmlStringPrettyFormatter. The patch
disables DOCTYPE declarations and external entity processing
to prevent XXE (XML External Entity) attacks. Backported from
upstream commit 77081dc5eb107141df80f95bd0149b468e451341,
adapted for the 3.24.2 source tree. Includes two new test
cases verifying that XML strings containing DOCTYPE with
general and parameter entities are properly rejected.
CVE: CVE-2026-24400
Upstream patches:
- 77081dc5eb.patch
Resolves: RHEL-208838
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
