Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 144

Export CSV
CVE-2008-3281

libxml2 denial of service

libxml2 2.6.32 and earlier does not properly detect recursion during entity expansion in an attribute value, which allows context-dependent attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document.

CVSS 3.1 · 6.5 Medium EPSS 2.5% KEV · Not listed
Vendors
Apple Canonical Debian and 4 more
Products
Iphone Os Safari Ubuntu Linux and 9 more
CVE-2008-3529

libxml2: long entity name heap buffer overflow

Heap-based buffer overflow in the xmlParseAttValueComplex function in parser.c in libxml2 before 2.7.0 allows context-dependent attackers to cause a denial of service (crash) or execute arbitrary code via a long XML entity name.

CVSS 2.0 · 10.0 Critical EPSS 23.4% KEV · Not listed
Vendors
Apple Canonical Debian and 2 more
Products
Iphone Os Mac Os X Safari and 4 more
CVE-2008-4226

libxml2: integer overflow leading to memory corruption in xmlSAX2Characters

Integer overflow in the xmlSAX2Characters function in libxml2 2.7.2 allows context-dependent attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a large XML document.

CVSS 2.0 · 10.0 Critical EPSS 4.1% KEV · Not listed
Vendors
Redhat Xmlsoft
Products
Enterprise Linux Libxml
CVE-2008-4409

libxml2: infinite loop when entity is used in entity definition

libxml2 2.7.0 and 2.7.1 does not properly handle "predefined entities definitions" in entities, which allows context-dependent attackers to cause a denial of service (memory consumption and application crash), as demonstrated by use of xmllint on a certain XML document, a different vulnerability than CVE-2003-1564 and CVE-2008-3281.

CVSS 2.0 · 5.0 Medium EPSS 8.5% KEV · Not listed
Vendors
Xmlsoft
Products
Libxml2
CVE-2009-2414

mingw32-libxml2: Stack overflow by parsing root XML element DTD definition

Stack consumption vulnerability in libxml2 2.5.10, 2.6.16, 2.6.26, 2.6.27, and 2.6.32, and libxml 1.8.17, allows context-dependent attackers to cause a denial of service (application crash) via a large depth of element declarations in a DTD, related to a function recursion, as demonstrated by the Codenomicon XML fuzzing framework.

CVSS 2.0 · 4.3 Medium EPSS 3.1% KEV · Not listed
Vendors
Redhat Xmlsoft
Products
Enterprise Linux Libxml Libxml2
CVE-2008-4225

libxml2: integer overflow leading to infinite loop in xmlBufferResize

Integer overflow in the xmlBufferResize function in libxml2 2.7.2 allows context-dependent attackers to cause a denial of service (infinite loop) via a large XML document.

CVSS 2.0 · 7.8 High EPSS 3.2% KEV · Not listed
Vendors
Redhat Xmlsoft
Products
Enterprise Linux Libxml
CVE-2004-0989

libxml2 various overflows

Multiple buffer overflows in libXML 2.6.12 and 2.6.13 (libxml2), and possibly other versions, may allow remote attackers to execute arbitrary code via (1) a long FTP URL that is not properly handled by the xmlNanoFTPScanURL function, (2) a long proxy URL containing FTP data that is not properly handled by the xmlNanoFTPScanProxy function, and other overflows related to manipulation of DNS length values, including (3) xmlNanoFTPConnect, (4) xmlNanoHTTPConnectHost, and (5) xmlNanoHTTPConnectHost.

CVSS 2.0 · 10.0 Critical EPSS 21.7% KEV · Not listed
Vendors
Redhat Trustix Ubuntu and 2 more
Products
Enterprise Linux Fedora Core Secure Linux and 4 more
CVE-2004-0110

libxml2 long URL causes SEGV

Buffer overflow in the (1) nanohttp or (2) nanoftp modules in XMLSoft Libxml 2 (Libxml2) 2.6.0 through 2.6.5 allow remote attackers to execute arbitrary code via a long URL.

CVSS 2.0 · 7.5 High EPSS 24.2% KEV · Not listed
Vendors
Redhat Sgi Xmlsoft
Products
Enterprise Linux Linux Propack and 2 more
CVE-2003-1564

libxml2: billion laughs DoS attack

libxml2, possibly before 2.5.0, does not properly detect recursion during entity expansion, which allows context-dependent attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, aka the "billion laughs attack."

CVSS 3.1 · 6.5 Medium EPSS 1.6% KEV · Not listed
Vendors
Redhat Xmlsoft
Products
Enterprise Linux Libxml2
CVE-2025-24855

libxslt: Use-After-Free in libxslt numbers.c

numbers.c in libxslt before 1.1.43 has a use-after-free because, in nested XPath evaluations, an XPath context node can be modified but never restored. This is related to xsltNumberFormatGetValue, xsltEvalXPathPredicate, xsltEvalXPathStringNs, and xsltComputeSortResultInternal.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Redhat Xmlsoft
Products
Enterprise Linux Openshift Rhel Aus and 5 more
CVE-2025-24928

libxml2: Stack-based buffer overflow in xmlSnprintfElements of libxml2

libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a stack-based buffer overflow in xmlSnprintfElements in valid.c. To exploit this, DTD validation must occur for an untrusted document or untrusted DTD. NOTE: this is similar to CVE-2017-9047.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Netapp Redhat Xmlsoft
Products
Active Iq Unified Manager H300s H300s Firmware and 25 more
CVE-2017-8872

libxml2: Out-of-bounds read in htmlParseTryOrFinish

The htmlParseTryOrFinish function in HTMLparser.c in libxml2 2.9.4 allows attackers to cause a denial of service (buffer over-read) or information disclosure.

CVSS 3.1 · 9.1 Critical EPSS 2.3% KEV · Not listed
Vendors
Xmlsoft
Products
Libxml2
CVE-2016-1762

libxml2: Heap-based buffer-overread in xmlNextChar

The xmlNextChar function in libxml2 before 2.9.4 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted XML document.

CVSS 3.1 · 8.1 High EPSS 6.1% KEV · Not listed
Vendors
Apple Canonical Debian and 3 more
Products
Iphone Os Mac Os X Safari and 14 more
CVE-2016-1834

libxml2: Heap-buffer-overflow in xmlStrncat

Heap-based buffer overflow in the xmlStrncat function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted XML document.

CVSS 3.1 · 7.8 High EPSS 4.6% KEV · Not listed
Vendors
Apple Canonical Debian and 3 more
Products
Iphone Os Mac Os X Tvos and 13 more
CVE-2016-3627

libxml2: stack exhaustion while parsing xml files in recovery mode

The xmlStringGetNodeList function in tree.c in libxml2 2.9.3 and earlier, when used in recovery mode, allows context-dependent attackers to cause a denial of service (infinite recursion, stack consumption, and application crash) via a crafted XML document.

CVSS 3.1 · 7.5 High EPSS 7.0% KEV · Not listed
Vendors
Canonical Debian Hp and 4 more
Products
Ubuntu Linux Debian Linux Icewall Federation Agent and 12 more
CVE-2017-5130

chromium-browser: heap overflow in libxml2

An integer overflow in xmlmemory.c in libxml2 before 2.9.5, as used in Google Chrome prior to 62.0.3202.62 and other products, allowed a remote attacker to potentially exploit heap corruption via a crafted XML file.

CVSS 3.1 · 8.8 High EPSS 2.7% KEV · Not listed
Vendors
Debian Google Redhat and 1 more
Products
Debian Linux Chrome Rhel Extras and 1 more
CVE-2024-40896

libxml2: XXE vulnerability

In libxml2 2.11 before 2.11.9, 2.12 before 2.12.9, and 2.13 before 2.13.3, the SAX parser can produce events for external entities even if custom SAX handlers try to override entity content (by setting "checked"). This makes classic XXE attacks possible.

CVSS 3.1 · 9.1 Critical EPSS 1.2% KEV · Not listed
Vendors
Netapp Redhat Xmlsoft
Products
H300s H300s Firmware H410c and 12 more
CVE-2022-2309

NULL Pointer Dereference in lxml/lxml

NULL Pointer Dereference allows attackers to cause a denial of service (or application crash). This only applies when lxml is used together with libxml2 2.9.10 through 2.9.14. libxml2 2.9.9 and earlier are not affected. It allows triggering crashes through forged input data, given a vulnerable code sequence in the application. The vulnerability is caused by the iterwalk function (also used by the canonicalize function). Such code shouldn't be in wide-spread use, given that parsing + iterwalk would usually be replaced with the more efficient iterparse function. However, an XML converter that serialises to C14N would also be vulnerable, for example, and there are legitimate use cases for this code sequence. If untrusted input is received (also remotely) and processed via iterwalk function, a crash can be triggered.

CVSS 3.1 · 7.5 High EPSS 2.4% KEV · Not listed
Vendors
Fedoraproject Lxml Redhat and 1 more
Products
Fedora Lxml Enterprise Linux and 1 more
CVE-2025-27113

libxml2: NULL Pointer Dereference in libxml2 xmlPatMatch

libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a NULL pointer dereference in xmlPatMatch in pattern.c.

CVSS 3.1 · 2.9 Low EPSS 1.1% KEV · Not listed
Vendors
Xmlsoft
Products
Libxml2
CVE-2024-56171

libxml2: Use-After-Free in libxml2

libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a use-after-free in xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables in xmlschemas.c. To exploit this, a crafted XML document must be validated against an XML schema with certain identity constraints, or a crafted XML schema must be used.

CVSS 3.1 · 7.8 High EPSS 1.2% KEV · Not listed
Vendors
Netapp Redhat Xmlsoft
Products
Active Iq Unified Manager H300s H300s Firmware and 25 more