CVE-2025-11731

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-11731", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2025-10-14T05:28:37.404Z", "datePublished": "2025-10-14T06:02:35.519Z", "dateUpdated": "2026-11-06T14:45:38.084Z"}, "containers": {"cna": {"title": "Libxslt: type confusion in exsltfuncresultcompfunction of libxslt", "metrics": [{"other": {"content": {"value": "Low", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 3.1, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "A flaw was found in the exsltFuncResultComp() function of libxslt, which handles EXSLT <func:result> elements during stylesheet parsing. Due to improper type handling, the function may treat an XML document node as a regular XML element node, resulting in a type confusion. This can cause unexpected memory reads and potential crashes. While difficult to exploit, the flaw could lead to application instability or denial of service."}], "affected": [{"versions": [{"status": "affected", "version": "0", "lessThan": "1.1.44", "versionType": "semver"}], "packageName": "libxslt", "collectionURL": "https://gitlab.gnome.org/GNOME/libxslt", "defaultStatus": "unaffected"}, {"vendor": "Red Hat", "product": "Red Hat Hardened Images", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "libxslt-main", "defaultStatus": "affected", "versions": [{"version": "1.1.45-0.1.hum1", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:hummingbird:1"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "libxslt", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:enterprise_linux:10"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 6", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "libxslt", "defaultStatus": "unknown", "cpes": ["cpe:/o:redhat:rhel_els:6"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 7", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "libxslt", "defaultStatus": "affected", "cpes": ["cpe:/o:redhat:rhel_els:7"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "libxslt", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:enterprise_linux:8"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "libxslt", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:enterprise_linux:9"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "openshift/ose-rhel-coreos-8", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:openshift:4"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "openshift/ose-rhel-coreos-9", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:openshift:4"]}], "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:11015", "name": "RHSA-2026:11015", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/security/cve/CVE-2025-11731", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2403688", "name": "RHBZ#2403688", "tags": ["issue-tracking", "x_refsource_REDHAT"]}, {"url": "https://gitlab.gnome.org/GNOME/libxslt/-/issues/151"}, {"url": "https://gitlab.gnome.org/GNOME/libxslt/-/merge_requests/78"}], "datePublic": "2025-10-14T00:00:00.000Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-843", "description": "Access of Resource Using Incompatible Type", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-843: Access of Resource Using Incompatible Type", "workarounds": [{"lang": "en", "value": "Mitigation for this issue is either not available or the currently available options don\u2019t meet the Red Hat Product Security criteria comprising ease of use, applicability to a widespread installation base, or stability."}], "timeline": [{"lang": "en", "time": "2025-10-14T05:24:09.808Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2025-10-14T00:00:00.000Z", "value": "Made public."}], "credits": [{"lang": "en", "value": "Red Hat would like to thank Google Big Sleep for reporting this issue."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-11-06T14:45:38.084Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-14T15:18:32.705297Z", "id": "CVE-2025-11731", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-14T15:18:44.086Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-11731", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-14T15:18:32.705297Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-14T15:18:39.195Z"}}], "cna": {"title": "Libxslt: type confusion in exsltfuncresultcompfunction of libxslt", "credits": [{"lang": "en", "value": "Red Hat would like to thank Google Big Sleep for reporting this issue."}], "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Low", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.1, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"versions": [{"status": "affected", "version": "0", "lessThan": "1.1.44", "versionType": "semver"}], "packageName": "libxslt", "collectionURL": "https://gitlab.gnome.org/GNOME/libxslt", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:hummingbird:1"], "vendor": "Red Hat", "product": "Red Hat Hardened Images", "versions": [{"status": "unaffected", "version": "1.1.45-0.1.hum1", "lessThan": "*", "versionType": "rpm"}], "packageName": "libxslt-main", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:enterprise_linux:10"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "packageName": "libxslt", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:rhel_els:6"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 6", "packageName": "libxslt", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unknown"}, {"cpes": ["cpe:/o:redhat:rhel_els:7"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 7", "packageName": "libxslt", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:enterprise_linux:8"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", "packageName": "libxslt", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:enterprise_linux:9"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "packageName": "libxslt", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift:4"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4", "packageName": "openshift/ose-rhel-coreos-8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift:4"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4", "packageName": "openshift/ose-rhel-coreos-9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}], "timeline": [{"lang": "en", "time": "2025-10-14T05:24:09.808Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2025-10-14T00:00:00.000Z", "value": "Made public."}], "datePublic": "2025-10-14T00:00:00.000Z", "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:11015", "name": "RHSA-2026:11015", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/security/cve/CVE-2025-11731", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2403688", "name": "RHBZ#2403688", "tags": ["issue-tracking", "x_refsource_REDHAT"]}, {"url": "https://gitlab.gnome.org/GNOME/libxslt/-/issues/151"}, {"url": "https://gitlab.gnome.org/GNOME/libxslt/-/merge_requests/78"}], "workarounds": [{"lang": "en", "value": "Mitigation for this issue is either not available or the currently available options don\u2019t meet the Red Hat Product Security criteria comprising ease of use, applicability to a widespread installation base, or stability."}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "A flaw was found in the exsltFuncResultComp() function of libxslt, which handles EXSLT <func:result> elements during stylesheet parsing. Due to improper type handling, the function may treat an XML document node as a regular XML element node, resulting in a type confusion. This can cause unexpected memory reads and potential crashes. While difficult to exploit, the flaw could lead to application instability or denial of service."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-843", "description": "Access of Resource Using Incompatible Type"}]}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-11-06T14:45:38.084Z"}, "x_redhatCweChain": "CWE-843: Access of Resource Using Incompatible Type"}}, "cveMetadata": {"cveId": "CVE-2025-11731", "state": "PUBLISHED", "dateUpdated": "2026-11-06T14:45:38.084Z", "dateReserved": "2025-10-14T05:28:37.404Z", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "datePublished": "2025-10-14T06:02:35.519Z", "assignerShortName": "redhat"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://gitlab.gnome.org/GNOME/libxslt", "defaultStatus": "unaffected", "packageName": "libxslt", "versions": [{"lessThan": "1.1.44", "status": "affected", "version": "0", "versionType": "semver"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:hummingbird:1"], "defaultStatus": "affected", "packageName": "libxslt-main", "product": "Red Hat Hardened Images", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1.1.45-0.1.hum1", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:10"], "defaultStatus": "affected", "packageName": "libxslt", "product": "Red Hat Enterprise Linux 10", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:rhel_els:6"], "defaultStatus": "unknown", "packageName": "libxslt", "product": "Red Hat Enterprise Linux 6", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:rhel_els:7"], "defaultStatus": "affected", "packageName": "libxslt", "product": "Red Hat Enterprise Linux 7", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:8"], "defaultStatus": "affected", "packageName": "libxslt", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:9"], "defaultStatus": "affected", "packageName": "libxslt", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift:4"], "defaultStatus": "affected", "packageName": "openshift/ose-rhel-coreos-8", "product": "Red Hat OpenShift Container Platform 4", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift:4"], "defaultStatus": "affected", "packageName": "openshift/ose-rhel-coreos-9", "product": "Red Hat OpenShift Container Platform 4", "vendor": "Red Hat"}], "source": "secalert@redhat.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw was found in the exsltFuncResultComp() function of libxslt, which handles EXSLT <func:result> elements during stylesheet parsing. Due to improper type handling, the function may treat an XML document node as a regular XML element node, resulting in a type confusion. This can cause unexpected memory reads and potential crashes. While difficult to exploit, the flaw could lead to application instability or denial of service."}, {"lang": "es", "value": "Se encontr\u00f3 un fallo en la funci\u00f3n exsltFuncResultComp() de libxslt, que maneja los elementos EXSLT <func:result> durante el an\u00e1lisis de hojas de estilo. Debido a un manejo de tipos incorrecto, la funci\u00f3n puede tratar un nodo de documento XML como un nodo de elemento XML regular, lo que resulta en una confusi\u00f3n de tipos. Esto puede causar lecturas de memoria inesperadas y posibles bloqueos. Aunque dif\u00edcil de explotar, el fallo podr\u00eda provocar inestabilidad en la aplicaci\u00f3n o denegaci\u00f3n de servicio."}], "id": "CVE-2025-11731", "lastModified": "2026-11-06T15:17:04.540", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 3.1, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 1.4, "source": "secalert@redhat.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-11731", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-14T15:18:32.705297Z", "version": "2.0.3"}}]}, "published": "2025-10-14T06:15:34.483", "references": [{"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:11015"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/security/cve/CVE-2025-11731"}, {"source": "secalert@redhat.com", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2403688"}, {"source": "secalert@redhat.com", "url": "https://gitlab.gnome.org/GNOME/libxslt/-/issues/151"}, {"source": "secalert@redhat.com", "url": "https://gitlab.gnome.org/GNOME/libxslt/-/merge_requests/78"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-843"}], "source": "secalert@redhat.com", "type": "Secondary"}]}

{"bugzilla": {"description": "libxslt: Type Confusion in exsltFuncResultCompfunction of libxslt", "id": "2403688", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2403688"}, "csaw": false, "cvss3": {"cvss3_base_score": "3.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L", "status": "draft"}, "cwe": "CWE-843", "details": ["A flaw was found in the exsltFuncResultComp() function of libxslt, which handles EXSLT <func:result> elements during stylesheet parsing. Due to improper type handling, the function may treat an XML document node as a regular XML element node, resulting in a type confusion. This can cause unexpected memory reads and potential crashes. While difficult to exploit, the flaw could lead to application instability or denial of service."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options don\u2019t meet the Red Hat Product Security criteria comprising ease of use, applicability to a widespread installation base, or stability."}, "name": "CVE-2025-11731", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "libxslt", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "libxslt", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "libxslt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "libxslt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "libxslt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "rhcos", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2025-10-14T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-11731\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-11731"], "statement": "The Red Hat Product Security team has rated this vulnerability as Low severity, given that exploitation only causes a crash and requires the processing of a specially crafted XSL stylesheet. There is no evidence of data corruption or code execution, but affected applications may experience denial-of-service conditions.", "threat_severity": "Low"}

{"analysis": {"en": {"generated_at": "2026-04-20T19:15:02.522990+00:00", "value": {"mitigation_remediation": ["Apply the latest Red\u00a0Hat update that includes a fixed libxslt package when it becomes available", "If a patch is not yet released, configure applications to reject or sanitize EXSLT <func:result> elements, or disable EXSLT processing for untrusted XSLT input", "No official CNA workaround is available; consider temporary measures such as disabling EXSLT processing where possible, noting limited applicability", "Continuously monitor application logs for unexpected crashes and implement additional hardening such as restricting stylesheet execution privileges"], "summary": {"action": "Monitor", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "Red\u00a0Hat Enterprise Linux 6, 7, 8, 9, 10, Red\u00a0Hat Hardened Images, and Red\u00a0Hat OpenShift Container Platform 4 are affected. No specific patch version details are provided; the defect exists in the default libxslt package shipped with these platforms.", "description_and_impact": "The vulnerability is a type confusion bug in the exsltFuncResultComp() function of libxslt, which processes EXSLT <func:result> elements during stylesheet parsing. It arises from improper type handling, causing an XML document node to be treated as a regular element node, leading to unintended memory reads. This flaw corresponds to CWE-843 (Incorrect Type Checking for a Pointer). The result may cause application instability or a denial of service but does not expose data or provide privileged access.", "risk_and_exploitability": "The CVSS score of 3.1 and an EPSS below 1% indicate a low severity and low probability of exploitation; the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker would need to supply a malicious XSLT stylesheet containing EXSLT <func:result> elements processed by libxslt within a running application, which is not trivial. If successfully triggered, the impact would be a denial of service through a crash, but the overall risk remains low due to the difficulty of crafting the necessary input and the limited scope of the vulnerability."}}}}, "created": "2026-04-20T19:15:15.053239+00:00", "updated": "2026-04-20T19:15:15.053250+00:00", "vendors": []}