Description
A flaw was found in the libxslt library. The same memory field, psvi, is used for both stylesheet and input data, which can lead to type confusion during XML transformations. This vulnerability allows an attacker to crash the application or corrupt memory. In some cases, it may lead to denial of service or unexpected behavior.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| GNOME | libxslt | < 1.1.44 | 1.1.44 |
| Red Hat | Red Hat Enterprise Linux 10 | — | — |
| Red Hat | Red Hat Hardened Images | — | — |
| Red Hat | Red Hat Enterprise Linux 6 | — | — |
| Red Hat | Red Hat Enterprise Linux 7 | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libxslt | 1.1.35-2 | — |
| Debian 13 | libxslt | 1.1.35-1.2+deb13u1 | DSA-5979-1 |
| Debian 12 | libxslt | 1.1.35-1+deb12u2 | DSA-5979-1 |
| Debian 11 | libxslt | 1.1.34-4+deb11u3 | DLA-4309-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | libxslt | 1.1.39-0exp1ubuntu0.24.04.3 | — |
| Ubuntu 22.04 LTS | libxslt | 1.1.34-4ubuntu0.22.04.5 | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | libxslt | 1.1.34-4ubuntu0.20.04.3+esm2 | — |
| Ubuntu Pro 18.04 LTS | libxslt | 1.1.29-5ubuntu0.3+esm3 | — |
| Ubuntu Pro 16.04 LTS | libxslt | 1.1.28-2.1ubuntu0.3+esm4 | — |
| Ubuntu Pro 14.04 LTS | libxslt | 1.1.28-2ubuntu0.2+esm5 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | libxslt +1 | 1.1.39-8.el10_0 | RHBA-2025:12345 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | libxslt +2 | 1.1.45-0.1.hum1 | RHSA-2026:11015 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLE Micro 6.1 | libxslt | 1.1.38-slfo.1.1_4.1 | SUSE-SU-2025:20661-1 |
| SLE Micro 6.0 | libxslt | 1.1.38-6.1 | SUSE-SU-2025:20556-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | libxslt | 1.1.43-2.1 | openSUSE-SU-2025:15364-1 |
| openSUSE Tumbleweed | python-lxml | 6.1.1-1.1 | openSUSE-SU-2026:11147-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | libxslt +2 | 1.1.43-1.amzn2023.0.2 | ALAS2023-2025-1119 |
| Amazon Linux 2 | libxslt +2 | 1.1.28-6.amzn2.0.5 | ALAS2-2025-2966 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | libxslt | 1.1.43-3 | — |
| Azure Linux 2 (CBL-Mariner) | libxslt | 1.1.34-10 | — |
Advisories 16
- WID-SEC-2026-1287 Red Hat Hardened Images RPMs (libxslt): Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · Nov 10, 2026
- RHBA-2025:12345 Red Hat Bug Fix Advisory: libxml2 and libxslt bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2026:11015 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- WID-SEC-2025-1672 Apple macOS Sequoia, Sonoma und Ventura: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 14, 2026
- openSUSE-SU-2026:11147-1 python-lxml-doc-6.1.1-1.1 on GA media SUSE / openSUSE Security Updates · Jun 30, 2026
- WID-SEC-2025-1668 Apple iOS und iPadOS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 6, 2026
- openSUSE-SU-2025:15364-1 libexslt0-1.1.43-2.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:20661-1 Security update for libxslt SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:20556-1 Security update for libxslt SUSE / openSUSE Security Updates · Mar 23, 2026
- WID-SEC-2025-1683 Apple Safari: Mehrere Schwachstellen BSI CERT-Bund (WID) · Mar 22, 2026
- DSA-5979-1 libxslt - security update Debian Security (DSA / DLA) · Mar 9, 2026
- WID-SEC-2026-0005 NetApp Data ONTAP: Schwachstelle ermöglicht Manipulation von Daten und Denial of Service BSI CERT-Bund (WID) · Jan 4, 2026
- DLA-4309-1 libxslt - security update Debian Security (DSA / DLA) · Sep 25, 2025
- ALAS2-2025-2966 Important: libxslt security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Aug 19, 2025
- ALAS2023-2025-1119 Important: libxslt security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Aug 8, 2025
- NCSC-2025-0238 Kwetsbaarheden verholpen in Apple macOS, iOS en iPadOS NCSC-NL (Netherlands) · Jul 30, 2025
References
- RHBA-2025:12345 vendor-advisory
- RHSA-2026:11015 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2025-7424 vdb-entry
- RHBZ#2379228 issue-tracking
- https://gitlab.gnome.org/GNOME/libxslt/-/issues/139