Out-of-bounds write in libxml2
Priority MEDIUM 60CWE-787Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · High
- Fix status
- Partial Red Hat: 7 fixed, 2 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat.
Summary
There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be processed by an application linked with the affected functionality of libxml2 could trigger an out-of-bounds read. The most likely impact of this flaw is to application availability, with some potential impact to confidentiality and integrity if an attacker is able to use memory information to further exploit the application.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.16986 97th percentileScored 2026-11-07
Fix Partial nokogiri (RubyGems): 1.11.4Red Hat: 3 advisoriesRed Hat: 7 fixed, 2 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | libxml2 | libxml2 2.9.11 | — | No fix listed | CNA |
| — | nokogiri (RubyGems) | before 1.11.4 | 1.11.4 | Patch available | GHSA-jw9f-hh49-cvp9 |
- libxml2 Vendor— Affected libxml2 2.9.11 Fixed in — No fix listed CNA
- nokogiri (RubyGems) Vendor— Affected before 1.11.4 Fixed in 1.11.4 Patch available GHSA-jw9f-hh49-cvp9
CPE configurations NVD · 34
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:* | before 2.9.11 | Vulnerable | xmlsoft |
| cpe:2.3:a:redhat:jboss_core_services:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Red Hat |
| cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* | 33 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* | 34 | Vulnerable | Fedoraproject |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:clustered_data_ontap_antivirus_connector:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
- cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:* Versions before 2.9.11 Vulnerable ·xmlsoft
- cpe:2.3:a:redhat:jboss_core_services:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
- cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* Versions 33 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* Versions 34 Vulnerable ·Fedoraproject
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:clustered_data_ontap_antivirus_connector:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
Show 24 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:* | 11.0.0 – 11.70.1 | Vulnerable | NetApp |
| cpe:2.3:a:netapp:e-series_santricity_storage_manager:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:e-series_santricity_web_services:-:*:*:*:*:web_services_proxy:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:manageability_software_development_kit:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:santricity_unified_manager:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:snapdrive:-:*:*:*:*:windows:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:oracle:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:sap:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:o:netapp:hci_h410c_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:hci_h410c:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:1.10.0:*:*:*:*:*:*:* | 1.10.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:enterprise_manager_base_platform:13.4.0.0:*:*:*:*:*:*:* | 13.4.0.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:enterprise_manager_base_platform:13.5.0.0:*:*:*:*:*:*:* | 13.5.0.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:mysql_workbench:*:*:*:*:*:*:*:* | up to 8.0.26 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:openjdk:8:update301:*:*:*:*:*:* | 8 update301 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:* | 8.58 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:real_user_experience_insight:13.4.1.0:*:*:*:*:*:*:* | 13.4.1.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:real_user_experience_insight:13.5.1.0:*:*:*:*:*:*:* | 13.5.1.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:zfs_storage_appliance_kit:8.8:*:*:*:*:*:*:* | 8.8 | Vulnerable | Oracle |
- cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:* Versions 11.0.0 – 11.70.1 Vulnerable ·NetApp
- cpe:2.3:a:netapp:e-series_santricity_storage_manager:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:e-series_santricity_web_services:-:*:*:*:*:web_services_proxy:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:manageability_software_development_kit:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:santricity_unified_manager:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:snapdrive:-:*:*:*:*:windows:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:oracle:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:sap:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:o:netapp:hci_h410c_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:hci_h410c:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:1.10.0:*:*:*:*:*:*:* Versions 1.10.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:enterprise_manager_base_platform:13.4.0.0:*:*:*:*:*:*:* Versions 13.4.0.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:enterprise_manager_base_platform:13.5.0.0:*:*:*:*:*:*:* Versions 13.5.0.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:mysql_workbench:*:*:*:*:*:*:*:* Versions up to 8.0.26 Vulnerable ·Oracle
- cpe:2.3:a:oracle:openjdk:8:update301:*:*:*:*:*:* Versions 8 update301 Vulnerable ·Oracle
- cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:* Versions 8.58 Vulnerable ·Oracle
- cpe:2.3:a:oracle:real_user_experience_insight:13.4.1.0:*:*:*:*:*:*:* Versions 13.4.1.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:real_user_experience_insight:13.5.1.0:*:*:*:*:*:*:* Versions 13.5.1.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:zfs_storage_appliance_kit:8.8:*:*:*:*:*:*:* Versions 8.8 Vulnerable ·Oracle
Remediation
- Fix · GHSA-jw9f-hh49-cvp9 nokogiri (RubyGems) Fixed in 1.11.4 Advisory →
Red Hat 3 advisories
- RHSA-2022:1389 Released 2022-04-20 · Red Hat rating ImportantRed Hat JBoss Core Services Apache HTTP Server 2.4.37 SP11 security update
- Red Hat JBoss Core Services on RHEL 7 Server jbcs-httpd24-apr-util-1.6.1-91.jbcs.el7, jbcs-httpd24-apr-util-devel-1.6.1-91.jbcs.el7, jbcs-httpd24-apr-util-ldap-1.6.1-91.jbcs.el7 +34
- Red Hat JBoss Core Services on RHEL 8 jbcs-httpd24-apr-util-1.6.1-91.el8jbcs, jbcs-httpd24-apr-util-devel-1.6.1-91.el8jbcs, jbcs-httpd24-apr-util-ldap-1.6.1-91.el8jbcs +34
- RHSA-2022:1390 Released 2022-04-20 · Red Hat rating ImportantRed Hat JBoss Core Services Apache HTTP Server 2.4.37 SP11 security update
- Red Hat JBoss Core Services
- RHSA-2021:2569 Released 2021-06-29 · Red Hat rating Moderatelibxml2 security update
- Red Hat Enterprise Linux AppStream (v. 8) libxml2-devel-2.9.7-9.el8_4.2
- Red Hat Enterprise Linux BaseOS (v. 8) libxml2-2.9.7-9.el8_4.2, python3-libxml2-2.9.7-9.el8_4.2
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
libxml2 — FEDORA-2021-b950000d2b
3 records Highest priority Priority MEDIUM 2 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2021-02477 Use after free in libxml2Priority MEDIUM 58
- TI-2021-02491 NULL pointer dereference in libxml2Priority LOW 33
- Advisory ·
libxml2 — FEDORA-2021-e3ed1ba38b
3 records Highest priority Priority MEDIUM 2 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2021-02477 Use after free in libxml2Priority MEDIUM 58
- TI-2021-02491 NULL pointer dereference in libxml2Priority LOW 33
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| 7Server-RHMTC-1.4 | Fixed | — |
| 8Base-RHMTC-1.4 | Fixed | — |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2021:2569 |
| Red Hat Enterprise Linux BaseOS (v. 8) | Fixed | RHSA-2021:2569 |
| Red Hat JBoss Core Services | Fixed | RHSA-2022:1390 |
| Red Hat JBoss Core Services on RHEL 7 Server | Fixed | RHSA-2022:1389 |
| Red Hat JBoss Core Services on RHEL 8 | Fixed | RHSA-2022:1389 |
Not affected: 1 product
- Red Hat Enterprise Linux 9
Timeline
- 2026-10-02 Threatist record created from CVE-2021-3517
- 2026-10-03 Alias added: GHSA-jw9f-hh49-cvp9
- 2026-10-09 Fix available: RHSA-2022:1390 · Red Hat
- 2026-10-16 Fix available: Red Hat JBoss Core Services · Red Hat
References
Patch 4
Advisory 7
Other 13
- [bookkeeper-issues] 20210628 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8
- [bookkeeper-issues] 20210629 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://github.com/sparklemotion/nokogiri/issues/2233
- https://github.com/sparklemotion/nokogiri/issues/2274
- https://security.netapp.com/advisory/ntap-20211022-0004
- https://security.netapp.com/advisory/ntap-20210625-0002
- https://lists.fedoraproject.org/archives/list/[email protected]/message/QVM4UJ3376I6ZVOYMHBNX4GY3NIV52WV
- https://lists.fedoraproject.org/archives/list/[email protected]/message/BZOMV5J4PMZAORVT64BKLV6YIZAFDGX6
- https://gitlab.gnome.org/GNOME/libxml2/-/commit/8598060bacada41a0eb09d95c97744ff4e428f8e
- https://github.com/sparklemotion/nokogiri/blob/7c19ef5cc6b7c5c36827dd5495f857c6877ec8cf/CHANGELOG.md?plain=1#L579
- https://github.com/sparklemotion/nokogiri
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2021-3517.yml
Sources
- CVE-2021-3517 · CVE Program
- CVE-2021-3517 · NVD
- FIRST EPSS
- GHSA-jw9f-hh49-cvp9 · GitHub Advisory Database · CC BY 4.0
- CVE-2021-3517 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences