Description
In libxml2 2.11 before 2.11.9, 2.12 before 2.12.9, and 2.13 before 2.13.3, the SAX parser can produce events for external entities even if custom SAX handlers try to override entity content (by setting "checked"). This makes classic XXE attacks possible.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| libxml2 | libxml2 | 2.11.0 – < 2.11.9, 2.12.0 – < 2.12.9, 2.13.0 – < 2.13.3 | 2.11.9 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | libxml2 +3 | 2.12.5-5.el10_0 | RHBA-2025:6597 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLE Micro 6.1 | libxml2 | 2.11.6-slfo.1.1_5.1 | SUSE-SU-2025:20418-1 |
| SLE Micro 6.0 | libxml2 | 2.11.6-4.1 | SUSE-SU-2025:20116-1 |
| SUSE Package Hub 15 SP6 | qt6-webengine +1 | 6.6.3-bp156.2.3.1 | openSUSE-SU-2025:0024-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | libxml2 | 2.12.9-1.1 | openSUSE-SU-2024:14241-1 |
| openSUSE Tumbleweed | qt6-webengine | 6.8.1-2.1 | openSUSE-SU-2024:14611-1 |
| openSUSE Leap 15.6 | qt6-webengine +1 | 6.6.3-bp156.2.3.1 | openSUSE-SU-2025:0024-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | libxml2 | 2.11.5-2 | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | openjdk-7-jre | No fix yet | — |
Advisories 15
- WID-SEC-2025-0813 Oracle MySQL: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 8, 2026
- RHBA-2025:6597 Red Hat Bug Fix Advisory: libxml2 bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- WID-SEC-2025-0823 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
- WID-SEC-2024-3746 libxml2: Schwachstelle ermöglicht XXE Angriffe BSI CERT-Bund (WID) · Mar 23, 2026
- SUSE-SU-2025:20418-1 Security update for libxml2 SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:20116-1 Security update for libxml2 SUSE / openSUSE Security Updates · Mar 23, 2026
- openSUSE-SU-2024:14241-1 libxml2-2-2.12.9-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:14611-1 libQt6Pdf6-6.8.1-2.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2025:0024-1 Security update for qt6-webengine SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2025-0859 Tenable Security Nessus: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 21, 2025
- NCSC-2025-0132 Kwetsbaarheden verholpen in Oracle MySQL NCSC-NL (Netherlands) · Apr 16, 2025
- NCSC-2025-0128 Kwetsbaarheden verholpen in Oracle Fusion Middleware NCSC-NL (Netherlands) · Apr 16, 2025
- NCSC-2025-0124 Kwetsbaarheden verholpen in Oracle Communications NCSC-NL (Netherlands) · Apr 16, 2025
- WID-SEC-2025-0824 Oracle Communications Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 15, 2025
- WID-SEC-2025-0818 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 15, 2025