Read the docs
TI-2022-24561 Aliases CVE-2022-49043GHSA-84p5-cqqq-h4gr

xmlXIncludeAddNode in xinclude.c in libxml2 before 2.11.0 has a use-after-free.

Priority LOW 37CWE-416Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 21 fixed, 2 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-416 and the CVSS impact.

Summary

xmlXIncludeAddNode in xinclude.c in libxml2 before 2.11.0 has a use-after-free.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00265 18th percentileScored 2026-11-07
Fix Partial libxml2 (xmlsoft): 2.11.0Red Hat: 16 advisoriesRed Hat: 21 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
xmlsoftlibxml22.0.0 to before 2.11.02.11.0Patch availableCNA
  • libxml2 Vendorxmlsoft Affected 2.0.0 to before 2.11.0 Fixed in 2.11.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:*before 2.11.0Vulnerablexmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:* Versions before 2.11.0 Vulnerable ·xmlsoft

Remediation

  • Fix · CNA libxml2 (xmlsoft) Fixed in 2.11.0

Red Hat 16 advisories

  • RHSA-2025:9278 Released 2025-06-24 · Red Hat rating Important
    OpenShift Container Platform 4.19.1 bug fix and security update
    • Red Hat OpenShift Container Platform 4.19 openshift4/aws-karpenter-provider-aws-rhel9, openshift4/aws-kms-encryption-provider-rhel9, openshift4/azure-kms-encryption-provider-rhel9 +47
  • RHSA-2025:7702 Released 2025-05-21 · Red Hat rating Important
    OpenShift Container Platform 4.14.52 bug fix and security update
    • Red Hat OpenShift Container Platform 4.14 openshift4/ose-agent-installer-node-agent-rhel9, openshift4/ose-agent-installer-orchestrator-rhel8, openshift4/ose-hypershift-rhel8 +1
  • RHSA-2025:4677 Released 2025-05-15 · Red Hat rating Important
    OpenShift Container Platform 4.13.58 bug fix and security update
    • Red Hat OpenShift Container Platform 4.13 openshift4/ose-agent-installer-api-server-rhel8, openshift4/ose-agent-installer-node-agent-rhel8, openshift4/ose-agent-installer-orchestrator-rhel8 +6
Show 13 more Red Hat advisories
  • RHSA-2025:4731 Released 2025-05-15 · Red Hat rating Important
    OpenShift Container Platform 4.16.40 bug fix and security update
    • Red Hat OpenShift Container Platform 4.16 openshift4/driver-toolkit-rhel9, openshift4/network-tools-rhel9, openshift4/openshift-route-controller-manager-rhel9 +30
  • RHSA-2025:4422 Released 2025-05-08 · Red Hat rating Important
    OpenShift Container Platform 4.15.50 bug fix and security update
    • Red Hat OpenShift Container Platform 4.15 openshift4/ose-agent-installer-node-agent-rhel9, openshift4/ose-agent-installer-orchestrator-rhel8, openshift4/ose-baremetal-rhel9-operator +4
  • RHSA-2025:4409 Released 2025-05-08 · Red Hat rating Important
    OpenShift Container Platform 4.12.76 bug fix and security update
    • Red Hat OpenShift Container Platform 4.12 openshift4/ose-agent-installer-api-server-rhel8, openshift4/ose-baremetal-rhel8-operator, openshift4/ose-ibm-vpc-block-csi-driver-rhel8 +2
  • RHSA-2025:3798 Released 2025-04-16 · Red Hat rating Important
    OpenShift Container Platform 4.17.25 bug fix and security update
    • Red Hat OpenShift Container Platform 4.17 openshift4/azure-kms-encryption-provider-rhel9, openshift4/ose-agent-installer-node-agent-rhel9, openshift4/ose-aws-cluster-api-controllers-rhel9 +2
  • RHSA-2025:3775 Released 2025-04-16 · Red Hat rating Important
    OpenShift Container Platform 4.18.9 bug fix and security update
    • Red Hat OpenShift Container Platform 4.18 openshift4/azure-kms-encryption-provider-rhel9, openshift4/ose-agent-installer-node-agent-rhel9, openshift4/ose-agent-installer-orchestrator-rhel9 +4
  • RHSA-2025:3453 Released 2025-04-02 · Red Hat rating Important
    Red Hat JBoss Core Services Apache HTTP Server 2.4.62 security update
    • Red Hat JBoss Core Services 2.4.62
  • RHSA-2025:2678 Released 2025-03-12 · Red Hat rating Important
    libxml2 security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) libxml2-devel-2.9.13-9.el9_4
    • Red Hat Enterprise Linux BaseOS EUS (v.9.4) libxml2-2.9.13-9.el9_4, python3-libxml2-2.9.13-9.el9_4
  • RHSA-2025:2507 Released 2025-03-10 · Red Hat rating Important
    libxml2 security update
    • Red Hat Enterprise Linux AppStream EUS (v.8.8) libxml2-devel-2.9.7-16.el8_8.7
    • Red Hat Enterprise Linux BaseOS EUS (v.8.8) libxml2-2.9.7-16.el8_8.7, python3-libxml2-2.9.7-16.el8_8.7
  • RHSA-2025:1925 Released 2025-02-27 · Red Hat rating Important
    Updated service-interconnect rhel9 container images for 1.5
    • Red Hat Service Interconnect 1 service-interconnect/skupper-config-sync-rhel9, service-interconnect/skupper-controller-podman-container-rhel9, service-interconnect/skupper-controller-podman-rhel9 +5
  • RHSA-2025:1517 Released 2025-02-17 · Red Hat rating Moderate
    libxml2 security update
    • Red Hat Enterprise Linux AppStream (v. 8) libxml2-devel-2.9.7-18.el8_10.2
    • Red Hat Enterprise Linux BaseOS (v. 8) libxml2-2.9.7-18.el8_10.2, python3-libxml2-2.9.7-18.el8_10.2
  • RHSA-2025:1516 Released 2025-02-17 · Red Hat rating Important
    libxml2 security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.2) libxml2-devel-2.9.13-3.el9_2.4
    • Red Hat Enterprise Linux BaseOS EUS (v.9.2) libxml2-2.9.13-3.el9_2.4, python3-libxml2-2.9.13-3.el9_2.4
  • RHSA-2025:1487 Released 2025-02-13 · Red Hat rating Important
    updated discovery container images
    • Discovery 1 for RHEL 9 discovery/discovery-server-rhel9, discovery/discovery-ui-rhel9
  • RHSA-2025:1350 Released 2025-02-12 · Red Hat rating Important
    libxml2 security update
    • Red Hat Enterprise Linux AppStream (v. 9) libxml2-devel-2.9.13-6.el9_5.1
    • Red Hat Enterprise Linux BaseOS (v. 9) libxml2-2.9.13-6.el9_5.1, python3-libxml2-2.9.13-6.el9_5.1

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 7AffectedNo fix planned: Will not fix
Discovery 1 for RHEL 9Fixed RHSA-2025:1487
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2025:1517
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2025:1350
Red Hat Enterprise Linux AppStream EUS (v.8.8)Fixed RHSA-2025:2507
Red Hat Enterprise Linux AppStream EUS (v.9.2)Fixed RHSA-2025:1516
Red Hat Enterprise Linux AppStream EUS (v.9.4)Fixed RHSA-2025:2678
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2025:1517
Red Hat Enterprise Linux BaseOS (v. 9)Fixed RHSA-2025:1350
Red Hat Enterprise Linux BaseOS EUS (v.8.8)Fixed RHSA-2025:2507
Red Hat Enterprise Linux BaseOS EUS (v.9.2)Fixed RHSA-2025:1516
Red Hat Enterprise Linux BaseOS EUS (v.9.4)Fixed RHSA-2025:2678
Red Hat JBoss Core Services 2.4.62Fixed RHSA-2025:3453
Red Hat OpenShift Container Platform 4.12Fixed RHSA-2025:4409
Red Hat OpenShift Container Platform 4.13Fixed RHSA-2025:4677
Red Hat OpenShift Container Platform 4.14Fixed RHSA-2025:7702
Red Hat OpenShift Container Platform 4.15Fixed RHSA-2025:4422
Red Hat OpenShift Container Platform 4.16Fixed RHSA-2025:4731
Red Hat OpenShift Container Platform 4.17Fixed RHSA-2025:3798
Red Hat OpenShift Container Platform 4.18Fixed RHSA-2025:3775
Red Hat OpenShift Container Platform 4.19Fixed RHSA-2025:9278
Red Hat Service Interconnect 1Fixed RHSA-2025:1925
Not affected: 7 products
  • Red Hat Enterprise Linux 10
  • Red Hat OpenShift Container Platform 4.12
  • Red Hat OpenShift Container Platform 4.13
  • Red Hat OpenShift Container Platform 4.14
  • Red Hat OpenShift Container Platform 4.15
  • Red Hat OpenShift Container Platform 4.17
  • Red Hat OpenShift Container Platform 4.18

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-49043
  2. 2026-10-03 Alias added: GHSA-84p5-cqqq-h4gr
  3. 2026-10-07 Affected versions changed · Red Hat
  4. 2026-10-09 Fix available: RHSA-2025:3453 · Red Hat
  5. 2026-10-13 Fix available: Red Hat JBoss Core Services 2.4.62 · Red Hat
  6. 2026-11-04 Fix available: RHSA-2025:4422 · Red Hat
  7. 2026-11-04 Fix available: RHSA-2025:4409 · Red Hat
  8. 2026-11-04 Fix available: RHSA-2025:7702 · Red Hat

References

Patch 1

Other 1

  • TI-2020-06117 xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation. CVSS 3.1HIGH 7.5
  • TI-2025-05441 Libxml2: integer overflow in xmlbuildqname() leads to stack buffer overflow in libxml2 CVSS 3.1HIGH 7.5
  • TI-2024-22792 An issue was discovered in xmllint (from libxml2) before 2.11.8 and 2.12.x before 2.12.7. CVSS 3.1HIGH 7.5
  • TI-2017-06514 libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the… CVSS 3.1HIGH 7.5
  • TI-2022-19140 An issue was discovered in libxml2 before 2.10.3. CVSS 3.1HIGH 7.5
  • TI-2025-23491 Out-of-bounds read in xmlsoft libxml2 CVSS 3.1HIGH 7.5
See all 114 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences