Description
Uncontrolled recursion in XPath evaluation in libxml2 up to and including version 2.9.14 allows a local attacker to cause a stack overflow via crafted expressions. XPath processing functions `xmlXPathRunEval`, `xmlXPathCtxtCompile`, and `xmlXPathEvalExpr` were resetting recursion depth to zero before making potentially recursive calls. When such functions were called recursively this could allow for uncontrolled recursion and lead to a stack overflow. These functions now preserve recursion depth across recursive calls, allowing recursion depth to be controlled.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| libxml2 | libxml2 | < 2.10.0, < 2.12.7+dfsg+really2.9.14-0.4ubuntu0.3, < 2.9.14+dfsg-1.3ubuntu3.5, < 2.9.13+dfsg-1ubuntu0.9, < 2.9.10+dfsg-5ubuntu0.20.04.10+esm2, < 2.9.4+dfsg1-6.1ubuntu1.9+esm5, < 2.9.3+dfsg1-1ubuntu0.7+esm10, < 2.9.1+dfsg1-3ubuntu4.13+esm9 | 2.10.0 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libxml2 | 2.14.5+dfsg-0.1 | — |
| Debian 13 | libxml2 | 2.12.7+dfsg+really2.9.14-2.1+deb13u2 | — |
| Debian 12 | libxml2 | 2.9.14+dfsg-1.3~deb12u5 | — |
| Debian 11 | libxml2 | 2.9.10+dfsg-6.7+deb11u9 | DLA-4319-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | libxml2 | 2.9.14+dfsg-1.3ubuntu3.5 | USN-7743-1 |
| Ubuntu 22.04 LTS | libxml2 | 2.9.13+dfsg-1ubuntu0.9 | USN-7743-1 |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | libxml2 | 2.9.10+dfsg-5ubuntu0.20.04.10+esm2 | USN-7743-1 |
| Ubuntu Pro 18.04 LTS | libxml2 | 2.9.4+dfsg1-6.1ubuntu1.9+esm5 | USN-7743-1 |
| Ubuntu Pro 16.04 LTS | libxml2 | 2.9.3+dfsg1-1ubuntu0.7+esm10 | USN-7743-1 |
| Ubuntu Pro 14.04 LTS | libxml2 | 2.9.1+dfsg1-3ubuntu4.13+esm9 | USN-7743-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | libxml2 +2 | 2.9.13-14.el9_7 | RHSA-2025:22376 |
| RHEL 8 | libxml2 +2 | 2.9.7-21.el8_10.4 | RHSA-2026:11349 |
Show 13 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9.6 EUS | libxml2 +2 | 2.9.13-12.el9_6.1 | RHSA-2025:22377 |
| RHEL 9.4 EUS | libxml2 +2 | 2.9.13-13.el9_4 | RHSA-2025:22163 |
| RHEL 9.2 E4S | libxml2 +2 | 2.9.13-3.el9_2.10 | RHSA-2025:22162 |
| RHEL 9.0 E4S | libxml2 +2 | 2.9.13-1.el9_0.8 | RHSA-2025:22177 |
| RHEL 8.8 TUS | libxml2 +2 | 2.9.7-16.el8_8.13 | RHSA-2026:14858 |
| RHEL 8.8 E4S | libxml2 +2 | 2.9.7-16.el8_8.13 | RHSA-2026:14858 |
| RHEL 8.6 TUS | libxml2 +2 | 2.9.7-13.el8_6.13 | RHSA-2026:15967 |
| RHEL 8.6 E4S | libxml2 +2 | 2.9.7-13.el8_6.13 | RHSA-2026:15967 |
| RHEL 8.6 AUS | libxml2 +2 | 2.9.7-13.el8_6.13 | RHSA-2026:15967 |
| RHEL 8.4 EUS Long Life | libxml2 +2 | 2.9.7-9.el8_4.9 | RHSA-2026:14832 |
| RHEL 8.4 AUS | libxml2 +2 | 2.9.7-9.el8_4.9 | RHSA-2026:14832 |
| RHEL 7 ELS | libxml2 +3 | 2.9.1-6.el7_9.14 | RHSA-2026:22420 |
| Red Hat Hardened Images 1 | libxml2 +4 | 2.15.2-0.3.hum1 | RHSA-2026:7519 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | libxml2 +2 | 2.9.13-14.el9_7 | ALSA-2025:22376 |
| AlmaLinux 8 | libxml2 +2 | 2.9.7-21.el8_10.4 | ALSA-2026:69655, ALSA-2026:11349 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 9 | libxml2 | 2.9.13-14.el9_7 | RLSA-2025:22376 |
| Rocky Linux 8 | libxml2 | 2.9.7-21.el8_10.4 | RLSA-2026:11349 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP5 | libxml2 +1 | 2.9.4-46.93.1 | SUSE-SU-2025:4104-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLE Micro 5.4 | libxml2 +1 | 2.9.14-150400.5.50.1 | SUSE-SU-2025:4116-1 |
| SLE Micro 5.3 | libxml2 +1 | 2.9.14-150400.5.50.1 | SUSE-SU-2025:4116-1 |
| SLE Micro 5.2 | libxml2 +1 | 2.9.7-150000.3.88.1 | SUSE-SU-2025:4115-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.6 | python-libxml2-python | 2.9.7-150000.3.88.1 | SUSE-SU-2025:4115-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | libxml2 +2 | 2.9.13-14.el9_7 | ELSA-2025-22376 |
| Oracle Linux 8 | libxml2 +2 | 2.9.7-21.el8_10.4 | ELSA-2026-11349 |
| Oracle Linux 7 | libxml2 +3 | 2.9.1-6.0.13.el7_9.6 | ELSA-2026-22420 |
Advisories 30
- WID-SEC-2026-2189 Dell PowerProtect Data Domain: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 2, 2026
- WID-SEC-2025-1948 libxml2 (exsltDynMapFunction): Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Nov 1, 2026
- ALSA-2025:22376 Moderate: libxml2 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:69655 Moderate: libxml2 security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:11349 Moderate: libxml2 security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2026:7519 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2026:22420 Red Hat Security Advisory: libxml2 security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2026:15967 Red Hat Security Advisory: libxml2 security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2026:14858 Red Hat Security Advisory: libxml2 security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2026:14832 Red Hat Security Advisory: libxml2 security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2026:11349 Red Hat Security Advisory: libxml2 security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2025:22377 Red Hat Security Advisory: libxml2 security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2025:22376 Red Hat Security Advisory: libxml2 security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2025:22177 Red Hat Security Advisory: libxml2 security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2025:22163 Red Hat Security Advisory: libxml2 security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2025:22162 Red Hat Security Advisory: libxml2 security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- WID-SEC-2026-2253 IBM Security Verify Access: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 17, 2026
- ELSA-2026-22420 Moderate: libxml2 security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jun 29, 2026
- USN-7743-1 libxml2 vulnerability Ubuntu Security Notices (USN) · Jun 25, 2026
- ICSA-26-134-16 Siemens Ruggedcom Rox CISA ICS & IT advisories · May 14, 2026
- NCSC-2026-0147 Kwetsbaarheden verholpen in Siemens-producten NCSC-NL (Netherlands) · May 13, 2026
- SSA-577017 SSA-577017: Multiple Vulnerabilities in Ruggedcom Rox Before 2.17.1 Siemens ProductCERT · May 12, 2026
- RLSA-2026:11349 Moderate: libxml2 security update Rocky Linux Security Advisories · Apr 29, 2026
- ELSA-2026-11349 Moderate: libxml2 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Apr 28, 2026
- SUSE-SU-2025:4104-1 Security update for libxml2 SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:4115-1 Security update for libxml2 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:4116-1 Security update for libxml2 SUSE / openSUSE Security Updates · Feb 4, 2026
- RLSA-2025:22376 Moderate: libxml2 security update Rocky Linux Security Advisories · Dec 2, 2025
- ELSA-2025-22376 Moderate: libxml2 security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Dec 1, 2025
- DLA-4319-1 libxml2 - security update Debian Security (DSA / DLA) · Sep 30, 2025