Skip to content
OpenAdvisories
Medium USN-7743-1 1 CVE

libxml2 vulnerability

Published Sep 10, 2025 · Updated Jun 25, 2026

Ecosystem: Ubuntu

Summary

Nikita Sveshnikov discovered that libxml2 incorrectly handled recursion
when processing XPath expressions. An attacker could possibly use this
issue to cause a denial of service.

Fixed packages 6

ReleasePackageFixed in
Ubuntu · 22.04 LTS 22.04:LTS libxml2 2.9.13+dfsg-1ubuntu0.9
Ubuntu · 24.04 LTS 24.04:LTS libxml2 2.9.14+dfsg-1.3ubuntu3.5
Ubuntu · Pro 14.04 LTS Pro:14.04:LTS libxml2 2.9.1+dfsg1-3ubuntu4.13+esm9
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS libxml2 2.9.3+dfsg1-1ubuntu0.7+esm10
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS libxml2 2.9.4+dfsg1-6.1ubuntu1.9+esm5
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS libxml2 2.9.10+dfsg-5ubuntu0.20.04.10+esm2

Vulnerabilities 1

  • Medium 6.2
    CVE-2025-9714

    Stack overflow in libxml2

    Uncontrolled recursion in XPath evaluation in libxml2 up to and including version 2.9.14 allows a local attacker to cause a stack overflow via crafted expressions. XPath processing functions `xmlXPathRunEval`, `xmlXPathCtxtCompile`, and `xmlXPathEvalExpr` wer…

    libxml2 libxml2 libxml2 libxml2 Debian Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2025-9714