Description
Buffer overflow in the (1) nanohttp or (2) nanoftp modules in XMLSoft Libxml 2 (Libxml2) 2.6.0 through 2.6.5 allow remote attackers to execute arbitrary code via a long URL.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 3 | libxml +1 | 1:1.8.17-9.2 | RHSA-2004:650 |
| RHEL 3 | libxml2 +2 | 2.5.10-6 | RHSA-2004:090 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- libxml 2.6.12 nanoftp - Local Buffer Overflow EDB-601 · local · Oct 26, 2004 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 3
- RHSA-2004:650 Red Hat Security Advisory: libxml security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2004:090 Red Hat Security Advisory: libxml2 security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-455 libxml - buffer overflows Debian Security (DSA / DLA) · Mar 9, 2026
References
- oval:org.mitre.oval:def:11626 vdb-entry signature
- oval:org.mitre.oval:def:875 vdb-entry signature
- 20040305 [OpenPKG-SA-2004.003] OpenPKG Security Advisory (libxml) mailing-list
- RHSA-2004:090 vendor-advisory
- libxml2-nanoftp-bo(15302) vdb-entry
- RHSA-2004:091 vendor-advisory
- 9718 vdb-entry
- DSA-455 vendor-advisory
- http://www.xmlsoft.org/news.html
- RHSA-2004:650 vendor-advisory
- O-086 third-party-advisory government-resource
- oval:org.mitre.oval:def:833 vdb-entry signature
- 10958 third-party-advisory
- SUSE-SR:2005:001 vendor-advisory
- GLSA-200403-01 vendor-advisory
- VU#493966 third-party-advisory
- 20040306 TSLSA-2004-0010 - libxml2 mailing-list
- libxml2-nanohttp-bo(15301) vdb-entry