From libxml2-2.15.4:
+v2.15.4: Sep 01 2026 + +### Security + +- xmlregexp: Prevent out-of-bounds read in NXT macro +- fix: add missing overflow checks in dict.c, uri.c, and valid.c +- xmlregexp: Calc string length after null checking +- xpointer: Check overflow in xmlXPtrEvalXPtrPart +- xmlIO: Check for int overflow before calling writecallback +- fix(xinclude): propagate parseFlags in xmlXIncludeProcess and xmlXIncludeProcessTree + + [...]
I possess no further details.
sam
Nokogiri before 1.11.4 (CRuby implementation only, when the packaged/vendored libxml2 is used) bundles libxml2 2.9.10, which is affected by multiple vulnerabilities addressed in libxml2 2.9.12, including a memory leak in xmlSchemaValidateStream (CVE-2019-20388), a global buffer over-read in xmlEncodeEntitiesInternal (CVE-2020-24977), a heap-based buffer overflow (CVE-2021-3517), and an out-of-bounds read (CVE-2021-3518). Processing crafted XML documents may lead to denial of service, information disclosure, or memory corruption.
Uncontrolled recursion vulnerability in the RelaxNG include handling logic of the libxml2 XML parsing library. The issue arises from the absence of limits on recursive <include> directive resolution. When a deeply nested chain of included RelaxNG schema files is processed, the parser enters unbounded recursion, eventually exhausting the system call stack. This results in a stack overflow and application crash. Exploitation requires attacker-controlled schema input and primarily impacts availability by causing a denial of service.
Uncontrolled recursion vulnerability in the xmlCatalogXMLResolveURI function of the libxml2 XML parsing library. The issue occurs when an XML catalog contains a delegate URI entry that references the catalog itself. During entity resolution, the function recursively resolves the same catalog entry without detecting the cyclic reference. This results in infinite recursion and eventual call stack exhaustion, leading to a segmentation fault. Exploitation is configuration-dependent and primarily impacts availability by allowing an attacker to crash affected applications.
libxml2: out-of-bounds read
It was discovered that the libxml2 Python bindings incorrectly handled certain return values. An attacker could possibly use this issue to cause libxml2 to crash, resulting in a denial of service. (CVE-2025-32414) It was discovered that libxml2 incorrectly handled certain memory operations. A remote attacker could possibly use this issue to cause libxml2 to crash, resulting in a denial of service. (CVE-2025-32415)
These issues are fixed in 2.14.2 and 2.13.8. Older branches won't receive official updates.
[CVE-2025-32414] Buffer overflow when parsing text streams with Python API https://gitlab.gnome.org/GNOME/libxml2/-/issues/889
The Python Package Index contains an outdated and unsanctioned upload based on libxml2 2.9.5 which is vulnerable. I tried to inform the PyPI maintainers but I'm not sure my message made it through.
[CVE-2025-32415] Heap-based Buffer Overflow in xmlSchemaIDCFillNodeTables https://gitlab.gnome.org/GNOME/libxml2/-/issues/890
Nick
These issues are fixed in 2.12.10, 2.13.6 and the upcoming 2.14.0 release. Older branches won't receive official updates.
[CVE-2024-56171] Use-after-free in xmlSchemaIDCFillNodeTables https://gitlab.gnome.org/GNOME/libxml2/-/issues/828
[CVE-2025-24928] Stack-buffer-overflow in xmlSnprintfElements https://gitlab.gnome.org/GNOME/libxml2/-/issues/847
Null-deref in xmlPatMatch https://gitlab.gnome.org/GNOME/libxml2/-/issues/861
Nick
El vie, 14 feb 2025, 07:14, Nick Wellnhofer <wellnhofer () aevum de> escribió: On Feb 13, 2025, at 23:28, Daniel Gutson <danielgutson () gmail com> wrote: Curious: is there any info about how this was discovered? The bug was discovered with basic fuzz testing. As libxml2 maintainer, I found more and more issues in various iconv implementations by accident which is a strong indicator that all this code isn't tested enough. The iconv API is also trivial to fuzz, so it seemed like a nice weekend project. Thanks, AFL?
My work is related to static checkers and linters (we will contribute an important patch to weggli soon), so I was wondering if you used something that used symbolic execution.
Nice job! Nick
Multiple use-after-free vulnerabilities in libxml2 2.5.10, 2.6.16, 2.6.26, 2.6.27, and 2.6.32, and libxml 1.8.17, allow context-dependent attackers to cause a denial of service (application crash) via crafted (1) Notation or (2) Enumeration attribute types in an XML file, as demonstrated by the Codenomicon XML fuzzing framework.
Created attachment 322846 [details] Proposed patch from Drew Yao
Description of problem:
Drew Yao of Apple Product Security has reported an integer overflow present in xmlBufferResize function in the libxml2 library potentially leading to an infinite loop. User could provide a very large XML file for parsing to the XML parsing library, which could allow him to cause a denial of service.
Proposed patch: See attachment.
Acknowledgements:
Red Hat would like to thank Drew Yao of the Apple Product Security team for reporting this issue.
Created attachment 322841 [details] Proposed patch from Drew Yao
Description of problem:
Drew Yao from Apple Product Security has reported integer overflow leading to memory corruption present in the xmlSAX2Characters() function in the libxml2 library. User could trigger this flaw by providing very large XML file for parsing to the XML parsing library, which would corrupt the memory and might potentially allow arbitrary code execution.
Proposed patch: See attachment.
Acknowledgements:
Red Hat would like to thank Drew Yao of the Apple Product Security team for reporting this issue.
A stack overflow flaw was found in libxml by parsing root XML document element DTD definition. Providing a specially-crafted XML file would lead to excessive stack growth and denial of service (application crash), when opened by a victim.
An integer overflow, leading to heap-based buffer overflow was found in the way libxml, XML files manipulation library, processed certain XPath expressions. A remote attacker could provide a specially-crafted XML file, which once opened in an application linked against libxml would cause that application to crash, or, potentially, execute arbitrary code with the privileges of the user running the application.
References: [1] http://scarybeastsecurity.blogspot.com/2011/05/libxml-vulnerability-and-interesting.html [2] http://www.openwall.com/lists/oss-security/2011/05/31/5 [3] http://www.openwall.com/lists/oss-security/2011/05/31/8
Upstream patch: [4] http://git.gnome.org/browse/libxml2/commit/?id=d7958b21e7f8c447a26bb2436f08402b2c308be4
https://www.cve.org/CVERecord?id=CVE-2023-45322 was published today. It reports:
libxml2 through 2.11.5 has a use-after-free that can only occur after a certain memory allocation fails. This occurs in xmlUnlinkNode in tree.c. NOTE: the vendor's position is "I don't think these issues are critical enough to warrant a CVE ID ... because an attacker typically can't control when memory allocations fail."
The reproducer is attached to the upstream bug report at: https://gitlab.gnome.org/GNOME/libxml2/-/issues/583 and is run via "./libxml2/xmllint --copy --html --maxmem 315229 input.xml"
The fix is in the git master branch, but not yet any release: https://gitlab.gnome.org/GNOME/libxml2/-/commit/d39f78069dff496ec865c73aa44d7110e429bce9
-- -Alan Coopersmith- alan.coopersmith () oracle com Oracle Solaris Engineering - https://blogs.oracle.com/solaris
It was found that Red Hat JBoss Core Services incorrectly included CVE-2016-3705 as resolved in Apache HTTP 2.4.23 (erratum RHSA-2016:2957). The release did not include the fix to libxml2, leaving it vulnerable to a Denial of Service attack due to a Stack Overflow. This is a regression CVE for CVE-2016-3705.
It is possible to trigger a stack overflow using a carefully crafted invalid xml file, the stack overflow occurs before libxml2 determines the xml file is invalid.
Upstream bug:
https://bugzilla.gnome.org/showbug.cgi?id=765207
A vulnerability was found in libxml2. Parsing a maliciously crafted xml file could cause the application to crash if recover mode is used.
References:
http://seclists.org/oss-sec/2016/q2/195
A vulnerability was found in the libxml2 library. A heap-based buffer overread could happen in xmlDictAddString.
References:
https://bugzilla.gnome.org/showbug.cgi?id=758605
Upstream fix:
https://git.gnome.org/browse/libxml2/commit/?id=a820dbeac29d330bae4be05d9ecd939ad6b4aa33
Heap-based buffer overflow was found in xmlParseXmlDecl. When conversion failure happens, parser continues to extract more errors which may lead to unexpected behaviour.
Upstream bug:
https://bugzilla.gnome.org/showbug.cgi?id=756527
Upstream patch:
https://git.gnome.org/browse/libxml2/commit/?id=afd27c21f6b36e22682b7da20d726bce2dcb2f43
A buffer overread in xmlNextChar was found, causing segmentation fault when compiled with ASAN.
Upstream bug (contains reproducer):
https://bugzilla.gnome.org/showbug.cgi?id=756263
Upstream patch:
https://git.gnome.org/browse/libxml2/commit/?id=ab2b9a93ff19cedde7befbf2fcc48c6e352b6cbe
An out-of-bounds heap read in xmlParseXMLDecl happens when a file containing unfinished xml declaration, e.g. <?xml versionencoding="ISO88598", is followed by 0xff byte.
Upstream bug:
https://bugzilla.gnome.org/showbug.cgi?id=751631
Upstream patch:
https://git.gnome.org/browse/libxml2/commit/?id=709a952110e98621c9b78c4f26462a9d8333102e
Out-of-bounds heap read also occurs in xmlParseXMLDecl when file contains unterminated encoding value.
Upstream bug:
https://bugzilla.gnome.org/showbug.cgi?id=751603
Upstream patch:
https://git.gnome.org/browse/libxml2/commit/?id=9aa37588ee78a06ca1379a9d9356eab16686099c
An out-of-bounds read flaw was reported in libxml2's htmlParseNameComplex() function:
http://seclists.org/oss-sec/2016/q1/199
A remote attacker could provide a specially crafted XML file that, when processed by an application linked against libxml2, could cause the application to disclose crash.
It was found that Red Hat JBoss Core Services incorrectly fixed CVE-2016-3627 in Apache HTTP 2.4.23 (erratum RHSA-2016:2957), leaving libxml2 vulnerable to a Denial of Service attack via stack consumption.
A vulnerability was found in a way libxml2 parses certain files. With the libxml2 in recovery mode, a maliciously crafted filed could cause libxml2 to crash.
References:
http://seclists.org/oss-sec/2016/q1/682
CVE assignment:
http://seclists.org/oss-sec/2016/q1/683
A vulnerability in libxml2 was found causing DoS by exhausting CPU when parsing specially crafted XML document.
Upstream bug:
https://bugzilla.gnome.org/showbug.cgi?id=756733
xmlsec is vulnerable to XML External Entity Expansion via libxml2 (see CVE-2016-9318). A workaround is in progress on the upstream bug report.
Upstream bug:
https://github.com/lsh123/xmlsec/issues/43
A vulnerability was found in the libxml2 library. A maliciously crafted file could cause the application to crash due to a heap-based buffer underread in xmlParseName.
References:
https://bugzilla.gnome.org/showbug.cgi?id=759573
Upstream fix:
https://git.gnome.org/browse/libxml2/commit/?id=00906759053986b8079985644172085f74331f83
A vulnerability was found in the libxml2 library. A maliciously crafted file could cause the application to crash due to a Heap use-after-free in htmlParsePubidLiteral and htmlParseSystemiteral
References:
https://bugzilla.gnome.org/showbug.cgi?id=760263
Upstream fix:
https://git.gnome.org/browse/libxml2/commit/?id=11ed4a7a90d5ce156a18980a4ad4e53e77384852
A vulnerability was found in the libxml2 library. A maliciously crafted file could cause the application to crash due to a heap-based out-of-bounds memory read.
References:
https://bugzilla.gnome.org/showbug.cgi?id=758606
Upstream fix:
https://git.gnome.org/browse/libxml2/commit/?id=0bcd05c5cd83dec3406c8f68b769b1d610c72f76