Description
libxml2 2.9.0 and earlier allows context-dependent attackers to cause a denial of service (CPU and memory consumption) via an XML file containing an entity declaration with long replacement text and many references to this entity, aka "internal entity expansion" with linear complexity.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libxml2 | 2.8.0+dfsg1-7+nmu1 | — |
| Debian 13 | libxml2 | 2.8.0+dfsg1-7+nmu1 | — |
| Debian 12 | libxml2 | 2.8.0+dfsg1-7+nmu1 | — |
| Debian 6.0 | libxml2 | 2.7.8.dfsg-2+squeeze7 | DSA-2652-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | libxml2 +3 | 2.7.6-12.el6_4.1 | RHSA-2013:0581 |
| RHEL 5 | libxml2 +2 | 2.6.26-2.1.21.el5_9.1 | RHSA-2013:0581 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | libxml2 | 2.9.4-1.22 | openSUSE-SU-2024:10192-1 |
Advisories 5
- RHSA-2013:0581 Red Hat Security Advisory: libxml2 security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-2652-1 libxml2 - external entity expansion Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10192-1 libxml2-2-2.9.4-1.22 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2024-3393 libxml2: Schwachstelle ermöglicht Denial Of Service BSI CERT-Bund (WID) · Dec 3, 2024
- WID-SEC-2023-1614 Tenable Security Nessus Network Monitor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 25, 2023
References
- 52662 third-party-advisory
- openSUSE-SU-2013:0555 vendor-advisory
- SUSE-SU-2013:1627 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=912400
- openSUSE-SU-2013:0552 vendor-advisory
- SSRT101996 vendor-advisory
- http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
- DSA-2652 vendor-advisory
- 55568 third-party-advisory
- https://git.gnome.org/browse/libxml2/commit/?id=23f05e0c33987d6605387b300c4be5da2120a7ab
- USN-1782-1 vendor-advisory
- MDVSA-2013:056 vendor-advisory