Xmlsoft Libxml2 vulnerabilities
135 known vulnerabilities affecting xmlsoft/libxml2.
Total CVEs
135
CISA KEV
0
Public exploits
8
Exploited in wild
2
Severity breakdown
CRITICAL17HIGH50MEDIUM60LOW7UNKNOWN1
Vulnerabilities
Page 4 of 7
CVE-2013-0339P3MEDIUMCVSS 6.8≤ 2.9.1v1.7.0+124 more2014-01-21
CVE-2013-0339 [MEDIUM] CWE-264 CVE-2013-0339: libxml2 through 2.9.1 does not properly handle external entities expansion unless an application dev
libxml2 through 2.9.1 does not properly handle external entities expansion unless an application developer uses the xmlSAX2ResolveEntity or xmlSetExternalEntityLoader function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, a
nvdosv
CVE-2016-3627P3HIGHCVSS 7.5≤ 2.9.32016-05-17
CVE-2016-3627 [HIGH] CWE-674 CVE-2016-3627: The xmlStringGetNodeList function in tree.c in libxml2 2.9.3 and earlier, when used in recovery mode
The xmlStringGetNodeList function in tree.c in libxml2 2.9.3 and earlier, when used in recovery mode, allows context-dependent attackers to cause a denial of service (infinite recursion, stack consumption, and application crash) via a crafted XML document.
nvdosv
CVE-2019-19956P3HIGHCVSS 7.5fixed in 2.9.102019-12-24
CVE-2019-19956 [HIGH] CWE-401 CVE-2019-19956: xmlParseBalancedChunkMemoryRecover in parser.c in libxml2 before 2.9.10 has a memory leak related to
xmlParseBalancedChunkMemoryRecover in parser.c in libxml2 before 2.9.10 has a memory leak related to newDoc->oldNs.
nvdosv
CVE-2016-5131P3HIGHCVSS 8.8≤ 2.9.42016-07-23
CVE-2016-5131 [HIGH] CWE-416 CVE-2016-5131: Use-after-free vulnerability in libxml2 through 2.9.4, as used in Google Chrome before 52.0.2743.82,
Use-after-free vulnerability in libxml2 through 2.9.4, as used in Google Chrome before 52.0.2743.82, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the XPointer range-to function.
nvdosv
CVE-2016-3705P3HIGHCVSS 7.5v2.9.32016-05-17
CVE-2016-3705 [HIGH] CWE-20 CVE-2016-3705: The (1) xmlParserEntityCheck and (2) xmlParseAttValueComplex functions in parser.c in libxml2 2.9.3
The (1) xmlParserEntityCheck and (2) xmlParseAttValueComplex functions in parser.c in libxml2 2.9.3 do not properly keep track of the recursion depth, which allows context-dependent attackers to cause a denial of service (stack consumption and application crash) via a crafted XML document containing a large number of nested entity references.
nvdosv
CVE-2016-4483P3HIGHCVSS 7.5fixed in 2.9.42017-04-11
CVE-2016-4483 [HIGH] CWE-502 CVE-2016-4483: The xmlBufAttrSerializeTxtContent function in xmlsave.c in libxml2 allows context-dependent attacker
The xmlBufAttrSerializeTxtContent function in xmlsave.c in libxml2 allows context-dependent attackers to cause a denial of service (out-of-bounds read and application crash) via a non-UTF-8 attribute value, related to serialization. NOTE: this vulnerability may be a duplicate of CVE-2016-3627.
nvdosv
CVE-2026-86142P3MEDIUMCVSS 6.9fixed in 2.15.42026-09-05
CVE-2026-86142 [MEDIUM] CWE-122 CVE-2026-86142: In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xm
In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation.
nvd
CVE-2011-3919P3HIGHCVSS 7.5≥ 0, < 2.7.8.dfsg-72012-01-07
CVE-2011-3919 [HIGH] CVE-2011-3919: Heap-based buffer overflow in libxml2, as used in Google Chrome before 16
Heap-based buffer overflow in libxml2, as used in Google Chrome before 16.0.912.75, allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
osv
CVE-2010-4494P3HIGHCVSS 7.5≤ 2.7.82010-12-07
CVE-2010-4494 [HIGH] CWE-415 CVE-2010-4494: Double free vulnerability in libxml2 2.7.8 and other versions, as used in Google Chrome before 8.0.5
Double free vulnerability in libxml2 2.7.8 and other versions, as used in Google Chrome before 8.0.552.215 and other products, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to XPath handling.
nvdosv
CVE-2015-8806P3HIGHCVSS 7.5fixed in 2.9.42016-04-13
CVE-2015-8806 [HIGH] CVE-2015-8806: dict.c in libxml2 allows remote attackers to cause a denial of service (heap-based buffer over-read
dict.c in libxml2 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via an unexpected character immediately after the "<!DOCTYPE html" substring in a crafted HTML document.
nvdosv
CVE-2026-86138P3MEDIUMCVSS 6.9fixed in 2.15.42026-09-05
CVE-2026-86138 [MEDIUM] CWE-190 CVE-2026-86138: In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-bas
In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based buffer overflow.
nvd
CVE-2015-5312P4HIGHCVSS 7.1≤ 2.9.22015-12-15
CVE-2015-5312 [HIGH] CVE-2015-5312: The xmlStringLenDecodeEntities function in parser.c in libxml2 before 2.9.3 does not properly preven
The xmlStringLenDecodeEntities function in parser.c in libxml2 before 2.9.3 does not properly prevent entity expansion, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted XML data, a different vulnerability than CVE-2014-3660.
nvdosv
CVE-2026-0990P3MEDIUMCVSS 5.9fixed in 2.15.22026-01-15
CVE-2026-0990 [MEDIUM] CWE-674 CVE-2026-0990: A flaw was found in libxml2, an XML parsing library. This uncontrolled recursion vulnerability occur
A flaw was found in libxml2, an XML parsing library. This uncontrolled recursion vulnerability occurs in the xmlCatalogXMLResolveURI function when an XML catalog contains a delegate URI entry that references itself. A remote attacker could exploit this configuration-dependent issue by providing a specially crafted XML catalog, leading to infinite recu
nvdosv
CVE-2020-24977P4MEDIUMCVSS 6.5v2.9.102020-09-04
CVE-2020-24977 [MEDIUM] CWE-125 CVE-2020-24977: GNOME project libxml2 v2.9.10 has a global buffer over-read vulnerability in xmlEncodeEntitiesIntern
GNOME project libxml2 v2.9.10 has a global buffer over-read vulnerability in xmlEncodeEntitiesInternal at libxml2/entities.c. The issue has been fixed in commit 50f06b3e.
nvdosv
CVE-2022-29824P4MEDIUMCVSS 6.5fixed in 2.9.142022-05-03
CVE-2022-29824 [MEDIUM] CWE-190 CVE-2022-29824: In libxml2 before 2.9.14, several buffer handling functions in buf.c (xmlBuf*) and tree.c (xmlBuffer
In libxml2 before 2.9.14, several buffer handling functions in buf.c (xmlBuf*) and tree.c (xmlBuffer*) don't check for integer overflows. This can result in out-of-bounds memory writes. Exploitation requires a victim to open a crafted, multi-gigabyte XML file. Other software using libxml2's buffer functions, for example libxslt through 1.1.35, is af
nvdosv
CVE-2026-86143P4MEDIUMCVSS 6.9fixed in 2.15.42026-09-05
CVE-2026-86143 [MEDIUM] CWE-192 CVE-2026-86143: In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes n
In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks, aka a lack of a check for integer overflow before calling writecallback. This has security relevance for many types of uses of that length value within a callback.
nvd
CVE-2015-7942P4MEDIUMCVSS 6.8v2.9.22015-11-18
CVE-2015-7942 [MEDIUM] CVE-2015-7942: The xmlParseConditionalSections function in parser.c in libxml2 does not properly skip intermediary
The xmlParseConditionalSections function in parser.c in libxml2 does not properly skip intermediary entities when it stops parsing invalid input, which allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) via crafted XML data, a different vulnerability than CVE-2015-7941.
nvdosv
CVE-2015-7498P4MEDIUMCVSS 5.0≤ 2.9.22015-12-15
CVE-2015-7498 [MEDIUM] CWE-119 CVE-2015-7498: Heap-based buffer overflow in the xmlParseXmlDecl function in parser.c in libxml2 before 2.9.3 allow
Heap-based buffer overflow in the xmlParseXmlDecl function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to cause a denial of service via unspecified vectors related to extracting errors after an encoding conversion failure.
nvdosv
CVE-2016-4449P4HIGHCVSS 7.1≤ 2.9.32016-06-09
CVE-2016-4449 [HIGH] CWE-20 CVE-2016-4449: XML external entity (XXE) vulnerability in the xmlStringLenDecodeEntities function in parser.c in li
XML external entity (XXE) vulnerability in the xmlStringLenDecodeEntities function in parser.c in libxml2 before 2.9.4, when not in validating mode, allows context-dependent attackers to read arbitrary files or cause a denial of service (resource consumption) via unspecified vectors.
nvdosv
CVE-2021-3541P4MEDIUMCVSS 6.5fixed in 2.9.11v2.9.112021-07-09
CVE-2021-3541 [MEDIUM] CWE-776 CVE-2021-3541: A flaw was found in libxml2. Exponential entity expansion attack its possible bypassing all existing
A flaw was found in libxml2. Exponential entity expansion attack its possible bypassing all existing protection mechanisms and leading to denial of service.
nvdosv