Total
116 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-86138 | 1 Xmlsoft | 1 Libxml2 | 2026-09-15 | N/A | 6.9 MEDIUM |
| In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based buffer overflow. | |||||
| CVE-2026-86139 | 1 Xmlsoft | 1 Libxml2 | 2026-09-15 | N/A | 6.9 MEDIUM |
| In libxml2 before 2.15.4, xmlURIEscapeStr in uri.c has an integer overflow. | |||||
| CVE-2026-86140 | 1 Xmlsoft | 1 Libxml2 | 2026-09-15 | N/A | 8.0 HIGH |
| In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-based buffer overflow. | |||||
| CVE-2026-86141 | 1 Xmlsoft | 1 Libxml2 | 2026-09-15 | N/A | 2.9 LOW |
| xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup failure, i.e., it does not calculate a string length after NULL checking. | |||||
| CVE-2026-86142 | 1 Xmlsoft | 1 Libxml2 | 2026-09-15 | N/A | 6.9 MEDIUM |
| In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation. | |||||
| CVE-2026-86143 | 1 Xmlsoft | 1 Libxml2 | 2026-09-15 | N/A | 6.9 MEDIUM |
| In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks, aka a lack of a check for integer overflow before calling writecallback. This has security relevance for many types of uses of that length value within a callback. | |||||
| CVE-2026-86144 | 1 Xmlsoft | 1 Libxml2 | 2026-09-15 | N/A | 5.6 MEDIUM |
| In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, the XML_PARSE_NONET flag, if (without it) a custom resource loader accesses the internet and triggers XML external entity injection, SSRF, or a denial of service (e.g., for an attacker-controlled internet resource that is intentionally slow). | |||||
| CVE-2026-0992 | 3 Ibm, Redhat, Xmlsoft | 7 Aix, Vios, Enterprise Linux and 4 more | 2026-09-01 | N/A | 2.9 LOW |
| A flaw was found in the libxml2 library. This uncontrolled resource consumption vulnerability occurs when processing XML catalogs that contain repeated <nextCatalog> elements pointing to the same downstream catalog. A remote attacker can exploit this by supplying crafted catalogs, causing the parser to redundantly traverse catalog chains. This leads to excessive CPU consumption and degrades application availability, resulting in a denial-of-service condition. | |||||
| CVE-2026-0989 | 3 Ibm, Redhat, Xmlsoft | 7 Aix, Vios, Enterprise Linux and 4 more | 2026-09-01 | N/A | 3.7 LOW |
| A flaw was identified in the RelaxNG parser of libxml2 related to how external schema inclusions are handled. The parser does not enforce a limit on inclusion depth when resolving nested <include> directives. Specially crafted or overly complex schemas can cause excessive recursion during parsing. This may lead to stack exhaustion and application crashes, creating a denial-of-service risk. | |||||
| CVE-2026-0990 | 3 Ibm, Redhat, Xmlsoft | 7 Aix, Vios, Enterprise Linux and 4 more | 2026-09-01 | N/A | 5.9 MEDIUM |
| A flaw was found in libxml2, an XML parsing library. This uncontrolled recursion vulnerability occurs in the xmlCatalogXMLResolveURI function when an XML catalog contains a delegate URI entry that references itself. A remote attacker could exploit this configuration-dependent issue by providing a specially crafted XML catalog, leading to infinite recursion and call stack exhaustion. This ultimately results in a segmentation fault, causing a Denial of Service (DoS) by crashing affected applications. | |||||
| CVE-2025-8732 | 3 Ibm, Siemens, Xmlsoft | 5 Aix, Vios, Ruggedcom Rst2428p and 2 more | 2026-07-01 | 1.7 LOW | 3.3 LOW |
| A vulnerability was found in libxml2 up to 2.14.5. It has been declared as problematic. This vulnerability affects the function xmlParseSGMLCatalog of the component xmlcatalog. The manipulation leads to uncontrolled recursion. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The code maintainer explains, that "[t]he issue can only be triggered with untrusted SGML catalogs and it makes absolutely no sense to use untrusted catalogs. I also doubt that anyone is still using SGML catalogs at all." | |||||
| CVE-2025-32415 | 1 Xmlsoft | 1 Libxml2 | 2026-06-17 | N/A | 2.9 LOW |
| In libxml2 before 2.13.8 and 2.14.x before 2.14.2, xmlSchemaIDCFillNodeTables in xmlschemas.c has a heap-based buffer under-read. To exploit this, a crafted XML document must be validated against an XML schema with certain identity constraints, or a crafted XML schema must be used. | |||||
| CVE-2025-32414 | 1 Xmlsoft | 1 Libxml2 | 2026-06-17 | N/A | 5.6 MEDIUM |
| In libxml2 before 2.13.8 and 2.14.x before 2.14.2, out-of-bounds memory access can occur in the Python API (Python bindings) because of an incorrect return value. This occurs in xmlPythonFileRead and xmlPythonFileReadRaw because of a difference between bytes and characters. | |||||
| CVE-2025-27113 | 1 Xmlsoft | 1 Libxml2 | 2026-06-17 | N/A | 2.9 LOW |
| libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a NULL pointer dereference in xmlPatMatch in pattern.c. | |||||
| CVE-2025-24928 | 2 Netapp, Xmlsoft | 16 Active Iq Unified Manager, H300s, H300s Firmware and 13 more | 2026-06-17 | N/A | 7.8 HIGH |
| libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a stack-based buffer overflow in xmlSnprintfElements in valid.c. To exploit this, DTD validation must occur for an untrusted document or untrusted DTD. NOTE: this is similar to CVE-2017-9047. | |||||
| CVE-2024-56171 | 2 Netapp, Xmlsoft | 16 Active Iq Unified Manager, H300s, H300s Firmware and 13 more | 2026-06-17 | N/A | 7.8 HIGH |
| libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a use-after-free in xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables in xmlschemas.c. To exploit this, a crafted XML document must be validated against an XML schema with certain identity constraints, or a crafted XML schema must be used. | |||||
| CVE-2024-40896 | 2 Netapp, Xmlsoft | 14 H300s, H300s Firmware, H410c and 11 more | 2026-06-17 | N/A | 9.1 CRITICAL |
| In libxml2 2.11 before 2.11.9, 2.12 before 2.12.9, and 2.13 before 2.13.3, the SAX parser can produce events for external entities even if custom SAX handlers try to override entity content (by setting "checked"). This makes classic XXE attacks possible. | |||||
| CVE-2022-49043 | 1 Xmlsoft | 1 Libxml2 | 2026-06-17 | N/A | 8.1 HIGH |
| xmlXIncludeAddNode in xinclude.c in libxml2 before 2.11.0 has a use-after-free. | |||||
| CVE-2022-2309 | 3 Fedoraproject, Lxml, Xmlsoft | 3 Fedora, Lxml, Libxml2 | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| NULL Pointer Dereference allows attackers to cause a denial of service (or application crash). This only applies when lxml is used together with libxml2 2.9.10 through 2.9.14. libxml2 2.9.9 and earlier are not affected. It allows triggering crashes through forged input data, given a vulnerable code sequence in the application. The vulnerability is caused by the iterwalk function (also used by the canonicalize function). Such code shouldn't be in wide-spread use, given that parsing + iterwalk would usually be replaced with the more efficient iterparse function. However, an XML converter that serialises to C14N would also be vulnerable, for example, and there are legitimate use cases for this code sequence. If untrusted input is received (also remotely) and processed via iterwalk function, a crash can be triggered. | |||||
| CVE-2018-9251 | 2 Debian, Xmlsoft | 2 Debian Linux, Libxml2 | 2026-06-17 | 2.6 LOW | 5.3 MEDIUM |
| The xz_decomp function in xzlib.c in libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-8035. | |||||