Skip to content
OpenAdvisories
Low · 3.3 CVE-2025-8732 EUVD-2025-24001GHSA-vr42-4x2q-392x

libxml2 xmlcatalog xmlParseSGMLCatalog recursion

Published Aug 8, 2025 · Updated Jun 2, 2026 · Assigned by VulDB

Package: libxml2 Package: libxml2 Package: libxml2 Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Ubuntu

Description

A vulnerability was found in libxml2 up to 2.14.5. It has been declared as problematic. This vulnerability affects the function xmlParseSGMLCatalog of the component xmlcatalog. The manipulation leads to uncontrolled recursion. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The code maintainer explains, that "[t]he issue can only be triggered with untrusted SGML catalogs and it makes absolutely no sense to use untrusted catalogs. I also doubt that anyone is still using SGML catalogs at all."

Affected products

VendorProductAffectedFixed
— libxml2 2.14.0, 2.14.1, 2.14.2, 2.14.3, 2.14.4, 2.14.5 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 libxml2 2.15.2+dfsg-0.1 —
Debian 13 libxml2 2.12.7+dfsg+really2.9.14-2.1+deb13u3 —
Debian 12 libxml2 2.9.14+dfsg-1.3~deb12u6 —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 25.10 libxml2 2.14.5+dfsg-0.2ubuntu0.1 —
Ubuntu 24.04 LTS libxml2 2.9.14+dfsg-1.3ubuntu3.7 —
Ubuntu 22.04 LTS libxml2 2.9.13+dfsg-1ubuntu0.11 —
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 20.04 LTS libxml2 2.9.10+dfsg-5ubuntu0.20.04.10+esm4 —
Ubuntu Pro 18.04 LTS libxml2 2.9.4+dfsg1-6.1ubuntu1.9+esm7 —
Ubuntu Pro 16.04 LTS libxml2 2.9.3+dfsg1-1ubuntu0.7+esm12 —
Ubuntu Pro 14.04 LTS libxml2 2.9.1+dfsg1-3ubuntu4.13+esm11 —

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 libxml2 +1 2.12.10-150700.4.11.1 SUSE-SU-2026:0605-1
SLES 12 SP5 libxml2 +1 2.9.4-46.93.1 SUSE-SU-2025:4104-1
SLES 3 libxml2-python 2.12.10-150700.4.11.1 SUSE-SU-2026:0605-1
Show 9 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 libxml2 +1 2.13.8-160000.4.1 SUSE-SU-2026:20631-1
SLES for SAP 16.0 libxslt 1.1.43-160000.4.1 SUSE-SU-2026:20631-1
SLES 16.0 libxml2 +1 2.13.8-160000.4.1 SUSE-SU-2026:20631-1
SLES 16.0 libxslt 1.1.43-160000.4.1 SUSE-SU-2026:20631-1
SLE Micro 6.2 libxml2 +1 2.13.8-160000.4.1 SUSE-SU-2026:20647-1
SLE Micro 6.2 libxslt 1.1.43-160000.4.1 SUSE-SU-2026:20647-1
SLE Micro 6.1 libxml2 +1 2.11.6-slfo.1.1_8.1 SUSE-SU-2026:20657-1
SLE Micro 6.1 libxslt 1.1.38-slfo.1.1_6.1 SUSE-SU-2026:20657-1
SLE Micro 6.0 libxml2 +1 2.11.6-12.1 SUSE-SU-2026:20707-1
SLE Micro 6.0 libxslt 1.1.38-8.1 SUSE-SU-2026:20707-1
SLE Micro 5.5 libxml2 +1 2.10.3-150500.5.38.1 SUSE-SU-2026:0570-1
SLE Micro 5.4 libxml2 +1 2.9.14-150400.5.50.1 SUSE-SU-2025:4116-1
SLE Micro 5.3 libxml2 +1 2.9.14-150400.5.50.1 SUSE-SU-2025:4116-1
SLE Micro 5.2 libxml2 +1 2.9.7-150000.3.88.1 SUSE-SU-2025:4115-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed libxml2 2.14.5-4.1 openSUSE-SU-2026:10213-1
openSUSE Leap 16.0 libxml2 +1 2.13.8-160000.4.1 openSUSE-SU-2026:20312-1
openSUSE Leap 16.0 libxslt 1.1.43-160000.4.1 openSUSE-SU-2026:20312-1
openSUSE Leap 15.6 libxml2 +1 2.10.3-150500.5.38.1 SUSE-SU-2026:0570-1
openSUSE Leap 15.6 python-libxml2-python 2.9.7-150000.3.88.1 SUSE-SU-2025:4115-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 libxml2 +3 2.10.4-1.amzn2023.0.15 ALAS2023-2026-1360
Amazon Linux 2 libxml2 +3 2.9.1-6.amzn2.5.21 ALAS2-2026-3122

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 libxml2 2.11.5-9 —
Azure Linux 2 (CBL-Mariner) libxml2 2.10.4-11 —

Advisories 16

References