CVE-2025-49796

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-49796", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2025-06-10T22:17:05.287Z", "datePublished": "2025-06-16T15:14:28.251Z", "dateUpdated": "2026-11-04T21:35:59.677Z"}, "containers": {"cna": {"title": "Libxml: type confusion leads to denial of service (dos)", "metrics": [{"other": {"content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in libxml2. Processing certain sch:name elements from the input XML file can trigger a memory corruption issue. This flaw allows an attacker to craft a malicious XML input file that can lead libxml to crash, resulting in a denial of service or other possible undefined behavior due to sensitive data being corrupted in memory."}], "affected": [{"versions": [{"status": "affected", "version": "0", "lessThan": "2.15.0", "versionType": "semver"}], "packageName": "libxml2", "collectionURL": "https://gitlab.gnome.org/GNOME/libxml2/", "defaultStatus": "unaffected"}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "libxml2", "defaultStatus": "affected", "versions": [{"version": "0:2.12.5-7.el10_0", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/o:redhat:enterprise_linux:10.0"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "libxml2", "defaultStatus": "affected", "versions": [{"version": "0:2.9.1-6.el7_9.10", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/o:redhat:rhel_els:7"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "libxml2", "defaultStatus": "affected", "versions": [{"version": "0:2.9.7-21.el8_10.1", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:enterprise_linux:8::appstream", "cpe:/o:redhat:enterprise_linux:8::baseos"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "libxml2", "defaultStatus": "affected", "versions": [{"version": "0:2.9.7-21.el8_10.1", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:enterprise_linux:8::appstream", "cpe:/o:redhat:enterprise_linux:8::baseos"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8.2 Advanced Update Support", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "libxml2", "defaultStatus": "affected", "versions": [{"version": "0:2.9.7-9.el8_2.3", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:rhel_aus:8.2::appstream", "cpe:/o:redhat:rhel_aus:8.2::baseos"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "libxml2", "defaultStatus": "affected", "versions": [{"version": "0:2.9.7-9.el8_4.6", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:rhel_aus:8.4::appstream", "cpe:/a:redhat:rhel_eus_long_life:8.4::appstream", "cpe:/o:redhat:rhel_aus:8.4::baseos", "cpe:/o:redhat:rhel_eus_long_life:8.4::baseos"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "libxml2", "defaultStatus": "affected", "versions": [{"version": "0:2.9.7-9.el8_4.6", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:rhel_aus:8.4::appstream", "cpe:/a:redhat:rhel_eus_long_life:8.4::appstream", "cpe:/o:redhat:rhel_aus:8.4::baseos", "cpe:/o:redhat:rhel_eus_long_life:8.4::baseos"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "libxml2", "defaultStatus": "affected", "versions": [{"version": "0:2.9.7-13.el8_6.10", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:rhel_aus:8.6::appstream", "cpe:/a:redhat:rhel_e4s:8.6::appstream", "cpe:/a:redhat:rhel_tus:8.6::appstream", "cpe:/o:redhat:rhel_aus:8.6::baseos", "cpe:/o:redhat:rhel_e4s:8.6::baseos", "cpe:/o:redhat:rhel_tus:8.6::baseos"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8.6 Telecommunications Update Service", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "libxml2", "defaultStatus": "affected", "versions": [{"version": "0:2.9.7-13.el8_6.10", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:rhel_aus:8.6::appstream", "cpe:/a:redhat:rhel_e4s:8.6::appstream", "cpe:/a:redhat:rhel_tus:8.6::appstream", "cpe:/o:redhat:rhel_aus:8.6::baseos", "cpe:/o:redhat:rhel_e4s:8.6::baseos", "cpe:/o:redhat:rhel_tus:8.6::baseos"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "libxml2", "defaultStatus": "affected", "versions": [{"version": "0:2.9.7-13.el8_6.10", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:rhel_aus:8.6::appstream", "cpe:/a:redhat:rhel_e4s:8.6::appstream", "cpe:/a:redhat:rhel_tus:8.6::appstream", "cpe:/o:redhat:rhel_aus:8.6::baseos", "cpe:/o:redhat:rhel_e4s:8.6::baseos", "cpe:/o:redhat:rhel_tus:8.6::baseos"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "libxml2", "defaultStatus": "affected", "versions": [{"version": "0:2.9.7-16.el8_8.9", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:rhel_e4s:8.8::appstream", "cpe:/a:redhat:rhel_tus:8.8::appstream", "cpe:/o:redhat:rhel_e4s:8.8::baseos", "cpe:/o:redhat:rhel_tus:8.8::baseos"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "libxml2", "defaultStatus": "affected", "versions": [{"version": "0:2.9.7-16.el8_8.9", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:rhel_e4s:8.8::appstream", "cpe:/a:redhat:rhel_tus:8.8::appstream", "cpe:/o:redhat:rhel_e4s:8.8::baseos", "cpe:/o:redhat:rhel_tus:8.8::baseos"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "libxml2", "defaultStatus": "affected", "versions": [{"version": "0:2.9.13-10.el9_6", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:enterprise_linux:9::appstream", "cpe:/o:redhat:enterprise_linux:9::baseos"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "libxml2", "defaultStatus": "affected", "versions": [{"version": "0:2.9.13-10.el9_6", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:enterprise_linux:9::appstream", "cpe:/o:redhat:enterprise_linux:9::baseos"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "libxml2", "defaultStatus": "affected", "versions": [{"version": "0:2.9.13-1.el9_0.5", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:rhel_e4s:9.0::appstream", "cpe:/o:redhat:rhel_e4s:9.0::baseos"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "libxml2", "defaultStatus": "affected", "versions": [{"version": "0:2.9.13-3.el9_2.7", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:rhel_e4s:9.2::appstream", "cpe:/o:redhat:rhel_e4s:9.2::baseos"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9.4 Extended Update Support", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "libxml2", "defaultStatus": "affected", "versions": [{"version": "0:2.9.13-10.el9_4", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:rhel_eus:9.4::appstream", "cpe:/o:redhat:rhel_eus:9.4::baseos"]}, {"vendor": "Red Hat", "product": "Red Hat JBoss Core Services 2.4.62.SP2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected", "packageName": "libxml2", "cpes": ["cpe:/a:redhat:jboss_core_services:1.0"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.12", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "openshift/ose-rhel-coreos-8", "defaultStatus": "affected", "versions": [{"version": "412.86.202510291903-0", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:openshift:4.12::el8"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.13", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "openshift/ose-rhel-coreos-9", "defaultStatus": "affected", "versions": [{"version": "413.92.202510150118-0", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:openshift:4.13::el9"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.14", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "openshift/ose-rhel-coreos-9", "defaultStatus": "affected", "versions": [{"version": "414.92.202510211419-0", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:openshift:4.14::el9"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.15", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "openshift/ose-rhel-coreos-9", "defaultStatus": "affected", "versions": [{"version": "415.92.202609140326-0", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:openshift:4.15::el9"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.16", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "openshift/ose-rhel-coreos-9", "defaultStatus": "affected", "versions": [{"version": "416.94.202609011112-0", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:openshift:4.16::el9"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.17", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "openshift/ose-rhel-coreos-9", "defaultStatus": "affected", "versions": [{"version": "417.94.202510112152-0", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:openshift:4.17::el9"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.18", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "openshift/ose-rhel-coreos-9", "defaultStatus": "affected", "versions": [{"version": "418.94.202510230424-0", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:openshift:4.18::el9"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.19", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "openshift/ose-rhel-coreos-9", "defaultStatus": "affected", "versions": [{"version": "4.19.9.6.202510140714-0", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:openshift:4.19::el9"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.20", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "openshift/ose-rhel-coreos-9", "defaultStatus": "affected", "versions": [{"version": "4.20.9.6.202509251656-0", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:openshift:4.20::el9"]}, {"vendor": "Red Hat", "product": "Red Hat Web Terminal 1.11 on RHEL 9", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "web-terminal/web-terminal-rhel9-operator", "defaultStatus": "affected", "versions": [{"version": "1.11-19", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:webterminal:1.11::el9"]}, {"vendor": "Red Hat", "product": "Red Hat Web Terminal 1.11 on RHEL 9", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "web-terminal/web-terminal-tooling-rhel9", "defaultStatus": "affected", "versions": [{"version": "1.11-8", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:webterminal:1.11::el9"]}, {"vendor": "Red Hat", "product": "Red Hat Web Terminal 1.12 on RHEL 9", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "web-terminal/web-terminal-tooling-rhel9", "defaultStatus": "affected", "versions": [{"version": "1.12-4", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:webterminal:1.12::el9"]}, {"vendor": "Red Hat", "product": "RHOSS-1.36-RHEL-8", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "openshift-serverless-1/logic-data-index-ephemeral-rhel8", "defaultStatus": "affected", "versions": [{"version": "1.36.0-11", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:openshift_serverless:1.36::el8"]}, {"vendor": "Red Hat", "product": "RHOSS-1.36-RHEL-8", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "openshift-serverless-1/logic-data-index-postgresql-rhel8", "defaultStatus": "affected", "versions": [{"version": "1.36.0-11", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:openshift_serverless:1.36::el8"]}, {"vendor": "Red Hat", "product": "RHOSS-1.36-RHEL-8", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "openshift-serverless-1/logic-db-migrator-tool-rhel8", "defaultStatus": "affected", "versions": [{"version": "1.36.0-11", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:openshift_serverless:1.36::el8"]}, {"vendor": "Red Hat", "product": "RHOSS-1.36-RHEL-8", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "openshift-serverless-1/logic-jobs-service-ephemeral-rhel8", "defaultStatus": "affected", "versions": [{"version": "1.36.0-10", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:openshift_serverless:1.36::el8"]}, {"vendor": "Red Hat", "product": "RHOSS-1.36-RHEL-8", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "openshift-serverless-1/logic-jobs-service-postgresql-rhel8", "defaultStatus": "affected", "versions": [{"version": "1.36.0-10", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:openshift_serverless:1.36::el8"]}, {"vendor": "Red Hat", "product": "RHOSS-1.36-RHEL-8", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "openshift-serverless-1/logic-kn-workflow-cli-artifacts-rhel8", "defaultStatus": "affected", "versions": [{"version": "1.36.0-4", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:openshift_serverless:1.36::el8"]}, {"vendor": "Red Hat", "product": "RHOSS-1.36-RHEL-8", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "openshift-serverless-1/logic-management-console-rhel8", "defaultStatus": "affected", "versions": [{"version": "1.36.0-9", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:openshift_serverless:1.36::el8"]}, {"vendor": "Red Hat", "product": "RHOSS-1.36-RHEL-8", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "openshift-serverless-1/logic-operator-bundle", "defaultStatus": "affected", "versions": [{"version": "1.36.0-12", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:openshift_serverless:1.36::el8"]}, {"vendor": "Red Hat", "product": "RHOSS-1.36-RHEL-8", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "openshift-serverless-1/logic-rhel8-operator", "defaultStatus": "affected", "versions": [{"version": "1.36.0-18", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:openshift_serverless:1.36::el8"]}, {"vendor": "Red Hat", "product": "RHOSS-1.36-RHEL-8", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "openshift-serverless-1/logic-swf-builder-rhel8", "defaultStatus": "affected", "versions": [{"version": "1.36.0-11", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:openshift_serverless:1.36::el8"]}, {"vendor": "Red Hat", "product": "RHOSS-1.36-RHEL-8", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "openshift-serverless-1/logic-swf-devmode-rhel8", "defaultStatus": "affected", "versions": [{"version": "1.36.0-7", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:openshift_serverless:1.36::el8"]}, {"vendor": "Red Hat", "product": "cert-manager operator for Red Hat OpenShift 1.16", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "cert-manager/jetstack-cert-manager-rhel9", "defaultStatus": "affected", "versions": [{"version": "v1.16.5-1760515757", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:cert_manager:1.16::el9"]}, {"vendor": "Red Hat", "product": "OpenShift File Integrity Operator - FIO 1", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "compliance/openshift-file-integrity-rhel8-operator", "defaultStatus": "affected", "versions": [{"version": "v1.3", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:openshift_file_integrity_operator:1::el9"]}, {"vendor": "Red Hat", "product": "Red Hat Discovery 2", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "discovery/discovery-server-rhel9", "defaultStatus": "affected", "versions": [{"version": "2.0.1-1754478727", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:discovery:2::el9"]}, {"vendor": "Red Hat", "product": "Red Hat Hardened Images", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "libxml2-main", "defaultStatus": "affected", "versions": [{"version": "2.15.2-0.3.hum1", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:hummingbird:1"]}, {"vendor": "Red Hat", "product": "Red Hat Insights proxy 1.5", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "insights-proxy/insights-proxy-container-rhel9", "defaultStatus": "affected", "versions": [{"version": "1.5.5-1754504343", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:insights_proxy:1.5::el9"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 6", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "libxml2", "defaultStatus": "unknown", "cpes": ["cpe:/o:redhat:rhel_els:6"]}], "references": [{"url": "https://access.redhat.com/errata/RHSA-2025:10630", "name": "RHSA-2025:10630", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:10698", "name": "RHSA-2025:10698", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:10699", "name": "RHSA-2025:10699", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:11580", "name": "RHSA-2025:11580", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:12098", "name": "RHSA-2025:12098", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:12099", "name": "RHSA-2025:12099", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:12199", "name": "RHSA-2025:12199", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:12237", "name": "RHSA-2025:12237", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:12239", "name": "RHSA-2025:12239", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:12240", "name": "RHSA-2025:12240", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:12241", "name": "RHSA-2025:12241", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:13267", "name": "RHSA-2025:13267", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:13335", "name": "RHSA-2025:13335", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:15397", "name": "RHSA-2025:15397", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:15827", "name": "RHSA-2025:15827", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:15828", "name": "RHSA-2025:15828", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:18217", "name": "RHSA-2025:18217", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:18218", "name": "RHSA-2025:18218", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:18219", "name": "RHSA-2025:18219", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:18240", "name": "RHSA-2025:18240", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:19020", "name": "RHSA-2025:19020", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:19041", "name": "RHSA-2025:19041", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:19046", "name": "RHSA-2025:19046", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:19894", "name": "RHSA-2025:19894", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:21913", "name": "RHSA-2025:21913", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:0934", "name": "RHSA-2026:0934", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:62549", "name": "RHSA-2026:62549", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:67857", "name": "RHSA-2026:67857", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:7519", "name": "RHSA-2026:7519", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/security/cve/CVE-2025-49796", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2372385", "name": "RHBZ#2372385", "tags": ["issue-tracking", "x_refsource_REDHAT"]}, {"url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/933"}], "datePublic": "2025-06-11T00:00:00.000Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-125", "description": "Out-of-bounds Read", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-125: Out-of-bounds Read", "workarounds": [{"lang": "en", "value": "There's no available mitigation other than to avoid processing untrusted XML documents if the user is unable/unwilling to update the library."}], "timeline": [{"lang": "en", "time": "2025-06-12T00:35:26.470Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2025-06-11T00:00:00.000Z", "value": "Made public."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-11-04T21:35:59.677Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-06-16T15:32:55.790163Z", "id": "CVE-2025-49796", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-16T15:33:08.296Z"}}, {"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/07/msg00014.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T20:05:26.711Z"}}, {"x_adpType": "supplier", "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-06-02T13:00:27.145Z"}, "affected": [{"vendor": "Siemens", "product": "RUGGEDCOM ROX MX5000", "versions": [{"status": "affected", "version": "0", "lessThan": "V2.17.1", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "RUGGEDCOM ROX MX5000RE", "versions": [{"status": "affected", "version": "0", "lessThan": "V2.17.1", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "RUGGEDCOM ROX RX1400", "versions": [{"status": "affected", "version": "0", "lessThan": "V2.17.1", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "RUGGEDCOM ROX RX1500", "versions": [{"status": "affected", "version": "0", "lessThan": "V2.17.1", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "RUGGEDCOM ROX RX1501", "versions": [{"status": "affected", "version": "0", "lessThan": "V2.17.1", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "RUGGEDCOM ROX RX1510", "versions": [{"status": "affected", "version": "0", "lessThan": "V2.17.1", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "RUGGEDCOM ROX RX1511", "versions": [{"status": "affected", "version": "0", "lessThan": "V2.17.1", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "RUGGEDCOM ROX RX1512", "versions": [{"status": "affected", "version": "0", "lessThan": "V2.17.1", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "RUGGEDCOM ROX RX1524", "versions": [{"status": "affected", "version": "0", "lessThan": "V2.17.1", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "RUGGEDCOM ROX RX1536", "versions": [{"status": "affected", "version": "0", "lessThan": "V2.17.1", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "RUGGEDCOM ROX RX5000", "versions": [{"status": "affected", "version": "0", "lessThan": "V2.17.1", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "RUGGEDCOM RST2428P", "versions": [{"status": "affected", "version": "0", "lessThan": "V4.0", "versionType": "custom"}], "defaultStatus": "unknown"}], "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-577017.html"}, {"url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/07/msg00014.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T20:05:26.711Z"}}, {"affected": [{"vendor": "Siemens", "product": "RUGGEDCOM ROX MX5000", "versions": [{"status": "affected", "version": "0", "lessThan": "V2.17.1", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "RUGGEDCOM ROX MX5000RE", "versions": [{"status": "affected", "version": "0", "lessThan": "V2.17.1", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "RUGGEDCOM ROX RX1400", "versions": [{"status": "affected", "version": "0", "lessThan": "V2.17.1", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "RUGGEDCOM ROX RX1500", "versions": [{"status": "affected", "version": "0", "lessThan": "V2.17.1", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "RUGGEDCOM ROX RX1501", "versions": [{"status": "affected", "version": "0", "lessThan": "V2.17.1", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "RUGGEDCOM ROX RX1510", "versions": [{"status": "affected", "version": "0", "lessThan": "V2.17.1", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "RUGGEDCOM ROX RX1511", "versions": [{"status": "affected", "version": "0", "lessThan": "V2.17.1", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "RUGGEDCOM ROX RX1512", "versions": [{"status": "affected", "version": "0", "lessThan": "V2.17.1", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "RUGGEDCOM ROX RX1524", "versions": [{"status": "affected", "version": "0", "lessThan": "V2.17.1", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "RUGGEDCOM ROX RX1536", "versions": [{"status": "affected", "version": "0", "lessThan": "V2.17.1", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "RUGGEDCOM ROX RX5000", "versions": [{"status": "affected", "version": "0", "lessThan": "V2.17.1", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "RUGGEDCOM RST2428P", "versions": [{"status": "affected", "version": "0", "lessThan": "V4.0", "versionType": "custom"}], "defaultStatus": "unknown"}], "x_adpType": "supplier", "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-577017.html"}, {"url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html"}], "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-06-02T13:00:27.145Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-49796", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-06-16T15:32:55.790163Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-16T15:32:58.396Z"}}], "cna": {"title": "Libxml: type confusion leads to denial of service (dos)", "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"versions": [{"status": "affected", "version": "0", "lessThan": "2.15.0", "versionType": "semver"}], "packageName": "libxml2", "collectionURL": "https://gitlab.gnome.org/GNOME/libxml2/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:10.0"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "versions": [{"status": "unaffected", "version": "0:2.12.5-7.el10_0", "lessThan": "*", "versionType": "rpm"}], "packageName": "libxml2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:rhel_els:7"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support", "versions": [{"status": "unaffected", "version": "0:2.9.1-6.el7_9.10", "lessThan": "*", "versionType": "rpm"}], "packageName": "libxml2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:enterprise_linux:8::appstream", "cpe:/o:redhat:enterprise_linux:8::baseos"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", "versions": [{"status": "unaffected", "version": "0:2.9.7-21.el8_10.1", "lessThan": "*", "versionType": "rpm"}], "packageName": "libxml2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:enterprise_linux:8::appstream", "cpe:/o:redhat:enterprise_linux:8::baseos"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", "versions": [{"status": "unaffected", "version": "0:2.9.7-21.el8_10.1", "lessThan": "*", "versionType": "rpm"}], "packageName": "libxml2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:rhel_aus:8.2::appstream", "cpe:/o:redhat:rhel_aus:8.2::baseos"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8.2 Advanced Update Support", "versions": [{"status": "unaffected", "version": "0:2.9.7-9.el8_2.3", "lessThan": "*", "versionType": "rpm"}], "packageName": "libxml2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:rhel_aus:8.4::appstream", "cpe:/a:redhat:rhel_eus_long_life:8.4::appstream", "cpe:/o:redhat:rhel_aus:8.4::baseos", "cpe:/o:redhat:rhel_eus_long_life:8.4::baseos"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support", "versions": [{"status": "unaffected", "version": "0:2.9.7-9.el8_4.6", "lessThan": "*", "versionType": "rpm"}], "packageName": "libxml2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:rhel_aus:8.4::appstream", "cpe:/a:redhat:rhel_eus_long_life:8.4::appstream", "cpe:/o:redhat:rhel_aus:8.4::baseos", "cpe:/o:redhat:rhel_eus_long_life:8.4::baseos"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On", "versions": [{"status": "unaffected", "version": "0:2.9.7-9.el8_4.6", "lessThan": "*", "versionType": "rpm"}], "packageName": "libxml2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:rhel_aus:8.6::appstream", "cpe:/a:redhat:rhel_e4s:8.6::appstream", "cpe:/a:redhat:rhel_tus:8.6::appstream", "cpe:/o:redhat:rhel_aus:8.6::baseos", "cpe:/o:redhat:rhel_e4s:8.6::baseos", "cpe:/o:redhat:rhel_tus:8.6::baseos"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support", "versions": [{"status": "unaffected", "version": "0:2.9.7-13.el8_6.10", "lessThan": "*", "versionType": "rpm"}], "packageName": "libxml2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:rhel_aus:8.6::appstream", "cpe:/a:redhat:rhel_e4s:8.6::appstream", "cpe:/a:redhat:rhel_tus:8.6::appstream", "cpe:/o:redhat:rhel_aus:8.6::baseos", "cpe:/o:redhat:rhel_e4s:8.6::baseos", "cpe:/o:redhat:rhel_tus:8.6::baseos"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8.6 Telecommunications Update Service", "versions": [{"status": "unaffected", "version": "0:2.9.7-13.el8_6.10", "lessThan": "*", "versionType": "rpm"}], "packageName": "libxml2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:rhel_aus:8.6::appstream", "cpe:/a:redhat:rhel_e4s:8.6::appstream", "cpe:/a:redhat:rhel_tus:8.6::appstream", "cpe:/o:redhat:rhel_aus:8.6::baseos", "cpe:/o:redhat:rhel_e4s:8.6::baseos", "cpe:/o:redhat:rhel_tus:8.6::baseos"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions", "versions": [{"status": "unaffected", "version": "0:2.9.7-13.el8_6.10", "lessThan": "*", "versionType": "rpm"}], "packageName": "libxml2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:rhel_e4s:8.8::appstream", "cpe:/a:redhat:rhel_tus:8.8::appstream", "cpe:/o:redhat:rhel_e4s:8.8::baseos", "cpe:/o:redhat:rhel_tus:8.8::baseos"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service", "versions": [{"status": "unaffected", "version": "0:2.9.7-16.el8_8.9", "lessThan": "*", "versionType": "rpm"}], "packageName": "libxml2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:rhel_e4s:8.8::appstream", "cpe:/a:redhat:rhel_tus:8.8::appstream", "cpe:/o:redhat:rhel_e4s:8.8::baseos", "cpe:/o:redhat:rhel_tus:8.8::baseos"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions", "versions": [{"status": "unaffected", "version": "0:2.9.7-16.el8_8.9", "lessThan": "*", "versionType": "rpm"}], "packageName": "libxml2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:enterprise_linux:9::appstream", "cpe:/o:redhat:enterprise_linux:9::baseos"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "versions": [{"status": "unaffected", "version": "0:2.9.13-10.el9_6", "lessThan": "*", "versionType": "rpm"}], "packageName": "libxml2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:enterprise_linux:9::appstream", "cpe:/o:redhat:enterprise_linux:9::baseos"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "versions": [{"status": "unaffected", "version": "0:2.9.13-10.el9_6", "lessThan": "*", "versionType": "rpm"}], "packageName": "libxml2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:rhel_e4s:9.0::appstream", "cpe:/o:redhat:rhel_e4s:9.0::baseos"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions", "versions": [{"status": "unaffected", "version": "0:2.9.13-1.el9_0.5", "lessThan": "*", "versionType": "rpm"}], "packageName": "libxml2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:rhel_e4s:9.2::appstream", "cpe:/o:redhat:rhel_e4s:9.2::baseos"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions", "versions": [{"status": "unaffected", "version": "0:2.9.13-3.el9_2.7", "lessThan": "*", "versionType": "rpm"}], "packageName": "libxml2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:rhel_eus:9.4::appstream", "cpe:/o:redhat:rhel_eus:9.4::baseos"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9.4 Extended Update Support", "versions": [{"status": "unaffected", "version": "0:2.9.13-10.el9_4", "lessThan": "*", "versionType": "rpm"}], "packageName": "libxml2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_core_services:1.0"], "vendor": "Red Hat", "product": "Red Hat JBoss Core Services 2.4.62.SP2", "packageName": "libxml2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:openshift:4.12::el8"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.12", "versions": [{"status": "unaffected", "version": "412.86.202510291903-0", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift/ose-rhel-coreos-8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift:4.13::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.13", "versions": [{"status": "unaffected", "version": "413.92.202510150118-0", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift/ose-rhel-coreos-9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift:4.14::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.14", "versions": [{"status": "unaffected", "version": "414.92.202510211419-0", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift/ose-rhel-coreos-9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift:4.15::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.15", "versions": [{"status": "unaffected", "version": "415.92.202609140326-0", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift/ose-rhel-coreos-9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift:4.16::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.16", "versions": [{"status": "unaffected", "version": "416.94.202609011112-0", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift/ose-rhel-coreos-9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift:4.17::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.17", "versions": [{"status": "unaffected", "version": "417.94.202510112152-0", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift/ose-rhel-coreos-9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift:4.18::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.18", "versions": [{"status": "unaffected", "version": "418.94.202510230424-0", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift/ose-rhel-coreos-9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift:4.19::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.19", "versions": [{"status": "unaffected", "version": "4.19.9.6.202510140714-0", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift/ose-rhel-coreos-9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift:4.20::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.20", "versions": [{"status": "unaffected", "version": "4.20.9.6.202509251656-0", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift/ose-rhel-coreos-9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:webterminal:1.11::el9"], "vendor": "Red Hat", "product": "Red Hat Web Terminal 1.11 on RHEL 9", "versions": [{"status": "unaffected", "version": "1.11-19", "lessThan": "*", "versionType": "rpm"}], "packageName": "web-terminal/web-terminal-rhel9-operator", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:webterminal:1.11::el9"], "vendor": "Red Hat", "product": "Red Hat Web Terminal 1.11 on RHEL 9", "versions": [{"status": "unaffected", "version": "1.11-8", "lessThan": "*", "versionType": "rpm"}], "packageName": "web-terminal/web-terminal-tooling-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:webterminal:1.12::el9"], "vendor": "Red Hat", "product": "Red Hat Web Terminal 1.12 on RHEL 9", "versions": [{"status": "unaffected", "version": "1.12-4", "lessThan": "*", "versionType": "rpm"}], "packageName": "web-terminal/web-terminal-tooling-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_serverless:1.36::el8"], "vendor": "Red Hat", "product": "RHOSS-1.36-RHEL-8", "versions": [{"status": "unaffected", "version": "1.36.0-11", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift-serverless-1/logic-data-index-ephemeral-rhel8", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_serverless:1.36::el8"], "vendor": "Red Hat", "product": "RHOSS-1.36-RHEL-8", "versions": [{"status": "unaffected", "version": "1.36.0-11", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift-serverless-1/logic-data-index-postgresql-rhel8", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_serverless:1.36::el8"], "vendor": "Red Hat", "product": "RHOSS-1.36-RHEL-8", "versions": [{"status": "unaffected", "version": "1.36.0-11", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift-serverless-1/logic-db-migrator-tool-rhel8", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_serverless:1.36::el8"], "vendor": "Red Hat", "product": "RHOSS-1.36-RHEL-8", "versions": [{"status": "unaffected", "version": "1.36.0-10", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift-serverless-1/logic-jobs-service-ephemeral-rhel8", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_serverless:1.36::el8"], "vendor": "Red Hat", "product": "RHOSS-1.36-RHEL-8", "versions": [{"status": "unaffected", "version": "1.36.0-10", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift-serverless-1/logic-jobs-service-postgresql-rhel8", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_serverless:1.36::el8"], "vendor": "Red Hat", "product": "RHOSS-1.36-RHEL-8", "versions": [{"status": "unaffected", "version": "1.36.0-4", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift-serverless-1/logic-kn-workflow-cli-artifacts-rhel8", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_serverless:1.36::el8"], "vendor": "Red Hat", "product": "RHOSS-1.36-RHEL-8", "versions": [{"status": "unaffected", "version": "1.36.0-9", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift-serverless-1/logic-management-console-rhel8", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_serverless:1.36::el8"], "vendor": "Red Hat", "product": "RHOSS-1.36-RHEL-8", "versions": [{"status": "unaffected", "version": "1.36.0-12", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift-serverless-1/logic-operator-bundle", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_serverless:1.36::el8"], "vendor": "Red Hat", "product": "RHOSS-1.36-RHEL-8", "versions": [{"status": "unaffected", "version": "1.36.0-18", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift-serverless-1/logic-rhel8-operator", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_serverless:1.36::el8"], "vendor": "Red Hat", "product": "RHOSS-1.36-RHEL-8", "versions": [{"status": "unaffected", "version": "1.36.0-11", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift-serverless-1/logic-swf-builder-rhel8", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_serverless:1.36::el8"], "vendor": "Red Hat", "product": "RHOSS-1.36-RHEL-8", "versions": [{"status": "unaffected", "version": "1.36.0-7", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift-serverless-1/logic-swf-devmode-rhel8", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:cert_manager:1.16::el9"], "vendor": "Red Hat", "product": "cert-manager operator for Red Hat OpenShift 1.16", "versions": [{"status": "unaffected", "version": "v1.16.5-1760515757", "lessThan": "*", "versionType": "rpm"}], "packageName": "cert-manager/jetstack-cert-manager-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_file_integrity_operator:1::el9"], "vendor": "Red Hat", "product": "OpenShift File Integrity Operator - FIO 1", "versions": [{"status": "unaffected", "version": "v1.3", "lessThan": "*", "versionType": "rpm"}], "packageName": "compliance/openshift-file-integrity-rhel8-operator", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:discovery:2::el9"], "vendor": "Red Hat", "product": "Red Hat Discovery 2", "versions": [{"status": "unaffected", "version": "2.0.1-1754478727", "lessThan": "*", "versionType": "rpm"}], "packageName": "discovery/discovery-server-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:hummingbird:1"], "vendor": "Red Hat", "product": "Red Hat Hardened Images", "versions": [{"status": "unaffected", "version": "2.15.2-0.3.hum1", "lessThan": "*", "versionType": "rpm"}], "packageName": "libxml2-main", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:insights_proxy:1.5::el9"], "vendor": "Red Hat", "product": "Red Hat Insights proxy 1.5", "versions": [{"status": "unaffected", "version": "1.5.5-1754504343", "lessThan": "*", "versionType": "rpm"}], "packageName": "insights-proxy/insights-proxy-container-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:rhel_els:6"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 6", "packageName": "libxml2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unknown"}], "timeline": [{"lang": "en", "time": "2025-06-12T00:35:26.470Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2025-06-11T00:00:00.000Z", "value": "Made public."}], "datePublic": "2025-06-11T00:00:00.000Z", "references": [{"url": "https://access.redhat.com/errata/RHSA-2025:10630", "name": "RHSA-2025:10630", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:10698", "name": "RHSA-2025:10698", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:10699", "name": "RHSA-2025:10699", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:11580", "name": "RHSA-2025:11580", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:12098", "name": "RHSA-2025:12098", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:12099", "name": "RHSA-2025:12099", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:12199", "name": "RHSA-2025:12199", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:12237", "name": "RHSA-2025:12237", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:12239", "name": "RHSA-2025:12239", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:12240", "name": "RHSA-2025:12240", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:12241", "name": "RHSA-2025:12241", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:13267", "name": "RHSA-2025:13267", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:13335", "name": "RHSA-2025:13335", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:15397", "name": "RHSA-2025:15397", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:15827", "name": "RHSA-2025:15827", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:15828", "name": "RHSA-2025:15828", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:18217", "name": "RHSA-2025:18217", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:18218", "name": "RHSA-2025:18218", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:18219", "name": "RHSA-2025:18219", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:18240", "name": "RHSA-2025:18240", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:19020", "name": "RHSA-2025:19020", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:19041", "name": "RHSA-2025:19041", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:19046", "name": "RHSA-2025:19046", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:19894", "name": "RHSA-2025:19894", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:21913", "name": "RHSA-2025:21913", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:0934", "name": "RHSA-2026:0934", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:62549", "name": "RHSA-2026:62549", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:67857", "name": "RHSA-2026:67857", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:7519", "name": "RHSA-2026:7519", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/security/cve/CVE-2025-49796", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2372385", "name": "RHBZ#2372385", "tags": ["issue-tracking", "x_refsource_REDHAT"]}, {"url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/933"}], "workarounds": [{"lang": "en", "value": "There's no available mitigation other than to avoid processing untrusted XML documents if the user is unable/unwilling to update the library."}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "A vulnerability was found in libxml2. Processing certain sch:name elements from the input XML file can trigger a memory corruption issue. This flaw allows an attacker to craft a malicious XML input file that can lead libxml to crash, resulting in a denial of service or other possible undefined behavior due to sensitive data being corrupted in memory."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "Out-of-bounds Read"}]}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-11-04T21:35:59.677Z"}, "x_redhatCweChain": "CWE-125: Out-of-bounds Read"}}, "cveMetadata": {"cveId": "CVE-2025-49796", "state": "PUBLISHED", "dateUpdated": "2026-11-04T21:35:59.677Z", "dateReserved": "2025-06-10T22:17:05.287Z", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "datePublished": "2025-06-16T15:14:28.251Z", "assignerShortName": "redhat"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://gitlab.gnome.org/GNOME/libxml2/", "defaultStatus": "unaffected", "packageName": "libxml2", "versions": [{"lessThan": "2.15.0", "status": "affected", "version": "0", "versionType": "semver"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:10.0"], "defaultStatus": "affected", "packageName": "libxml2", "product": "Red Hat Enterprise Linux 10", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.12.5-7.el10_0", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:rhel_els:7"], "defaultStatus": "affected", "packageName": "libxml2", "product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.9.1-6.el7_9.10", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:8::appstream", "cpe:/o:redhat:enterprise_linux:8::baseos"], "defaultStatus": "affected", "packageName": "libxml2", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.9.7-21.el8_10.1", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:8::appstream", "cpe:/o:redhat:enterprise_linux:8::baseos"], "defaultStatus": "affected", "packageName": "libxml2", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.9.7-21.el8_10.1", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_aus:8.2::appstream", "cpe:/o:redhat:rhel_aus:8.2::baseos"], "defaultStatus": "affected", "packageName": "libxml2", "product": "Red Hat Enterprise Linux 8.2 Advanced Update Support", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.9.7-9.el8_2.3", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_aus:8.4::appstream", "cpe:/a:redhat:rhel_eus_long_life:8.4::appstream", "cpe:/o:redhat:rhel_aus:8.4::baseos", "cpe:/o:redhat:rhel_eus_long_life:8.4::baseos"], "defaultStatus": "affected", "packageName": "libxml2", "product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.9.7-9.el8_4.6", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_aus:8.4::appstream", "cpe:/a:redhat:rhel_eus_long_life:8.4::appstream", "cpe:/o:redhat:rhel_aus:8.4::baseos", "cpe:/o:redhat:rhel_eus_long_life:8.4::baseos"], "defaultStatus": "affected", "packageName": "libxml2", "product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.9.7-9.el8_4.6", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_aus:8.6::appstream", "cpe:/a:redhat:rhel_e4s:8.6::appstream", "cpe:/a:redhat:rhel_tus:8.6::appstream", "cpe:/o:redhat:rhel_aus:8.6::baseos", "cpe:/o:redhat:rhel_e4s:8.6::baseos", "cpe:/o:redhat:rhel_tus:8.6::baseos"], "defaultStatus": "affected", "packageName": "libxml2", "product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.9.7-13.el8_6.10", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_aus:8.6::appstream", "cpe:/a:redhat:rhel_e4s:8.6::appstream", "cpe:/a:redhat:rhel_tus:8.6::appstream", "cpe:/o:redhat:rhel_aus:8.6::baseos", "cpe:/o:redhat:rhel_e4s:8.6::baseos", "cpe:/o:redhat:rhel_tus:8.6::baseos"], "defaultStatus": "affected", "packageName": "libxml2", "product": "Red Hat Enterprise Linux 8.6 Telecommunications Update Service", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.9.7-13.el8_6.10", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_aus:8.6::appstream", "cpe:/a:redhat:rhel_e4s:8.6::appstream", "cpe:/a:redhat:rhel_tus:8.6::appstream", "cpe:/o:redhat:rhel_aus:8.6::baseos", "cpe:/o:redhat:rhel_e4s:8.6::baseos", "cpe:/o:redhat:rhel_tus:8.6::baseos"], "defaultStatus": "affected", "packageName": "libxml2", "product": "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.9.7-13.el8_6.10", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_e4s:8.8::appstream", "cpe:/a:redhat:rhel_tus:8.8::appstream", "cpe:/o:redhat:rhel_e4s:8.8::baseos", "cpe:/o:redhat:rhel_tus:8.8::baseos"], "defaultStatus": "affected", "packageName": "libxml2", "product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.9.7-16.el8_8.9", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_e4s:8.8::appstream", "cpe:/a:redhat:rhel_tus:8.8::appstream", "cpe:/o:redhat:rhel_e4s:8.8::baseos", "cpe:/o:redhat:rhel_tus:8.8::baseos"], "defaultStatus": "affected", "packageName": "libxml2", "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.9.7-16.el8_8.9", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:9::appstream", "cpe:/o:redhat:enterprise_linux:9::baseos"], "defaultStatus": "affected", "packageName": "libxml2", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.9.13-10.el9_6", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:9::appstream", "cpe:/o:redhat:enterprise_linux:9::baseos"], "defaultStatus": "affected", "packageName": "libxml2", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.9.13-10.el9_6", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_e4s:9.0::appstream", "cpe:/o:redhat:rhel_e4s:9.0::baseos"], "defaultStatus": "affected", "packageName": "libxml2", "product": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.9.13-1.el9_0.5", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_e4s:9.2::appstream", "cpe:/o:redhat:rhel_e4s:9.2::baseos"], "defaultStatus": "affected", "packageName": "libxml2", "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.9.13-3.el9_2.7", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_eus:9.4::appstream", "cpe:/o:redhat:rhel_eus:9.4::baseos"], "defaultStatus": "affected", "packageName": "libxml2", "product": "Red Hat Enterprise Linux 9.4 Extended Update Support", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.9.13-10.el9_4", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_core_services:1.0"], "defaultStatus": "unaffected", "packageName": "libxml2", "product": "Red Hat JBoss Core Services 2.4.62.SP2", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift:4.12::el8"], "defaultStatus": "affected", "packageName": "openshift/ose-rhel-coreos-8", "product": "Red Hat OpenShift Container Platform 4.12", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "412.86.202510291903-0", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift:4.13::el9"], "defaultStatus": "affected", "packageName": "openshift/ose-rhel-coreos-9", "product": "Red Hat OpenShift Container Platform 4.13", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "413.92.202510150118-0", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift:4.14::el9"], "defaultStatus": "affected", "packageName": "openshift/ose-rhel-coreos-9", "product": "Red Hat OpenShift Container Platform 4.14", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "414.92.202510211419-0", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift:4.15::el9"], "defaultStatus": "affected", "packageName": "openshift/ose-rhel-coreos-9", "product": "Red Hat OpenShift Container Platform 4.15", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "415.92.202609140326-0", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift:4.16::el9"], "defaultStatus": "affected", "packageName": "openshift/ose-rhel-coreos-9", "product": "Red Hat OpenShift Container Platform 4.16", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "416.94.202609011112-0", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift:4.17::el9"], "defaultStatus": "affected", "packageName": "openshift/ose-rhel-coreos-9", "product": "Red Hat OpenShift Container Platform 4.17", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "417.94.202510112152-0", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift:4.18::el9"], "defaultStatus": "affected", "packageName": "openshift/ose-rhel-coreos-9", "product": "Red Hat OpenShift Container Platform 4.18", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "418.94.202510230424-0", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift:4.19::el9"], "defaultStatus": "affected", "packageName": "openshift/ose-rhel-coreos-9", "product": "Red Hat OpenShift Container Platform 4.19", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "4.19.9.6.202510140714-0", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift:4.20::el9"], "defaultStatus": "affected", "packageName": "openshift/ose-rhel-coreos-9", "product": "Red Hat OpenShift Container Platform 4.20", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "4.20.9.6.202509251656-0", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:webterminal:1.11::el9"], "defaultStatus": "affected", "packageName": "web-terminal/web-terminal-rhel9-operator", "product": "Red Hat Web Terminal 1.11 on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1.11-19", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:webterminal:1.11::el9"], "defaultStatus": "affected", "packageName": "web-terminal/web-terminal-tooling-rhel9", "product": "Red Hat Web Terminal 1.11 on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1.11-8", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:webterminal:1.12::el9"], "defaultStatus": "affected", "packageName": "web-terminal/web-terminal-tooling-rhel9", "product": "Red Hat Web Terminal 1.12 on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1.12-4", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_serverless:1.36::el8"], "defaultStatus": "affected", "packageName": "openshift-serverless-1/logic-data-index-ephemeral-rhel8", "product": "RHOSS-1.36-RHEL-8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1.36.0-11", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_serverless:1.36::el8"], "defaultStatus": "affected", "packageName": "openshift-serverless-1/logic-data-index-postgresql-rhel8", "product": "RHOSS-1.36-RHEL-8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1.36.0-11", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_serverless:1.36::el8"], "defaultStatus": "affected", "packageName": "openshift-serverless-1/logic-db-migrator-tool-rhel8", "product": "RHOSS-1.36-RHEL-8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1.36.0-11", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_serverless:1.36::el8"], "defaultStatus": "affected", "packageName": "openshift-serverless-1/logic-jobs-service-ephemeral-rhel8", "product": "RHOSS-1.36-RHEL-8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1.36.0-10", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_serverless:1.36::el8"], "defaultStatus": "affected", "packageName": "openshift-serverless-1/logic-jobs-service-postgresql-rhel8", "product": "RHOSS-1.36-RHEL-8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1.36.0-10", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_serverless:1.36::el8"], "defaultStatus": "affected", "packageName": "openshift-serverless-1/logic-kn-workflow-cli-artifacts-rhel8", "product": "RHOSS-1.36-RHEL-8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1.36.0-4", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_serverless:1.36::el8"], "defaultStatus": "affected", "packageName": "openshift-serverless-1/logic-management-console-rhel8", "product": "RHOSS-1.36-RHEL-8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1.36.0-9", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_serverless:1.36::el8"], "defaultStatus": "affected", "packageName": "openshift-serverless-1/logic-operator-bundle", "product": "RHOSS-1.36-RHEL-8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1.36.0-12", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_serverless:1.36::el8"], "defaultStatus": "affected", "packageName": "openshift-serverless-1/logic-rhel8-operator", "product": "RHOSS-1.36-RHEL-8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1.36.0-18", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_serverless:1.36::el8"], "defaultStatus": "affected", "packageName": "openshift-serverless-1/logic-swf-builder-rhel8", "product": "RHOSS-1.36-RHEL-8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1.36.0-11", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_serverless:1.36::el8"], "defaultStatus": "affected", "packageName": "openshift-serverless-1/logic-swf-devmode-rhel8", "product": "RHOSS-1.36-RHEL-8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1.36.0-7", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:cert_manager:1.16::el9"], "defaultStatus": "affected", "packageName": "cert-manager/jetstack-cert-manager-rhel9", "product": "cert-manager operator for Red Hat OpenShift 1.16", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "v1.16.5-1760515757", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_file_integrity_operator:1::el9"], "defaultStatus": "affected", "packageName": "compliance/openshift-file-integrity-rhel8-operator", "product": "OpenShift File Integrity Operator - FIO 1", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "v1.3", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:discovery:2::el9"], "defaultStatus": "affected", "packageName": "discovery/discovery-server-rhel9", "product": "Red Hat Discovery 2", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "2.0.1-1754478727", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:hummingbird:1"], "defaultStatus": "affected", "packageName": "libxml2-main", "product": "Red Hat Hardened Images", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "2.15.2-0.3.hum1", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:insights_proxy:1.5::el9"], "defaultStatus": "affected", "packageName": "insights-proxy/insights-proxy-container-rhel9", "product": "Red Hat Insights proxy 1.5", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1.5.5-1754504343", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:rhel_els:6"], "defaultStatus": "unknown", "packageName": "libxml2", "product": "Red Hat Enterprise Linux 6", "vendor": "Red Hat"}], "source": "secalert@redhat.com"}, {"affectedData": [{"defaultStatus": "unknown", "product": "RUGGEDCOM ROX MX5000", "vendor": "Siemens", "versions": [{"lessThan": "V2.17.1", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "RUGGEDCOM ROX MX5000RE", "vendor": "Siemens", "versions": [{"lessThan": "V2.17.1", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "RUGGEDCOM ROX RX1400", "vendor": "Siemens", "versions": [{"lessThan": "V2.17.1", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "RUGGEDCOM ROX RX1500", "vendor": "Siemens", "versions": [{"lessThan": "V2.17.1", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "RUGGEDCOM ROX RX1501", "vendor": "Siemens", "versions": [{"lessThan": "V2.17.1", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "RUGGEDCOM ROX RX1510", "vendor": "Siemens", "versions": [{"lessThan": "V2.17.1", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "RUGGEDCOM ROX RX1511", "vendor": "Siemens", "versions": [{"lessThan": "V2.17.1", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "RUGGEDCOM ROX RX1512", "vendor": "Siemens", "versions": [{"lessThan": "V2.17.1", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "RUGGEDCOM ROX RX1524", "vendor": "Siemens", "versions": [{"lessThan": "V2.17.1", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "RUGGEDCOM ROX RX1536", "vendor": "Siemens", "versions": [{"lessThan": "V2.17.1", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "RUGGEDCOM ROX RX5000", "vendor": "Siemens", "versions": [{"lessThan": "V2.17.1", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "RUGGEDCOM RST2428P", "vendor": "Siemens", "versions": [{"lessThan": "V4.0", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was found in libxml2. Processing certain sch:name elements from the input XML file can trigger a memory corruption issue. This flaw allows an attacker to craft a malicious XML input file that can lead libxml to crash, resulting in a denial of service or other possible undefined behavior due to sensitive data being corrupted in memory."}, {"lang": "es", "value": "Se encontr\u00f3 una vulnerabilidad en libxml2. El procesamiento de ciertos elementos sch:name del archivo XML de entrada puede provocar un problema de corrupci\u00f3n de memoria. Esta falla permite a un atacante manipular un archivo XML de entrada malicioso que puede provocar el bloqueo de libxml, lo que resulta en una denegaci\u00f3n de servicio u otro posible comportamiento indefinido debido a la corrupci\u00f3n de datos confidenciales en la memoria."}], "id": "CVE-2025-49796", "lastModified": "2026-11-04T22:17:37.073", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "secalert@redhat.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-49796", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-06-16T15:32:55.790163Z", "version": "2.0.3"}}]}, "published": "2025-06-16T16:15:19.370", "references": [{"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2025:10630"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2025:10698"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2025:10699"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2025:11580"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2025:12098"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2025:12099"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2025:12199"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2025:12237"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2025:12239"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2025:12240"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2025:12241"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2025:13267"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2025:13335"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2025:15397"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2025:15827"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2025:15828"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2025:18217"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2025:18218"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2025:18219"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2025:18240"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2025:19020"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2025:19041"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2025:19046"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2025:19894"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2025:21913"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:0934"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:62549"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:67857"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:7519"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/security/cve/CVE-2025-49796"}, {"source": "secalert@redhat.com", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2372385"}, {"source": "secalert@redhat.com", "url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/933"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2025/07/msg00014.html"}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html"}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-577017.html"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "secalert@redhat.com", "type": "Secondary"}]}

{"affected_release": [{"advisory": "RHSA-2025:10630", "cpe": "cpe:/o:redhat:enterprise_linux:10.0", "package": "libxml2-0:2.12.5-7.el10_0", "product_name": "Red Hat Enterprise Linux 10", "release_date": "2025-07-08T00:00:00Z"}, {"advisory": "RHSA-2025:10698", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "libxml2-0:2.9.7-21.el8_10.1", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2025-07-09T00:00:00Z"}, {"advisory": "RHSA-2025:10698", "cpe": "cpe:/o:redhat:enterprise_linux:8", "package": "libxml2-0:2.9.7-21.el8_10.1", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2025-07-09T00:00:00Z"}, {"advisory": "RHSA-2025:10699", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "libxml2-0:2.9.13-10.el9_6", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2025-07-09T00:00:00Z"}, {"advisory": "RHSA-2025:10699", "cpe": "cpe:/o:redhat:enterprise_linux:9", "package": "libxml2-0:2.9.13-10.el9_6", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2025-07-09T00:00:00Z"}], "bugzilla": {"description": "libxml: Type confusion leads to Denial of service (DoS)", "id": "2372385", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2372385"}, "csaw": false, "cvss3": {"cvss3_base_score": "9.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "status": "verified"}, "cwe": "CWE-125", "details": ["A vulnerability was found in libxml2. Processing certain sch:name elements from the input XML file can trigger a memory corruption issue. This flaw allows an attacker to craft a malicious XML input file that can lead libxml to crash, resulting in a denial of service or other possible undefined behavior due to sensitive data being corrupted in memory.", "A vulnerability was found in libxml2. Processing certain sch:name elements from the input XML file can trigger a memory corruption issue. This flaw allows an attacker to craft a malicious XML input file that can lead libxml to crash, resulting in a denial of service or other possible undefined behavior due to sensitive data being corrupted in memory."], "mitigation": {"lang": "en:us", "value": "There's no available mitigation other than to avoid processing untrusted XML documents before updating to the libxml version containing the fix."}, "name": "CVE-2025-49796", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "libxml2", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "libxml2", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/a:redhat:jboss_core_services:1", "fix_state": "Affected", "package_name": "libxml2", "product_name": "Red Hat JBoss Core Services"}], "public_date": "2025-06-11T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-49796\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-49796"], "statement": "The Red Hat Product Security team has evaluated this vulnerability as having an Important security impact, as libxml can be used to parse XML from the network depending on how the program consumes it using the library. Additionally, although the initial report shows a crash due to invalid memory access (A:H), other undefined issues that can present data integrity due to the application overwriting sensitive data are not discarded (I:H).", "threat_severity": "Important"}

{"analysis": {"en": {"generated_at": "2026-04-20T16:25:15.768740+00:00", "value": {"mitigation_remediation": ["Apply the Red\u202fHat errata updates (e.g., RHSA\u20112025:10630, RHSA\u20112025:10698, RHSA\u20112025:10699, etc.) that contain the libxml2 patch for all affected RHEL and OpenShift versions.", "If an immediate update is not possible, stop processing any XML that arrives from untrusted or external sources, as the workaround states that the only mitigation is to avoid parsing such data.", "Update deployments or container images that embed libxml2, redeploy services with the patched library, and monitor logs for crashes or abnormal memory usage to confirm the fix."], "summary": {"action": "Immediate Patch", "impact": "Denial of Service due to memory corruption"}, "threat_synthesis": {"affected_systems": "Red\u202fHat customers running libxml2 on multiple Red\u202fHat distributions and products are impacted, including Enterprise Linux 6, 7, 8, 9, 10, the Red\u202fHat Enterprise Linux Extended Update Supports (e.g., 8.2, 8.4, 8.6, 8.8, 9.0, 9.2, 9.4), the Red\u202fHat Hardened Images, RHOSS OpenShift and Serverless components (4.12 through 4.20), Red\u202fHat Discovery, Red\u202fHat Insights Proxy, Red\u202fHat JBoss Core Services, Red\u202fHat Web Terminal (1.11 and 1.12 on RHEL\u202f9), and the cert\u2011manager operator (1.16). All listed versions are mentioned in the referenced errata.", "description_and_impact": "A flaw in libxml2\u2019s handling of certain sch:name elements can corrupt memory. When an attacker supplies a tailored XML file, libxml processes it and may write beyond the bounds of the stack or heap, which causes the library to crash. The resulting denial of service is amplified by the possibility that sensitive data could also be overwritten, potentially exposing confidential information or enabling further exploitation if memory corruption is abused.", "risk_and_exploitability": "The CVSS score of 9.1 classifies this as critical, and the EPSS of 2% indicates a moderate likelihood that exploit code could surface. The vulnerability is not listed in the CISA KEV catalog, but the high CVSS and the impact on core XML processing libraries mean that any service parsing untrusted XML is at risk. The attack path evidently requires the attacker to supply or influence the XML content; once that is done, an out\u2011of\u2011bounds read (CWE\u2011125) leads to a crash, disabling the affected service."}}}}, "created": "2026-04-20T16:30:06.290641+00:00", "updated": "2026-04-20T16:30:06.290660+00:00", "vendors": []}