From libxml2-2.15.4:
+v2.15.4: Sep 01 2026 + +### Security + +- xmlregexp: Prevent out-of-bounds read in NXT macro +- fix: add missing overflow checks in dict.c, uri.c, and valid.c +- xmlregexp: Calc string length after null checking +- xpointer: Check overflow in xmlXPtrEvalXPtrPart +- xmlIO: Check for int overflow before calling writecallback +- fix(xinclude): propagate parseFlags in xmlXIncludeProcess and xmlXIncludeProcessTree + + [...]
I possess no further details.
sam
Nokogiri before 1.11.4 (CRuby implementation only, when the packaged/vendored libxml2 is used) bundles libxml2 2.9.10, which is affected by multiple vulnerabilities addressed in libxml2 2.9.12, including a memory leak in xmlSchemaValidateStream (CVE-2019-20388), a global buffer over-read in xmlEncodeEntitiesInternal (CVE-2020-24977), a heap-based buffer overflow (CVE-2021-3517), and an out-of-bounds read (CVE-2021-3518). Processing crafted XML documents may lead to denial of service, information disclosure, or memory corruption.
Uncontrolled recursion vulnerability in the xmlCatalogXMLResolveURI function of the libxml2 XML parsing library. The issue occurs when an XML catalog contains a delegate URI entry that references the catalog itself. During entity resolution, the function recursively resolves the same catalog entry without detecting the cyclic reference. This results in infinite recursion and eventual call stack exhaustion, leading to a segmentation fault. Exploitation is configuration-dependent and primarily impacts availability by allowing an attacker to crash affected applications.
Uncontrolled recursion vulnerability in the RelaxNG include handling logic of the libxml2 XML parsing library. The issue arises from the absence of limits on recursive <include> directive resolution. When a deeply nested chain of included RelaxNG schema files is processed, the parser enters unbounded recursion, eventually exhausting the system call stack. This results in a stack overflow and application crash. Exploitation requires attacker-controlled schema input and primarily impacts availability by causing a denial of service.
It was discovered that the libxml2 Python bindings incorrectly handled certain return values. An attacker could possibly use this issue to cause libxml2 to crash, resulting in a denial of service. (CVE-2025-32414) It was discovered that libxml2 incorrectly handled certain memory operations. A remote attacker could possibly use this issue to cause libxml2 to crash, resulting in a denial of service. (CVE-2025-32415)
These issues are fixed in 2.14.2 and 2.13.8. Older branches won't receive official updates.
[CVE-2025-32414] Buffer overflow when parsing text streams with Python API https://gitlab.gnome.org/GNOME/libxml2/-/issues/889
The Python Package Index contains an outdated and unsanctioned upload based on libxml2 2.9.5 which is vulnerable. I tried to inform the PyPI maintainers but I'm not sure my message made it through.
[CVE-2025-32415] Heap-based Buffer Overflow in xmlSchemaIDCFillNodeTables https://gitlab.gnome.org/GNOME/libxml2/-/issues/890
Nick
These issues are fixed in 2.12.10, 2.13.6 and the upcoming 2.14.0 release. Older branches won't receive official updates.
[CVE-2024-56171] Use-after-free in xmlSchemaIDCFillNodeTables https://gitlab.gnome.org/GNOME/libxml2/-/issues/828
[CVE-2025-24928] Stack-buffer-overflow in xmlSnprintfElements https://gitlab.gnome.org/GNOME/libxml2/-/issues/847
Null-deref in xmlPatMatch https://gitlab.gnome.org/GNOME/libxml2/-/issues/861
Nick
El vie, 14 feb 2025, 07:14, Nick Wellnhofer <wellnhofer () aevum de> escribió: On Feb 13, 2025, at 23:28, Daniel Gutson <danielgutson () gmail com> wrote: Curious: is there any info about how this was discovered? The bug was discovered with basic fuzz testing. As libxml2 maintainer, I found more and more issues in various iconv implementations by accident which is a strong indicator that all this code isn't tested enough. The iconv API is also trivial to fuzz, so it seemed like a nice weekend project. Thanks, AFL?
My work is related to static checkers and linters (we will contribute an important patch to weggli soon), so I was wondering if you used something that used symbolic execution.
Nice job! Nick
https://www.cve.org/CVERecord?id=CVE-2023-45322 was published today. It reports:
libxml2 through 2.11.5 has a use-after-free that can only occur after a certain memory allocation fails. This occurs in xmlUnlinkNode in tree.c. NOTE: the vendor's position is "I don't think these issues are critical enough to warrant a CVE ID ... because an attacker typically can't control when memory allocations fail."
The reproducer is attached to the upstream bug report at: https://gitlab.gnome.org/GNOME/libxml2/-/issues/583 and is run via "./libxml2/xmllint --copy --html --maxmem 315229 input.xml"
The fix is in the git master branch, but not yet any release: https://gitlab.gnome.org/GNOME/libxml2/-/commit/d39f78069dff496ec865c73aa44d7110e429bce9
-- -Alan Coopersmith- alan.coopersmith () oracle com Oracle Solaris Engineering - https://blogs.oracle.com/solaris
xmlsec is vulnerable to XML External Entity Expansion via libxml2 (see CVE-2016-9318). A workaround is in progress on the upstream bug report.
Upstream bug:
https://github.com/lsh123/xmlsec/issues/43
libxml2: out-of-bounds read
It was found that Red Hat JBoss Core Services incorrectly included CVE-2016-3705 as resolved in Apache HTTP 2.4.23 (erratum RHSA-2016:2957). The release did not include the fix to libxml2, leaving it vulnerable to a Denial of Service attack due to a Stack Overflow. This is a regression CVE for CVE-2016-3705.
It was found that Red Hat JBoss Core Services incorrectly fixed CVE-2016-3627 in Apache HTTP 2.4.23 (erratum RHSA-2016:2957), leaving libxml2 vulnerable to a Denial of Service attack via stack consumption.
A vulnerability was found in the libxml2 library. A heap-based buffer overread could happen in xmlNextChar.
References:
https://bugzilla.gnome.org/showbug.cgi?id=759671
Upstream fix:
https://git.gnome.org/browse/libxml2/commit/?id=a7a94612aa3b16779e2c74e1fa353b5d9786c602
A vulnerability was found in the libxml2 library. A heap-buffer-overflow could happen in xmlStrncat.
References:
https://bugzilla.gnome.org/showbug.cgi?id=763071
Upstream fix:
https://git.gnome.org/browse/libxml2/commit/?id=8fbbf5513d609c1770b391b99e33314cd0742704
A vulnerability was found in the libxml2 library. A heap-buffer overflow could happen in xmlFAParsePosCharGroup
References:
https://bugzilla.gnome.org/showbug.cgi?id=757711
Upstream fix:
https://git.gnome.org/browse/libxml2/commit/?id=cbb271655cadeb8dbb258a64701d9a3a0c4835b4
A vulnerability was found in the libxml2 library. A heap-based buffer overread could happen in xmlParserPrintFileContextInternal
References:
https://bugzilla.gnome.org/showbug.cgi?id=758588
Upstream fix:
https://git.gnome.org/browse/libxml2/commit/?id=db07dd613e461df93dde7902c6505629bf0734e9
A vulnerability was found in the libxml2 library. A heap-based buffer overread could happen in xmlDictAddString.
References:
https://bugzilla.gnome.org/showbug.cgi?id=758605
Upstream fix:
https://git.gnome.org/browse/libxml2/commit/?id=a820dbeac29d330bae4be05d9ecd939ad6b4aa33
A vulnerability was found in the libxml2 library. A heap-use-after free can happen in the xmlDictComputeFastKey.
References:
https://bugzilla.gnome.org/showbug.cgi?id=759398
Upstream fix:
https://git.gnome.org/browse/libxml2/commit/?id=45752d2c334b50016666d8f0ec3691e2d680f0a0
A vulnerability was found in the libxml2 library. The parser would fetch content of an external entity while not in validating mode.
References:
https://bugzilla.gnome.org/showbug.cgi?id=761430
Upstream fix:
https://git.gnome.org/browse/libxml2/commit/?id=b1d34de46a11323fccffa9fadeb33be670d602f5
A vulnerability was found in the libxml2 library. There exist a possible format string vulnerability.
https://bugzilla.gnome.org/showbug.cgi?id=761029
Upstream fixes:
https://git.gnome.org/browse/libxml2/commit/?id=4472c3a5a5b516aaf59b89be602fbce52756c3e9 https://git.gnome.org/browse/libxml2/commit/?id=502f6a6d08b08c04b3ddfb1cd21b2f699c1b7f5b
A vulnerability was found in the libxml2 library. A maliciously crafted file could cause the application to crash due to a Heap use-after-free in htmlParsePubidLiteral and htmlParseSystemiteral
References:
https://bugzilla.gnome.org/showbug.cgi?id=760263
Upstream fix:
https://git.gnome.org/browse/libxml2/commit/?id=11ed4a7a90d5ce156a18980a4ad4e53e77384852
A vulnerability was found in the libxml2 library. A maliciously crafted file could cause the application to crash due to a Heap use-after-free in xmlSAX2AttributeNs.
References:
https://bugzilla.gnome.org/showbug.cgi?id=759020
Upstream fix:
https://git.gnome.org/browse/libxml2/commit/?id=38eae571111db3b43ffdeb05487c9f60551906fb
A vulnerability was found in the libxml2 library. A maliciously crafted file could cause the application to crash due to a heap-based buffer underread in xmlParseName.
References:
https://bugzilla.gnome.org/showbug.cgi?id=759573
Upstream fix:
https://git.gnome.org/browse/libxml2/commit/?id=00906759053986b8079985644172085f74331f83
A vulnerability was found in the libxml2 library. A maliciously crafted file could cause the application to crash due to a heap-based out-of-bounds memory read.
References:
https://bugzilla.gnome.org/showbug.cgi?id=758606
Upstream fix:
https://git.gnome.org/browse/libxml2/commit/?id=0bcd05c5cd83dec3406c8f68b769b1d610c72f76
A vulnerability was found in libxml2. Parsing a maliciously crafted xml file could cause the application to crash if recover mode is used.
References:
http://seclists.org/oss-sec/2016/q2/195
It is possible to trigger a stack overflow using a carefully crafted invalid xml file, the stack overflow occurs before libxml2 determines the xml file is invalid.
Upstream bug:
https://bugzilla.gnome.org/showbug.cgi?id=765207
A vulnerability was found in a way libxml2 parses certain files. With the libxml2 in recovery mode, a maliciously crafted filed could cause libxml2 to crash.
References:
http://seclists.org/oss-sec/2016/q1/682
CVE assignment:
http://seclists.org/oss-sec/2016/q1/683
An out-of-bounds read flaw was reported in libxml2's htmlParseNameComplex() function:
http://seclists.org/oss-sec/2016/q1/199
A remote attacker could provide a specially crafted XML file that, when processed by an application linked against libxml2, could cause the application to disclose crash.
A buffer overread in xmlNextChar was found, causing segmentation fault when compiled with ASAN.
Upstream bug (contains reproducer):
https://bugzilla.gnome.org/showbug.cgi?id=756263
Upstream patch:
https://git.gnome.org/browse/libxml2/commit/?id=ab2b9a93ff19cedde7befbf2fcc48c6e352b6cbe