Vulnerabilities

libxml2 before 2.15.4 fails to propagate parser flags in the xmlXIncludeProcess and xmlXIncludeProcessTree functions, so options such as XML_PARSE_NONET are not applied during XInclude processing. An application that relies on that flag to block network access, while using a custom resource loader that can reach the internet, can be tricked into fetching attacker-controlled external entities or remote resources. This enables XML external entity (XXE) injection, server-side request forgery (SSRF), and denial of service via deliberately slow attacker-controlled internet resources, with high impact to confidentiality, integrity, and availability (CVSS 3.1: 7.8). Any product that embeds a vulnerable libxml2 and calls the affected XInclude functions is affected, with the xmlsoft project as the maintaining vendor. No public proof-of-concept or confirmed in-the-wild exploitation is known, EPSS is low (0.2% in 30 days), and the issue is not listed in the CISA KEV catalog.

Do: Upgrade libxml2 to 2.15.4 or later, or apply your Linux distribution's backported security patch. Developers whose code calls xmlXIncludeProcess or xmlXIncludeProcessTree should audit whether they rely on XML_PARSE_NONET for network isolation, and mitigate by restricting or hardening custom resource loaders, disabling XInclude on untrusted XML input, and enforcing egress filtering. Remember that bundled or vendored copies of libxml2 inside language bindings and third-party software may need separate updates from the OS package.

libxml2 is vulnerable to multiple stack-based buffer overflows in the xmlcatalog utility when running in --shell mode. The usershell() function processes user input using fixed-size stack buffers without proper bounds checking. By supplying an overly long input line, an attacker can overflow internal buffers (command, arg, and argv) during input parsing. This results in memory corruption within the stack frame. Successful exploitation may cause a crash or potentially allow arbitrary code execution in the context of the xmlcatalog process. This issue has been fixed in the commit c2e233fc. NOTE: The maintainers of this project did not agree that this issue is a vulnerability and considered it a bug.

Use After Free in libxml2's xmlParseInternalSubset from GNOME libxml2 version 2.9.11 to 2.11.0 allows a remote attacker to cause a denial-of-service via maliciously crafted XML input with improper entity resolution handling.