Changes/Libxml215

Change Proposal Name libxml215

This is a proposed Change for Fedora Linux.
This document represents a proposed Change. As part of the Changes process, proposals are publicly announced in order to receive community feedback. This proposal will only be implemented if approved by the Fedora Engineering Steering Committee.

Summary

Update the libxml2 library from version 2.13.9 to 2.15.3. This release includes critical security fixes and requires a system-wide mass rebuild due to an ABI (soname) change. Additionally, this update marks the official deprecation of the libxml2 Python bindings, which are scheduled for removal in 2.16.

Owner

• Name: David King
• Email: amigadave@amigadave.com

Current status

• Targeted release: Fedora Linux 45
• Last updated: 2026-07-28
• Announced
• Discussion thread
• FESCo issue: #3628
• Tracker bug: <will be assigned by the Wrangler>
• Release notes tracker: <will be assigned by the Wrangler>

Detailed Description

The update to 2.15.3 is necessary to address several security vulnerabilities fixed only in version 2.15.2 and above. Version 2.14 introduces an ABI change, requiring all packages linked against libxml2 to be rebuilt.

Furthermore, upstream has deprecated the libxml2 Python bindings. While these remain present in 2.15.3, they are scheduled to be removed in 2.16. Fedora packages currently using these bindings must be ported to alternatives, such as python3-lxml or the standard library's xml.etree. Concretely, this will mean that the python3-libxml2 subpackage will be marked as deprecated.

Feedback

• There is uncertainty upstream about removal of the Python bindings, but the deprecated state currently remains: https://gitlab.gnome.org/GNOME/libxml2/-/work_items/891#note_2705350
• As dnf5 depends on libxml2, it was deemed necessary to add a compatibility package with the old ABI, and this was included with the open MR for the 2.15.3 update
• The proposal missed the deadline for incorporating into the mass rebuild, so FESCo requested fixing of all critical path packages during a targeted rebuild instead

Benefit to Fedora

• Security: Several security vulnerabilities, that are only fixed in 2.15.2 and above, are fixed in this release
• Modernization: Aligns Fedora with the latest upstream release, which sees security and bugfixes.

Scope

• Proposal owners:
  • Perform the libxml2 library update in Rawhide.
  • Perform a critical path rebuild and fix any broken packages
    • Notify affected maintainers
  • Deprecation Management:
    • Audit all packages in Fedora using python3-libxml2.
    • Notify maintainers of affected packages.
    • Provide guidance/patches for migrating to lxml or ElementTree.

• Other developers:
  • Critical path Rebuild: Maintainers of packages depending on libxml2 must ensure their packages rebuild successfully against the new ABI.
  • Migration: Maintainers of packages relying on the Python bindings in python3-libxml2 must begin porting their code to alternative libraries before the planned removal in 2.16.

• Release engineering: #13382
  • A rebuild of dependent packages will be required due to the ABI change.

• Policies and guidelines: N/A (not needed for this Change)

• Trademark approval: N/A (not needed for this Change)

• Alignment with the Fedora Strategy:

Upgrade/compatibility impact

• C ABI: Applications not rebuilt will fail to run due to the soname change.
• Python ABI: Although applications using the Python bindings will run, the applications will need to be ported to alternative APIs before libxml2 2.16 is released.

Early Testing (Optional)

Do you require 'QA Blueprint' support? N

Proposed MR for the package update to 2.15.3: https://src.fedoraproject.org/rpms/libxml2/pull-request/16

COPR with the proposed 2.15.3 libxml2 package included: https://copr.fedorainfracloud.org/coprs/amigadave/libxml215/

How To Test

There should be no user-visible changes to test, as the majority of the upstream changes are removing old and unused code in the libxml2 library. A mass rebuild of dependent packages is the most effective test, but testing that functionality using libxml2 in those packages still works as expected will be useful. The COPR including the updated libxml2 package can be used.

Dependencies

Preliminary list of packages depending on libxml2: approximately 600 binary packages, including many critical path packages.

Preliminary list of packages depending on python3-libxml2, which will be affected by the deprecation and eventual removal:

• beaker-client
• gnome-doc-utils
• imagefactory
• itstool
• koji-vm
• ovfenv
• python3-dmidecode
• python3-libxslt
• rteval
• setroubleshoot-server
• virt-manager-common

Contingency Plan

• Contingency mechanism:
  • ABI Breakage: If the mass rebuild is unsuccessful or reveals widespread, unresolvable issues, revert to 2.13.9.
  • Binding Deprecation: If a critical system package cannot be ported away from the libxml2 Python bindings in time, we will maintain the bindings in a separate legacy package (python3-libxml2-legacy) as a temporary measure until the migration is completed.
• Contingency deadline: Beta freeze
• Blocks release? Yes

Documentation

There were many removals and deprecations between 2.13.9 and 2.15.3, including:

• Removal of FTP, HTTP and LZMA support
• Removal of the libxml.m4 autoconf macros
• Deprecation of direct struct access, with many accessor functions added

In addition, many other bugfixes and security fixes were added, including:

• CVE-2026-1757 fix: Memory leak in xmllint Shell - shell.c
• CVE-2026-0990 fix: Prevent infinite recursion in xmlCatalogListXMLResolve
• CVE-2026-0992 fix: Exponential behavior when handling
• parser: Fix infinite loop in xmlCtxtParseContent
• CVE-2025-10911 libxslt related: Ignore next/prev of documents when traversing XPath
• CVE-2026-0989 fix: Add RelaxNG include limit