TI-2021-02495 Aliases CVE-2021-3541 GHSA-wcgr-63g6-pj93

A flaw was found in libxml2.

LOW 33CWE-776Published 2021-07-09 · Updated 2026-10-14

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · None · High
Fix status: Partial Red Hat: 7 fixed, 2 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.

Summary

A flaw was found in libxml2. Exponential entity expansion attack its possible bypassing all existing protection mechanisms and leading to denial of service.

Why it matters now

EPSS 0.02065 81st percentileScored 2026-11-07

Fix Partial Red Hat: 3 advisoriesRed Hat: 7 fixed, 2 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	libxml2	2.9.11	—	No fix listed	CNA

libxml2 Vendor— Affected 2.9.11 Fixed in — No fix listed CNA

CPE configurations NVD · 27

CPE	Versions	Role	Vendor
cpe:2.3:a:xmlsoft:libxml2::::::::	before 2.9.11	Vulnerable	xmlsoft
cpe:2.3:a:redhat:jboss_core_services:-:::::::*	not specified by NVD	Vulnerable	Red Hat
cpe:2.3:a:oracle:zfs_storage_appliance_kit:8.8:::::::*	8.8	Vulnerable	Oracle
cpe:2.3:a:netapp:active_iq_unified_manager:-:::::vmware_vsphere::	not specified by NVD	Vulnerable	NetApp
cpe:2.3:a:netapp:cloud_backup:-:::::::*	not specified by NVD	Vulnerable	NetApp
cpe:2.3:a:netapp:clustered_data_ontap:-:::::::*	not specified by NVD	Vulnerable	NetApp
cpe:2.3:a:netapp:clustered_data_ontap_antivirus_connector:-:::::::*	not specified by NVD	Vulnerable	NetApp
cpe:2.3:a:netapp:manageability_software_development_kit:-:::::::*	not specified by NVD	Vulnerable	NetApp
cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:::::::*	not specified by NVD	Vulnerable	NetApp
cpe:2.3:a:netapp:smi-s_provider:-:::::::*	not specified by NVD	Vulnerable	NetApp

cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:* Versions before 2.9.11 Vulnerable ·xmlsoft
cpe:2.3:a:redhat:jboss_core_services:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
cpe:2.3:a:oracle:zfs_storage_appliance_kit:8.8:*:*:*:*:*:*:* Versions 8.8 Vulnerable ·Oracle
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* Versions not specified by NVD Vulnerable ·NetApp
cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
cpe:2.3:a:netapp:clustered_data_ontap_antivirus_connector:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
cpe:2.3:a:netapp:manageability_software_development_kit:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
cpe:2.3:a:netapp:smi-s_provider:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp

Show 17 more CPE

CPE	Versions	Role	Vendor
cpe:2.3:a:netapp:snapdrive:-:::::unix::	not specified by NVD	Vulnerable	NetApp
cpe:2.3:o:netapp:h410c_firmware:-:::::::*	not specified by NVD	Vulnerable	NetApp
cpe:2.3:h:netapp:h410c:-:::::::*	not specified by NVD	Running on	NetApp
cpe:2.3:o:netapp:h300s_firmware:-:::::::*	not specified by NVD	Vulnerable	NetApp
cpe:2.3:h:netapp:h300s:-:::::::*	not specified by NVD	Running on	NetApp
cpe:2.3:o:netapp:h500s_firmware:-:::::::*	not specified by NVD	Vulnerable	NetApp
cpe:2.3:h:netapp:h500s:-:::::::*	not specified by NVD	Running on	NetApp
cpe:2.3:o:netapp:h700s_firmware:-:::::::*	not specified by NVD	Vulnerable	NetApp
cpe:2.3:h:netapp:h700s:-:::::::*	not specified by NVD	Running on	NetApp
cpe:2.3:o:netapp:h300e_firmware:-:::::::*	not specified by NVD	Vulnerable	NetApp
cpe:2.3:h:netapp:h300e:-:::::::*	not specified by NVD	Running on	NetApp
cpe:2.3:o:netapp:h500e_firmware:-:::::::*	not specified by NVD	Vulnerable	NetApp
cpe:2.3:h:netapp:h500e:-:::::::*	not specified by NVD	Running on	NetApp
cpe:2.3:o:netapp:h700e_firmware:-:::::::*	not specified by NVD	Vulnerable	NetApp
cpe:2.3:h:netapp:h700e:-:::::::*	not specified by NVD	Running on	NetApp
cpe:2.3:o:netapp:h410s_firmware:-:::::::*	not specified by NVD	Vulnerable	NetApp
cpe:2.3:h:netapp:h410s:-:::::::*	not specified by NVD	Running on	NetApp

cpe:2.3:a:netapp:snapdrive:-:*:*:*:*:unix:*:* Versions not specified by NVD Vulnerable ·NetApp
cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
cpe:2.3:o:netapp:h300e_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
cpe:2.3:h:netapp:h300e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
cpe:2.3:o:netapp:h500e_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
cpe:2.3:h:netapp:h500e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
cpe:2.3:o:netapp:h700e_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
cpe:2.3:h:netapp:h700e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp

Remediation

Red Hat 3 advisories

RHSA-2022:1389 Released 2022-04-20 · Red Hat rating Important
Red Hat JBoss Core Services Apache HTTP Server 2.4.37 SP11 security update
- Red Hat JBoss Core Services on RHEL 7 Server jbcs-httpd24-apr-util-1.6.1-91.jbcs.el7, jbcs-httpd24-apr-util-devel-1.6.1-91.jbcs.el7, jbcs-httpd24-apr-util-ldap-1.6.1-91.jbcs.el7 +34
- Red Hat JBoss Core Services on RHEL 8 jbcs-httpd24-apr-util-1.6.1-91.el8jbcs, jbcs-httpd24-apr-util-devel-1.6.1-91.el8jbcs, jbcs-httpd24-apr-util-ldap-1.6.1-91.el8jbcs +34
RHSA-2022:1390 Released 2022-04-20 · Red Hat rating Important
Red Hat JBoss Core Services Apache HTTP Server 2.4.37 SP11 security update
- Red Hat JBoss Core Services
RHSA-2021:2569 Released 2021-06-29 · Red Hat rating Moderate
libxml2 security update
- Red Hat Enterprise Linux AppStream (v. 8) libxml2-devel-2.9.7-9.el8_4.2
- Red Hat Enterprise Linux BaseOS (v. 8) libxml2-2.9.7-9.el8_4.2, python3-libxml2-2.9.7-9.el8_4.2

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux 6	Affected	No fix planned: Out of support scope
Red Hat Enterprise Linux 7	Affected	No fix planned: Will not fix
7Server-RHMTC-1.4	Fixed	—
8Base-RHMTC-1.4	Fixed	—
Red Hat Enterprise Linux AppStream (v. 8)	Fixed	RHSA-2021:2569
Red Hat Enterprise Linux BaseOS (v. 8)	Fixed	RHSA-2021:2569
Red Hat JBoss Core Services	Fixed	RHSA-2022:1390
Red Hat JBoss Core Services on RHEL 7 Server	Fixed	RHSA-2022:1389
Red Hat JBoss Core Services on RHEL 8	Fixed	RHSA-2022:1389

Not affected: 1 product

Red Hat Enterprise Linux 9

Timeline

2026-10-02 Threatist record created from CVE-2021-3541
2026-10-03 Alias added: GHSA-wcgr-63g6-pj93
2026-10-09 Fix available: RHSA-2022:1390 · Red Hat
2026-10-16 Fix available: Red Hat JBoss Core Services · Red Hat

References

Patch 2

Advisory 1

https://security.netapp.com/advisory/ntap-20210805-0007/

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences