Read the docs
TI-2025-08904 Aliases CVE-2025-9714GHSA-fmj5-rvmp-845r

Stack overflow in libxml2

Priority LOW 27CWE-674Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 43 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-674.

Summary

Uncontrolled recursion in XPath evaluation in libxml2 up to and including version 2.9.14 allows a local attacker to cause a stack overflow via crafted expressions. XPath processing functions `xmlXPathRunEval`, `xmlXPathCtxtCompile`, and `xmlXPathEvalExpr` were resetting recursion depth to zero before making potentially recursive calls. When such functions were called recursively this could allow for uncontrolled recursion and lead to a stack overflow. These functions now preserve recursion depth across recursive calls, allowing recursion depth to be controlled.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00159 5th percentileScored 2026-11-07
Fix Partial libxml2 (libxml2): 2.10.0, 2.12.7+dfsg+really2.9.14-0.4ubuntu0.3, 2.9.14+dfsg-1.3ubuntu3.5 +5Red Hat: 32 advisoriesRed Hat: 43 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
libxml2libxml2before 2.10.0; before 2.12.7+dfsg+really2.9.14-0.4ubuntu0.3; before 2.9.14+dfsg-1.3ubuntu3.5; before 2.9.13+dfsg-1ubuntu0.9; before 2.9.10+dfsg-5ubuntu0.20.04.10+esm2; before 2.9.4+dfsg1-6.1ubuntu1.9+esm5; before 2.9.3+dfsg1-1ubuntu0.7+esm10; before 2.9.1+dfsg1-3ubuntu4.13+esm92.10.0, 2.12.7+dfsg+really2.9.14-0.4ubuntu0.3, 2.9.14+dfsg-1.3ubuntu3.5, 2.9.13+dfsg-1ubuntu0.9, 2.9.10+dfsg-5ubuntu0.20.04.10+esm2, 2.9.4+dfsg1-6.1ubuntu1.9+esm5, 2.9.3+dfsg1-1ubuntu0.7+esm10, 2.9.1+dfsg1-3ubuntu4.13+esm9Patch availableCNA
  • libxml2 Vendorlibxml2 Affected before 2.10.0; before 2.12.7+dfsg+really2.9.14-0.4ubuntu0.3; before 2.9.14+dfsg-1.3ubuntu3.5; before 2.9.13+dfsg-1ubuntu0.9; before 2.9.10+dfsg-5ubuntu0.20.04.10+esm2; before 2.9.4+dfsg1-6.1ubuntu1.9+esm5; before 2.9.3+dfsg1-1ubuntu0.7+esm10; before 2.9.1+dfsg1-3ubuntu4.13+esm9 Fixed in 2.10.0, 2.12.7+dfsg+really2.9.14-0.4ubuntu0.3, 2.9.14+dfsg-1.3ubuntu3.5, 2.9.13+dfsg-1ubuntu0.9, 2.9.10+dfsg-5ubuntu0.20.04.10+esm2, 2.9.4+dfsg1-6.1ubuntu1.9+esm5, 2.9.3+dfsg1-1ubuntu0.7+esm10, 2.9.1+dfsg1-3ubuntu4.13+esm9 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:*before 2.10.0Vulnerablexmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:* Versions before 2.10.0 Vulnerable ·xmlsoft

Remediation

  • Fix · CNA libxml2 (libxml2) Fixed in 2.10.0, 2.12.7+dfsg+really2.9.14-0.4ubuntu0.3, 2.9.14+dfsg-1.3ubuntu3.5, 2.9.13+dfsg-1ubuntu0.9, 2.9.10+dfsg-5ubuntu0.20.04.10+esm2, 2.9.4+dfsg1-6.1ubuntu1.9+esm5, 2.9.3+dfsg1-1ubuntu0.7+esm10, 2.9.1+dfsg1-3ubuntu4.13+esm9

Red Hat 32 advisories

  • RHSA-2026:21695 Released 2026-06-04 · Red Hat rating Important
    OpenShift Container Platform 4.12.91 bug fix and security update
    • Red Hat OpenShift Container Platform 4.12 rhcos-x86_64-412.86.202605271418-0
  • RHSA-2026:22420 Released 2026-06-02 · Red Hat rating Moderate
    libxml2 security update
    • Red Hat Enterprise Linux Server (v. 7 ELS) libxml2-2.9.1-6.el7_9.14, libxml2-2.9.1-6.el7_9.14.ppc, libxml2-devel-2.9.1-6.el7_9.14 +2
    • Red Hat Enterprise Linux Server Optional (v. 7 ELS) libxml2-static-2.9.1-6.el7_9.14, libxml2-static-2.9.1-6.el7_9.14.ppc
  • RHSA-2026:15967 Released 2026-05-11 · Red Hat rating Moderate
    libxml2 security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) libxml2-devel-2.9.7-13.el8_6.13
    • Red Hat Enterprise Linux AppStream E4S (v.8.6) libxml2-devel-2.9.7-13.el8_6.13
    • Red Hat Enterprise Linux AppStream TUS (v.8.6) libxml2-devel-2.9.7-13.el8_6.13
    • Red Hat Enterprise Linux BaseOS AUS (v.8.6) libxml2-2.9.7-13.el8_6.13, python3-libxml2-2.9.7-13.el8_6.13
    • Red Hat Enterprise Linux BaseOS E4S (v.8.6) libxml2-2.9.7-13.el8_6.13, python3-libxml2-2.9.7-13.el8_6.13
    • Red Hat Enterprise Linux BaseOS TUS (v.8.6) libxml2-2.9.7-13.el8_6.13, python3-libxml2-2.9.7-13.el8_6.13
Show 29 more Red Hat advisories
  • RHSA-2026:14858 Released 2026-05-07 · Red Hat rating Moderate
    libxml2 security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) libxml2-devel-2.9.7-16.el8_8.13
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) libxml2-devel-2.9.7-16.el8_8.13
    • Red Hat Enterprise Linux BaseOS E4S (v.8.8) libxml2-2.9.7-16.el8_8.13, python3-libxml2-2.9.7-16.el8_8.13
    • Red Hat Enterprise Linux BaseOS TUS (v.8.8) libxml2-2.9.7-16.el8_8.13, python3-libxml2-2.9.7-16.el8_8.13
  • RHSA-2026:14832 Released 2026-05-07 · Red Hat rating Moderate
    libxml2 security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) libxml2-devel-2.9.7-9.el8_4.9
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) libxml2-devel-2.9.7-9.el8_4.9
    • Red Hat Enterprise Linux BaseOS AUS (v.8.4) libxml2-2.9.7-9.el8_4.9, python3-libxml2-2.9.7-9.el8_4.9
    • Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) libxml2-2.9.7-9.el8_4.9, python3-libxml2-2.9.7-9.el8_4.9
  • RHSA-2026:11349 Released 2026-04-28 · Red Hat rating Moderate
    libxml2 security update
    • Red Hat Enterprise Linux AppStream (v. 8) libxml2-devel-2.9.7-21.el8_10.4
    • Red Hat Enterprise Linux BaseOS (v. 8) libxml2-2.9.7-21.el8_10.4, python3-libxml2-2.9.7-21.el8_10.4
  • RHSA-2026:7519 Released 2026-04-10 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images libxml2-16-2.15.2-0.3.hum1@aarch64, libxml2-16-2.15.2-0.3.hum1@x86_64, libxml2-2.15.2-0.3.hum1@aarch64 +8
  • RHSA-2026:3462 Released 2026-02-27 · Red Hat rating Critical
    Red Hat AI Inference Server 3.2.2 (ROCm)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-rocm-rhel9
  • RHSA-2026:3461 Released 2026-02-27 · Red Hat rating Critical
    Red Hat AI Inference Server 3.2.2 (CUDA)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-cuda-rhel9
  • RHSA-2026:1541 Released 2026-02-05 · Red Hat rating Important
    OpenShift Container Platform 4.15.61 bug fix and security update
    • Red Hat OpenShift Container Platform 4.15 rhcos-aarch64-415.92.202601271320-0, rhcos-ppc64le-415.92.202601271320-0, rhcos-s390x-415.92.202601271320-0 +1
  • RHSA-2026:1539 Released 2026-02-04 · Red Hat rating Moderate
    OpenShift Container Platform 4.19.23 bug fix and security update
    • Red Hat OpenShift Container Platform 4.19 rhcos-aarch64-4.19.9.6.202601260820-0, rhcos-aarch64-9.6.20260123-0, rhcos-ppc64le-4.19.9.6.202601260820-0 +5
  • RHSA-2026:0980 Released 2026-02-03 · Red Hat rating Moderate
    OpenShift Container Platform 4.18.32 bug fix and security update
    • Red Hat OpenShift Container Platform 4.18 rhcos-aarch64-418.94.202601202224-0, rhcos-ppc64le-418.94.202601202224-0, rhcos-s390x-418.94.202601202224-0 +1
  • RHSA-2026:1652 Released 2026-02-02 · Red Hat rating Important
    Red Hat Ceph Storage
    • Red Hat Ceph Storage 8 registry.redhat.io/rhceph/rhceph-8-rhel9
  • RHSA-2026:0996 Released 2026-01-30 · Red Hat rating Important
    OpenShift Container Platform 4.14.61 bug fix and security update
    • Red Hat OpenShift Container Platform 4.14 rhcos-aarch64-414.92.202601191325-0, rhcos-ppc64le-414.92.202601191325-0, rhcos-s390x-414.92.202601191325-0 +1
  • RHSA-2026:0985 Released 2026-01-30 · Red Hat rating Moderate
    OpenShift Container Platform 4.16.56 bug fix and security update
    • Red Hat OpenShift Container Platform 4.16 rhcos-aarch64-416.94.202601160124-0, rhcos-ppc64le-416.94.202601160124-0, rhcos-s390x-416.94.202601160124-0 +1
  • RHSA-2026:0978 Released 2026-01-27 · Red Hat rating Moderate
    OpenShift Container Platform 4.20.12 bug fix and security update
    • Red Hat OpenShift Container Platform 4.20 rhcos-aarch64-4.20.9.6.202601211057-0, rhcos-ppc64le-4.20.9.6.202601211057-0, rhcos-s390x-4.20.9.6.202601211057-0 +1
  • RHSA-2026:0677 Released 2026-01-22 · Red Hat rating Important
    OpenShift Container Platform 4.13.63 bug fix and security update
    • Red Hat OpenShift Container Platform 4.13 rhcos-x86_64-413.92.202601130113-0
  • RHSA-2026:0702 Released 2026-01-22 · Red Hat rating Important
    OpenShift Container Platform 4.17.47 bug fix and security update
    • Red Hat OpenShift Container Platform 4.17 rhcos-aarch64-417.94.202601120213-0, rhcos-ppc64le-417.94.202601120213-0, rhcos-s390x-417.94.202601120213-0 +1
  • RHSA-2026:0414 Released 2026-01-08 · Red Hat rating Important
    A Subscription Management tool for finding and reporting Red Hat product usage
    • Red Hat Discovery 2 registry.redhat.io/discovery/discovery-server-rhel9, registry.redhat.io/discovery/discovery-ui-rhel9
  • RHSA-2025:23449 Released 2025-12-17 · Red Hat rating Important
    Red Hat AI Inference Server 3.2.5 (ROCm)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-rocm-rhel9
  • RHSA-2025:23234 Released 2025-12-16 · Red Hat rating Moderate
    Red Hat Ceph Storage
    • Red Hat Ceph Storage 7 registry.redhat.io/rhceph/rhceph-7-rhel9
  • RHSA-2025:23227 Released 2025-12-16 · Red Hat rating Important
    Red Hat Ceph Storage
    • Red Hat Ceph Storage 8 registry.redhat.io/rhceph/rhceph-8-rhel9
  • RHSA-2025:23209 Released 2025-12-15 · Red Hat rating Important
    Red Hat AI Inference Server 3.2.5 (TPU)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-tpu-rhel9
  • RHSA-2025:23205 Released 2025-12-15 · Red Hat rating Important
    Red Hat AI Inference Server 3.2.5 (ROCm)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-rocm-rhel9
  • RHSA-2025:23204 Released 2025-12-15 · Red Hat rating Important
    Red Hat AI Inference Server 3.2.5 (CUDA)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-cuda-rhel9
  • RHSA-2025:23202 Released 2025-12-15 · Red Hat rating Important
    Red Hat AI Inference Server Model Optimization Tools 3.2.5 (CUDA)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/model-opt-cuda-rhel9
  • RHSA-2025:22868 Released 2025-12-08 · Red Hat rating Important
    Insights proxy Container Image
    • Red Hat Insights proxy 1.5 registry.redhat.io/insights-proxy/insights-proxy-container-rhel9
  • RHSA-2025:22377 Released 2025-12-01 · Red Hat rating Moderate
    libxml2 security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) libxml2-devel-2.9.13-12.el9_6.1
    • Red Hat Enterprise Linux BaseOS EUS (v.9.6) libxml2-2.9.13-12.el9_6.1, python3-libxml2-2.9.13-12.el9_6.1
  • RHSA-2025:22376 Released 2025-12-01 · Red Hat rating Moderate
    libxml2 security update
    • Red Hat Enterprise Linux AppStream (v. 9) libxml2-devel-2.9.13-14.el9_7
    • Red Hat Enterprise Linux BaseOS (v. 9) libxml2-2.9.13-14.el9_7, python3-libxml2-2.9.13-14.el9_7
  • RHSA-2025:22177 Released 2025-11-26 · Red Hat rating Moderate
    libxml2 security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.0) libxml2-devel-2.9.13-1.el9_0.8
    • Red Hat Enterprise Linux BaseOS E4S (v.9.0) libxml2-2.9.13-1.el9_0.8, python3-libxml2-2.9.13-1.el9_0.8
  • RHSA-2025:22163 Released 2025-11-26 · Red Hat rating Moderate
    libxml2 security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) libxml2-devel-2.9.13-13.el9_4
    • Red Hat Enterprise Linux BaseOS EUS (v.9.4) libxml2-2.9.13-13.el9_4, python3-libxml2-2.9.13-13.el9_4
  • RHSA-2025:22162 Released 2025-11-26 · Red Hat rating Moderate
    libxml2 security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) libxml2-devel-2.9.13-3.el9_2.10
    • Red Hat Enterprise Linux BaseOS E4S (v.9.2) libxml2-2.9.13-3.el9_2.10, python3-libxml2-2.9.13-3.el9_2.10

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat AI Inference Server 3.2Fixed RHSA-2025:23202, RHSA-2025:23204, RHSA-2025:23205, RHSA-2025:23209, RHSA-2025:23449, RHSA-2026:3461, RHSA-2026:3462
Red Hat Ceph Storage 7Fixed RHSA-2025:23234
Red Hat Ceph Storage 8Fixed RHSA-2025:23227, RHSA-2026:1652
Red Hat Discovery 2Fixed RHSA-2026:0414
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:11349
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2025:22376
Red Hat Enterprise Linux AppStream AUS (v.8.4)Fixed RHSA-2026:14832
Red Hat Enterprise Linux AppStream AUS (v.8.6)Fixed RHSA-2026:15967
Red Hat Enterprise Linux AppStream E4S (v.8.6)Fixed RHSA-2026:15967
Red Hat Enterprise Linux AppStream E4S (v.8.8)Fixed RHSA-2026:14858
Red Hat Enterprise Linux AppStream E4S (v.9.0)Fixed RHSA-2025:22177
Red Hat Enterprise Linux AppStream E4S (v.9.2)Fixed RHSA-2025:22162
Red Hat Enterprise Linux AppStream EUS (v.9.4)Fixed RHSA-2025:22163
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2025:22377
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)Fixed RHSA-2026:14832
Red Hat Enterprise Linux AppStream TUS (v.8.6)Fixed RHSA-2026:15967
Red Hat Enterprise Linux AppStream TUS (v.8.8)Fixed RHSA-2026:14858
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2026:11349
Red Hat Enterprise Linux BaseOS (v. 9)Fixed RHSA-2025:22376
Red Hat Enterprise Linux BaseOS AUS (v.8.4)Fixed RHSA-2026:14832
Red Hat Enterprise Linux BaseOS AUS (v.8.6)Fixed RHSA-2026:15967
Red Hat Enterprise Linux BaseOS E4S (v.8.6)Fixed RHSA-2026:15967
Red Hat Enterprise Linux BaseOS E4S (v.8.8)Fixed RHSA-2026:14858
Red Hat Enterprise Linux BaseOS E4S (v.9.0)Fixed RHSA-2025:22177
Red Hat Enterprise Linux BaseOS E4S (v.9.2)Fixed RHSA-2025:22162
Red Hat Enterprise Linux BaseOS EUS (v.9.4)Fixed RHSA-2025:22163
Red Hat Enterprise Linux BaseOS EUS (v.9.6)Fixed RHSA-2025:22377
Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)Fixed RHSA-2026:14832
Red Hat Enterprise Linux BaseOS TUS (v.8.6)Fixed RHSA-2026:15967
Red Hat Enterprise Linux BaseOS TUS (v.8.8)Fixed RHSA-2026:14858
Red Hat Enterprise Linux Server (v. 7 ELS)Fixed RHSA-2026:22420
Red Hat Enterprise Linux Server Optional (v. 7 ELS)Fixed RHSA-2026:22420
Red Hat Hardened ImagesFixed RHSA-2026:7519
Red Hat Insights proxy 1.5Fixed RHSA-2025:22868
Red Hat OpenShift Container Platform 4.12Fixed RHSA-2026:21695
Red Hat OpenShift Container Platform 4.13Fixed RHSA-2026:0677
Red Hat OpenShift Container Platform 4.14Fixed RHSA-2026:0996
Red Hat OpenShift Container Platform 4.15Fixed RHSA-2026:1541
Red Hat OpenShift Container Platform 4.16Fixed RHSA-2026:0985
Red Hat OpenShift Container Platform 4.17Fixed RHSA-2026:0702
Red Hat OpenShift Container Platform 4.18Fixed RHSA-2026:0980
Red Hat OpenShift Container Platform 4.19Fixed RHSA-2026:1539
Red Hat OpenShift Container Platform 4.20Fixed RHSA-2026:0978
Not affected: 4 products
  • Red Hat Ceph Storage 7
  • Red Hat Ceph Storage 8
  • Red Hat Enterprise Linux 10
  • Red Hat JBoss Core Services

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-9714
  2. 2026-10-03 Alias added: GHSA-fmj5-rvmp-845r
  3. 2026-10-09 Affected versions changed · Red Hat

References

Patch 1

  • TI-2020-06117 xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation. CVSS 3.1HIGH 7.5
  • TI-2025-05441 Libxml2: integer overflow in xmlbuildqname() leads to stack buffer overflow in libxml2 CVSS 3.1HIGH 7.5
  • TI-2024-22792 An issue was discovered in xmllint (from libxml2) before 2.11.8 and 2.12.x before 2.12.7. CVSS 3.1HIGH 7.5
  • TI-2017-06514 libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the… CVSS 3.1HIGH 7.5
  • TI-2022-19140 An issue was discovered in libxml2 before 2.10.3. CVSS 3.1HIGH 7.5
  • TI-2025-23491 Out-of-bounds read in xmlsoft libxml2 CVSS 3.1HIGH 7.5
See all 114 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences