Use after free in libxml2
Priority MEDIUM 58CWE-416Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 7 fixed, 2 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-416 and the CVSS impact.
Summary
There's a flaw in libxml2 in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by an application linked with libxml2 could trigger a use-after-free. The greatest impact from this flaw is to confidentiality, integrity, and availability.
Why it matters now
EPSS 0.21859 97th percentileScored 2026-11-07
Fix Partial nokogiri (RubyGems): 1.11.4Red Hat: 3 advisoriesRed Hat: 7 fixed, 2 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | libxml2 | libxml2 2.9.11 | — | No fix listed | CNA |
| — | nokogiri (RubyGems) | before 1.11.4 | 1.11.4 | Patch available | GHSA-v4f8-2847-rwm7 |
- libxml2 Vendor— Affected libxml2 2.9.11 Fixed in — No fix listed CNA
- nokogiri (RubyGems) Vendor— Affected before 1.11.4 Fixed in 1.11.4 Patch available GHSA-v4f8-2847-rwm7
CPE configurations NVD · 22
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:* | before 2.9.11 | Vulnerable | xmlsoft |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
| cpe:2.3:a:redhat:jboss_core_services:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Red Hat |
| cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* | 33 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* | 34 | Vulnerable | Fedoraproject |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:clustered_data_ontap_antivirus_connector:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:manageability_software_development_kit:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
- cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:* Versions before 2.9.11 Vulnerable ·xmlsoft
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
- cpe:2.3:a:redhat:jboss_core_services:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
- cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* Versions 33 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* Versions 34 Vulnerable ·Fedoraproject
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:clustered_data_ontap_antivirus_connector:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:manageability_software_development_kit:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
Show 12 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:snapdrive:-:*:*:*:*:windows:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:o:netapp:hci_h410c_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:hci_h410c:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:1.10.0:*:*:*:*:*:*:* | 1.10.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:enterprise_manager_base_platform:13.4.0.0:*:*:*:*:*:*:* | 13.4.0.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:enterprise_manager_base_platform:13.5.0.0:*:*:*:*:*:*:* | 13.5.0.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0.0:*:*:*:*:*:*:* | 12.4.0.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:mysql_workbench:*:*:*:*:*:*:*:* | up to 8.0.26 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:* | 8.58 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:real_user_experience_insight:13.4.1.0:*:*:*:*:*:*:* | 13.4.1.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:real_user_experience_insight:13.5.1.0:*:*:*:*:*:*:* | 13.5.1.0 | Vulnerable | Oracle |
- cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:snapdrive:-:*:*:*:*:windows:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:o:netapp:hci_h410c_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:hci_h410c:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:1.10.0:*:*:*:*:*:*:* Versions 1.10.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:enterprise_manager_base_platform:13.4.0.0:*:*:*:*:*:*:* Versions 13.4.0.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:enterprise_manager_base_platform:13.5.0.0:*:*:*:*:*:*:* Versions 13.5.0.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0.0:*:*:*:*:*:*:* Versions 12.4.0.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:mysql_workbench:*:*:*:*:*:*:*:* Versions up to 8.0.26 Vulnerable ·Oracle
- cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:* Versions 8.58 Vulnerable ·Oracle
- cpe:2.3:a:oracle:real_user_experience_insight:13.4.1.0:*:*:*:*:*:*:* Versions 13.4.1.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:real_user_experience_insight:13.5.1.0:*:*:*:*:*:*:* Versions 13.5.1.0 Vulnerable ·Oracle
Remediation
- Fix · GHSA-v4f8-2847-rwm7 nokogiri (RubyGems) Fixed in 1.11.4 Advisory →
Red Hat 3 advisories
- RHSA-2022:1389 Released 2022-04-20 · Red Hat rating ImportantRed Hat JBoss Core Services Apache HTTP Server 2.4.37 SP11 security update
- Red Hat JBoss Core Services on RHEL 7 Server jbcs-httpd24-apr-util-1.6.1-91.jbcs.el7, jbcs-httpd24-apr-util-devel-1.6.1-91.jbcs.el7, jbcs-httpd24-apr-util-ldap-1.6.1-91.jbcs.el7 +34
- Red Hat JBoss Core Services on RHEL 8 jbcs-httpd24-apr-util-1.6.1-91.el8jbcs, jbcs-httpd24-apr-util-devel-1.6.1-91.el8jbcs, jbcs-httpd24-apr-util-ldap-1.6.1-91.el8jbcs +34
- RHSA-2022:1390 Released 2022-04-20 · Red Hat rating ImportantRed Hat JBoss Core Services Apache HTTP Server 2.4.37 SP11 security update
- Red Hat JBoss Core Services
- RHSA-2021:2569 Released 2021-06-29 · Red Hat rating Moderatelibxml2 security update
- Red Hat Enterprise Linux AppStream (v. 8) libxml2-devel-2.9.7-9.el8_4.2
- Red Hat Enterprise Linux BaseOS (v. 8) libxml2-2.9.7-9.el8_4.2, python3-libxml2-2.9.7-9.el8_4.2
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
libxml2 — FEDORA-2021-b950000d2b
3 records Highest priority Priority MEDIUM 2 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2021-02476 Out-of-bounds write in libxml2Priority MEDIUM 60
- TI-2021-02491 NULL pointer dereference in libxml2Priority LOW 33
- Advisory ·
libxml2 — FEDORA-2021-e3ed1ba38b
3 records Highest priority Priority MEDIUM 2 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2021-02476 Out-of-bounds write in libxml2Priority MEDIUM 60
- TI-2021-02491 NULL pointer dereference in libxml2Priority LOW 33
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| 7Server-RHMTC-1.4 | Fixed | — |
| 8Base-RHMTC-1.4 | Fixed | — |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2021:2569 |
| Red Hat Enterprise Linux BaseOS (v. 8) | Fixed | RHSA-2021:2569 |
| Red Hat JBoss Core Services | Fixed | RHSA-2022:1390 |
| Red Hat JBoss Core Services on RHEL 7 Server | Fixed | RHSA-2022:1389 |
| Red Hat JBoss Core Services on RHEL 8 | Fixed | RHSA-2022:1389 |
Not affected: 1 product
- Red Hat Enterprise Linux 9
Timeline
- 2026-10-02 Threatist record created from CVE-2021-3518
- 2026-10-03 Alias added: GHSA-v4f8-2847-rwm7
- 2026-10-09 Fix available: RHSA-2022:1390 · Red Hat
- 2026-10-16 Fix available: Red Hat JBoss Core Services · Red Hat
References
Patch 3
Advisory 14
- FEDORA-2021-e3ed1ba38b
- [debian-lts-announce] 20210510 [SECURITY] [DLA 2653-1] libxml2 security update
- FEDORA-2021-b950000d2b
- GLSA-202107-05
- https://security.netapp.com/advisory/ntap-20210625-0002/
- 20210723 APPLE-SA-2021-07-21-5 watchOS 7.6
- 20210723 APPLE-SA-2021-07-21-1 iOS 14.7 and iPadOS 14.7
- 20210723 APPLE-SA-2021-07-21-2 macOS Big Sur 11.5
- 20210723 APPLE-SA-2021-07-21-6 tvOS 14.7
- https://support.apple.com/kb/HT212605
- https://support.apple.com/kb/HT212602
- https://support.apple.com/kb/HT212601
- https://support.apple.com/kb/HT212604
- https://nvd.nist.gov/vuln/detail/CVE-2021-3518
Other 12
- [bookkeeper-issues] 20210628 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8
- [bookkeeper-issues] 20210629 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://security.netapp.com/advisory/ntap-20210625-0002
- https://nokogiri.org/CHANGELOG.html#1114-2021-05-14
- https://lists.fedoraproject.org/archives/list/[email protected]/message/QVM4UJ3376I6ZVOYMHBNX4GY3NIV52WV
- https://lists.fedoraproject.org/archives/list/[email protected]/message/BZOMV5J4PMZAORVT64BKLV6YIZAFDGX6
- https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E
- https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E
- https://github.com/sparklemotion/nokogiri/blob/2edbbef95f1dc12c1ddc5ebda71b9159026245fe/CHANGELOG.md?plain=1#L722
- https://github.com/sparklemotion/nokogiri
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2021-3518.yml
Sources
- CVE-2021-3518 · CVE Program
- CVE-2021-3518 · NVD
- FIRST EPSS
- GHSA-v4f8-2847-rwm7 · GitHub Advisory Database · CC BY 4.0
- CVE-2021-3518 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences