CVE-2025-24855

Description

numbers.c in libxslt before 1.1.43 has a use-after-free because, in nested XPath evaluations, an XPath context node can be modified but never restored. This is related to xsltNumberFormatGetValue, xsltEvalXPathPredicate, xsltEvalXPathStringNs, and xsltComputeSortResultInternal.

Affected products

Vendor	Product	Affected	Fixed
xmlsoft	libxslt	< 1.1.43	1.1.43

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	libxslt	1.1.35-1.2	—
Debian 13	libxslt	1.1.35-1.2	—
Debian 12	libxslt	1.1.35-1+deb12u1	DSA-5884-1
Debian 11	libxslt	1.1.34-4+deb11u2	DLA-4089-1

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 24.04 LTS	libxslt	1.1.39-0exp1ubuntu0.24.04.2	USN-7361-1
Ubuntu 22.04 LTS	libxslt	1.1.34-4ubuntu0.22.04.3	USN-7361-1
Ubuntu 20.04 LTS	libxslt	1.1.34-4ubuntu0.20.04.3	USN-7361-1

Show 3 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Ubuntu Pro 18.04 LTS	libxslt	1.1.29-5ubuntu0.3+esm2	USN-7787-1
Ubuntu Pro 16.04 LTS	libxslt	1.1.28-2.1ubuntu0.3+esm3	USN-7787-1
Ubuntu Pro 14.04 LTS	libxslt	1.1.28-2ubuntu0.2+esm4	USN-7787-1

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
RHEL 10	libxslt +1	1.1.39-7.el10_0	RHSA-2025:7496
RHEL 9	libxslt +1	1.1.34-9.el9_5.1	RHSA-2025:3107
RHEL 8	libxslt +1	1.1.32-6.1.el8_10	RHSA-2025:3615

Show 12 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
RHEL 9.4 EUS	libxslt +1	1.1.34-10.el9_4	RHSA-2025:3389
RHEL 9.2 EUS	libxslt +1	1.1.34-10.el9_2	RHSA-2025:3528
RHEL 9.0 E4S	libxslt +1	1.1.34-11.el9_0	RHSA-2025:3627
RHEL 8.8 EUS	libxslt +1	1.1.32-8.el8_8	RHSA-2025:3624
RHEL 8.6 TUS	libxslt +1	1.1.32-8.el8_6	RHSA-2025:3625
RHEL 8.6 E4S	libxslt +1	1.1.32-8.el8_6	RHSA-2025:3625
RHEL 8.6 AUS	libxslt +1	1.1.32-8.el8_6	RHSA-2025:3625
RHEL 8.4 TUS	libxslt +1	1.1.32-8.el8_4	RHSA-2025:3626
RHEL 8.4 E4S	libxslt +1	1.1.32-8.el8_4	RHSA-2025:3626
RHEL 8.4 AUS	libxslt +1	1.1.32-8.el8_4	RHSA-2025:3626
RHEL 8.2 AUS	libxslt +1	1.1.32-6.el8_2	RHSA-2025:3619
RHEL 7 ELS	libxslt +2	1.1.28-9.el7_9	RHSA-2025:4098

AlmaLinux

Errata ↗

Release	Package	Fixed in	Advisory
AlmaLinux 10	libxslt +1	1.1.39-7.el10_0	ALSA-2025:7496
AlmaLinux 9	libxslt +1	1.1.34-9.el9_5.1	ALSA-2025:3107
AlmaLinux 8	libxslt +1	1.1.32-6.1.el8_10	ALSA-2025:3615

Rocky Linux

Errata ↗

Release	Package	Fixed in	Advisory
Rocky Linux 10	libxslt	1.1.39-7.el10_0	RLSA-2025:7496
Rocky Linux 8	libxslt	1.1.32-6.1.el8_10	RLSA-2025:3615

SUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
SLES 15 SP6	libxslt	1.1.34-150400.3.6.1	SUSE-SU-2025:1125-1
SLES 15 SP5	libxslt	1.1.34-150400.3.6.1	SUSE-SU-2025:1125-1
SLES 15 SP4	libxslt	1.1.34-150400.3.6.1	SUSE-SU-2025:1125-1
SLES 15 SP3	libxslt	1.1.32-150000.3.17.1	SUSE-SU-2025:1003-1
SLES 12 SP5	libxslt	1.1.28-17.18.1	SUSE-SU-2025:1494-1

Show 16 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
SLES for SAP 15 SP5	libxslt	1.1.34-150400.3.6.1	SUSE-SU-2025:1125-1
SLES for SAP 15 SP4	libxslt	1.1.34-150400.3.6.1	SUSE-SU-2025:1125-1
SLES for SAP 15 SP3	libxslt	1.1.32-150000.3.17.1	SUSE-SU-2025:1003-1
SLE Micro 6.1	libxslt	1.1.38-slfo.1.1_2.1	SUSE-SU-2025:20277-1
SLE Micro 6.0	libxslt	1.1.38-4.1	SUSE-SU-2025:20201-1
SLE Micro 5.5	libxslt	1.1.34-150400.3.6.1	SUSE-SU-2025:1125-1
SLE Micro 5.4	libxslt	1.1.34-150400.3.6.1	SUSE-SU-2025:1125-1
SLE Micro 5.3	libxslt	1.1.34-150400.3.6.1	SUSE-SU-2025:1125-1
SLE Micro 5.2	libxslt	1.1.32-150000.3.17.1	SUSE-SU-2025:1003-1
SLE Micro 5.1	libxslt	1.1.32-150000.3.17.1	SUSE-SU-2025:1003-1
SLE HPC 15 SP5	libxslt	1.1.34-150400.3.6.1	SUSE-SU-2025:1125-1
SLE HPC 15 SP4	libxslt	1.1.34-150400.3.6.1	SUSE-SU-2025:1125-1
SLE HPC 15 SP3	libxslt	1.1.32-150000.3.17.1	SUSE-SU-2025:1003-1
SUSE Manager Server 4.3	libxslt	1.1.34-150400.3.6.1	SUSE-SU-2025:1125-1
SUSE Manager Proxy 4.3	libxslt	1.1.34-150400.3.6.1	SUSE-SU-2025:1125-1
SUSE Enterprise Storage 7.1	libxslt	1.1.32-150000.3.17.1	SUSE-SU-2025:1003-1

openSUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
openSUSE Tumbleweed	libqt5-qtwebengine	5.15.19-1.1	openSUSE-SU-2025:15531-1
openSUSE Tumbleweed	libxslt	1.1.43-1.1	openSUSE-SU-2025:14894-1
openSUSE Leap 15.6	libxslt	1.1.34-150400.3.6.1	SUSE-SU-2025:1125-1
openSUSE Leap 15.6	libxslt-python	1.1.32-150000.3.17.1	SUSE-SU-2025:1003-1

Alpine

Security tracker ↗

Release	Package	Fixed in	Advisory
Alpine v3.24	libxslt	1.1.43-r0	—
Alpine v3.24	qt6-qtwebengine	6.8.2-r3	—
Alpine v3.23	libxslt	1.1.43-r0	—
Alpine v3.23	qt5-qtwebengine	5.15.17-r10	—
Alpine v3.23	qt6-qtwebengine	6.8.2-r3	—
Alpine v3.22	libxslt	1.1.43-r0	—
Alpine v3.22	qt5-qtwebengine	5.15.17-r10	—
Alpine v3.22	qt6-qtwebengine	6.8.2-r3	—
Alpine v3.21	libxslt	1.1.42-r2	—
Alpine v3.21	qt5-qtwebengine	5.15.17-r7	—
Alpine v3.20	libxslt	1.1.39-r2	—

Show 2 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Alpine v3.19	libxslt	1.1.39-r1	—
Alpine v3.18	libxslt	1.1.38-r1	—

Amazon Linux

Release	Package	Fixed in	Advisory
Amazon Linux 2023	libxslt +2	1.1.43-1.amzn2023.0.1	ALAS2023-2025-909
Amazon Linux 2	libxslt +2	1.1.28-6.amzn2.0.3	ALAS2-2025-2823

Azure Linux

Release	Package	Fixed in	Advisory
Azure Linux 3	libxslt	1.1.43-1	—
Azure Linux 2 (CBL-Mariner)	libxslt	1.1.34-8	—

Oracle Linux

Release	Package	Fixed in	Advisory
Oracle Linux 10	libxslt +1	1.1.39-7.el10_0	ELSA-2025-7496
Oracle Linux 9	libxslt +1	1.1.34-9.0.1.el9_5.1	ELSA-2025-3107
Oracle Linux 8	libxslt +1	1.1.32-6.1.0.1.el8_10	ELSA-2025-3615
Oracle Linux 7	libxslt +2	1.1.28-6.0.3.el7	ELSA-2025-4098, ELSA-2025-3612

Wolfi

Release	Package	Fixed in	Advisory
Wolfi rolling	openjdk-7-jre	No fix yet	—

Advisories 41

WID-SEC-2026-2189 Dell PowerProtect Data Domain: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 2, 2026
ALSA-2025:7496 Important: libxslt security update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2025:3107 Important: libxslt security update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2025:3615 Important: libxslt security update AlmaLinux Security Advisories · Oct 29, 2026
RHSA-2025:7496 Red Hat Security Advisory: libxslt security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
RHSA-2025:4098 Red Hat Security Advisory: libxslt security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
RHSA-2025:3626 Red Hat Security Advisory: libxslt security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
RHSA-2025:3627 Red Hat Security Advisory: libxslt security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
RHSA-2025:3624 Red Hat Security Advisory: libxslt security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
RHSA-2025:3625 Red Hat Security Advisory: libxslt security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
RHSA-2025:3619 Red Hat Security Advisory: libxslt security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
RHSA-2025:3615 Red Hat Security Advisory: libxslt security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
RHSA-2025:3528 Red Hat Security Advisory: libxslt security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
RHSA-2025:3389 Red Hat Security Advisory: libxslt security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
RHSA-2025:3107 Red Hat Security Advisory: libxslt security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
WID-SEC-2025-1439 Dell Secure Connect Gateway: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff BSI CERT-Bund (WID) · Oct 11, 2026
WID-SEC-2025-0626 Red Hat Enterprise Linux (libxslt): Schwachstelle ermöglicht Codeausführung oder Manipulation von Dateien BSI CERT-Bund (WID) · Jun 25, 2026
USN-7787-1 libxslt vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
WID-SEC-2025-1569 Oracle Java SE: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 25, 2026
USN-7361-1 libxslt vulnerability Ubuntu Security Notices (USN) · Apr 22, 2026
openSUSE-SU-2025:15531-1 libQt5Pdf5-5.15.19-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
SUSE-SU-2025:1494-1 Security update for libxslt SUSE / openSUSE Security Updates · Mar 23, 2026
SUSE-SU-2025:20277-1 Security update for libxslt SUSE / openSUSE Security Updates · Mar 23, 2026
SUSE-SU-2025:20201-1 Security update for libxslt SUSE / openSUSE Security Updates · Mar 23, 2026
DSA-5884-1 libxslt - security update Debian Security (DSA / DLA) · Mar 9, 2026
DLA-4089-1 libxslt - security update Debian Security (DSA / DLA) · Mar 9, 2026
SUSE-SU-2025:1125-1 Security update for libxslt SUSE / openSUSE Security Updates · Feb 4, 2026
openSUSE-SU-2025:14894-1 libexslt0-1.1.43-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2025:1003-1 Security update for libxslt SUSE / openSUSE Security Updates · Feb 4, 2026
WID-SEC-2025-2587 GitLab: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 14, 2026
WID-SEC-2025-0201 Apple macOS, iPadOS und iOS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 23, 2025
NCSC-2025-0367 Kwetsbaarheden verholpen in GitLab NCSC-NL (Netherlands) · Nov 18, 2025
RLSA-2025:7496 Important: libxslt security update Rocky Linux Security Advisories · Oct 3, 2025
RLSA-2025:3615 Important: libxslt security update Rocky Linux Security Advisories · Jul 29, 2025
ELSA-2025-7496 Important: libxslt security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Jun 26, 2025
ELSA-2025-4098 Important: libxslt security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · May 2, 2025
ELSA-2025-3612 Important: libxslt security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Apr 27, 2025
ALAS2-2025-2823 Important: libxslt security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Apr 16, 2025
ELSA-2025-3615 Important: libxslt security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Apr 7, 2025
ALAS2023-2025-909 Important: libxslt security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Apr 1, 2025
ELSA-2025-3107 Important: libxslt security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Mar 24, 2025

References

https://gitlab.gnome.org/GNOME/libxslt/-/issues/128

CNA	v3.1	7.8
EUVD	v3.1	7.8

numbers.c in libxslt before 1.1.43 has a use-after-free because, in nested XPath evaluations, an XPath context node can be modified but nev…

Description

Affected products

Fixed in Linux distributions

Debian

Ubuntu

Red Hat

AlmaLinux

Rocky Linux

SUSE

openSUSE

Alpine

Amazon Linux

Azure Linux

Oracle Linux

Wolfi

Advisories 41

References