Backport upstream commit 059abf5f to fix CVE-2026-8177, an
out-of-bounds UTF-8 read in domParseChar(). The patch replaces
the vulnerable domParseChar() function with libxml2's
xmlValidateName() to prevent heap reads past the NUL terminator
on truncated or malformed multi-byte UTF-8 sequences, and adds
65 regression tests covering the affected DOM entry points.
CVE: CVE-2026-8177
Upstream patches:
- 059abf5f93.patch
Resolves: RHEL-186536
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
