The mxml_write_node function in mxml-file.c in mxml 2.9, 2.7, and possibly earlier allows remote attackers to cause a denial of service (st…

Description

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Advisories 2

• DLA-1641-1 mxml - security update Debian Security (DSA / DLA) · Mar 9, 2026
• SUSE-SU-2017:3060-1 Security update for mxml SUSE / openSUSE Security Updates · Feb 4, 2026

References

• [oss-security] 20160509 Re: CVE requested: two stack exhaustation parsing xml files using mxml mailing-list
• 90315 vdb-entry
• [debian-lts-announce] 20190125 [SECURITY] [DLA 1641-1] mxml security update mailing-list
• [oss-security] 20160511 Re: CVE requested: two stack exhaustation parsing xml files using mxml mailing-list
• https://bugzilla.redhat.com/show_bug.cgi?id=1334648