Read the docs
TI-2021-02475 Aliases CVE-2021-3516GHSA-cfj9-6cq4-25vj

Use after free in libxml2

Priority LOW 38CWE-416Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 7 fixed, 2 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-416 and the CVSS impact.

Summary

There's a flaw in libxml2's xmllint in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by xmllint could trigger a use-after-free. The greatest impact of this flaw is to confidentiality, integrity, and availability.

Why it matters now

EPSS 0.02043 81st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial Red Hat: 3 advisoriesRed Hat: 7 fixed, 2 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—libxml2libxml2 2.9.11—No fix listedCNA
  • libxml2 Vendor— Affected libxml2 2.9.11 Fixed in — No fix listed CNA

CPE configurations NVD · 12

CPEVersionsRoleVendor
cpe:2.3:a:xmlsoft:xmllint:*:*:*:*:*:*:*:*before 2.9.11Vulnerablexmlsoft
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*9.0VulnerableDebian
cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*33VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*34VulnerableFedoraproject
cpe:2.3:a:redhat:jboss_core_services:-:*:*:*:*:*:*:*not specified by NVDVulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*6.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*8.0VulnerableRed Hat
cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:clustered_data_ontap_antivirus_connector:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
  • cpe:2.3:a:xmlsoft:xmllint:*:*:*:*:*:*:*:* Versions before 2.9.11 Vulnerable ·xmlsoft
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
  • cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* Versions 33 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* Versions 34 Vulnerable ·Fedoraproject
  • cpe:2.3:a:redhat:jboss_core_services:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
  • cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:clustered_data_ontap_antivirus_connector:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
Show 2 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:oracle:zfs_storage_appliance_kit:8.8:*:*:*:*:*:*:*8.8VulnerableOracle
  • cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:oracle:zfs_storage_appliance_kit:8.8:*:*:*:*:*:*:* Versions 8.8 Vulnerable ·Oracle

Remediation

Red Hat 3 advisories

  • RHSA-2022:1389 Released 2022-04-20 · Red Hat rating Important
    Red Hat JBoss Core Services Apache HTTP Server 2.4.37 SP11 security update
    • Red Hat JBoss Core Services on RHEL 7 Server jbcs-httpd24-apr-util-1.6.1-91.jbcs.el7, jbcs-httpd24-apr-util-devel-1.6.1-91.jbcs.el7, jbcs-httpd24-apr-util-ldap-1.6.1-91.jbcs.el7 +34
    • Red Hat JBoss Core Services on RHEL 8 jbcs-httpd24-apr-util-1.6.1-91.el8jbcs, jbcs-httpd24-apr-util-devel-1.6.1-91.el8jbcs, jbcs-httpd24-apr-util-ldap-1.6.1-91.el8jbcs +34
  • RHSA-2022:1390 Released 2022-04-20 · Red Hat rating Important
    Red Hat JBoss Core Services Apache HTTP Server 2.4.37 SP11 security update
    • Red Hat JBoss Core Services
  • RHSA-2021:2569 Released 2021-06-29 · Red Hat rating Moderate
    libxml2 security update
    • Red Hat Enterprise Linux AppStream (v. 8) libxml2-devel-2.9.7-9.el8_4.2
    • Red Hat Enterprise Linux BaseOS (v. 8) libxml2-2.9.7-9.el8_4.2, python3-libxml2-2.9.7-9.el8_4.2

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
7Server-RHMTC-1.4Fixed—
8Base-RHMTC-1.4Fixed—
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2021:2569
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2021:2569
Red Hat JBoss Core ServicesFixed RHSA-2022:1390
Red Hat JBoss Core Services on RHEL 7 ServerFixed RHSA-2022:1389
Red Hat JBoss Core Services on RHEL 8Fixed RHSA-2022:1389
Not affected: 1 product
  • Red Hat Enterprise Linux 9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-3516
  2. 2026-10-03 Alias added: GHSA-cfj9-6cq4-25vj
  3. 2026-10-09 Fix available: RHSA-2022:1390 · Red Hat
  4. 2026-10-16 Fix available: Red Hat JBoss Core Services · Red Hat

References

Exploit 1

Patch 2

Advisory 6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences