CVE-2008-3281
libxml2 2.6.32 and earlier does not properly detect recursion during entity expansion in an...
libxml2 2.6.32 and earlier does not properly detect recursion during entity expansion in an attribute value, which allows context-dependent attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
libxml2 2.6.32 and earlier does not properly detect recursion during entity expansion in an attribute value, which allows context-dependent attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document.
- Record
CVE-2008-3281- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-776
- Updated
- 2026-11-02
CVE List No score
libxml2 2.6.32 and earlier does not properly detect recursion during entity expansion in an attribute value, which allows context-dependent attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document.
- Record
CVE-2008-3281- Updated
- 2026-11-02
EUVDEUVD-2008-3269 No score
libxml2 2.6.32 and earlier does not properly detect recursion during entity expansion in an attribute value, which allows context-dependent attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document.
- Record
EUVD-2008-3269- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-x9c5-c5mj-wjjx
libxml2 2.6.32 and earlier does not properly detect recursion during entity expansion in an...
libxml2 2.6.32 and earlier does not properly detect recursion during entity expansion in an attribute value, which allows context-dependent attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document.
- Record
GHSA-x9c5-c5mj-wjjx- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-776
- Updated
- 2026-11-02
OSV
libxml2 2.6.32 and earlier does not properly detect recursion during entity expansion in an attribute value, which allows context-dependent attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document.
- Record
CVE-2008-3281- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2008-3281
libxml2 2.6.32 and earlier does not properly detect recursion during entity expansion in an attribute value, which allows context-dependent attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document.
- Record
DEBIAN-CVE-2008-3281- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libxml2Debian:12 |
before 2.6.32.dfsg-3 | 2.6.32.dfsg-3 |
libxml2Debian:13 |
before 2.6.32.dfsg-3 | 2.6.32.dfsg-3 |
libxml2Debian:14 |
before 2.6.32.dfsg-3 | 2.6.32.dfsg-3 |
libxml2Debian:4.0 |
before 2.6.27.dfsg-3, plus listed versions 2.6.27.dfsg-12.6.27.dfsg-2 |
2.6.27.dfsg-3 |
libxml2Debian:5.0 |
before 2.6.32.dfsg-2+lenny1 | 2.6.32.dfsg-2+lenny1 |
libxml2Red Hat:enterprise_linux:2.1::as |
before 0:2.4.19-9.ent | 0:2.4.19-9.ent |
libxml2-develRed Hat:enterprise_linux:2.1::as |
before 0:2.4.19-9.ent | 0:2.4.19-9.ent |
libxml2-pythonRed Hat:enterprise_linux:2.1::as |
before 0:2.4.19-9.ent | 0:2.4.19-9.ent |
libxml2Red Hat:enterprise_linux:2.1::aw |
before 0:2.4.19-9.ent | 0:2.4.19-9.ent |
libxml2-develRed Hat:enterprise_linux:2.1::aw |
before 0:2.4.19-9.ent | 0:2.4.19-9.ent |
Show 49 moreShow less
| Package | Affected | Fixed |
|---|---|---|
libxml2-pythonRed Hat:enterprise_linux:2.1::aw |
before 0:2.4.19-9.ent | 0:2.4.19-9.ent |
libxml2Red Hat:enterprise_linux:2.1::es |
before 0:2.4.19-9.ent | 0:2.4.19-9.ent |
libxml2-develRed Hat:enterprise_linux:2.1::es |
before 0:2.4.19-9.ent | 0:2.4.19-9.ent |
libxml2-pythonRed Hat:enterprise_linux:2.1::es |
before 0:2.4.19-9.ent | 0:2.4.19-9.ent |
libxml2Red Hat:enterprise_linux:2.1::ws |
before 0:2.4.19-9.ent | 0:2.4.19-9.ent |
libxml2-develRed Hat:enterprise_linux:2.1::ws |
before 0:2.4.19-9.ent | 0:2.4.19-9.ent |
libxml2-pythonRed Hat:enterprise_linux:2.1::ws |
before 0:2.4.19-9.ent | 0:2.4.19-9.ent |
libxml2Red Hat:enterprise_linux:3::as |
before 0:2.5.10-11 | 0:2.5.10-11 |
libxml2-debuginfoRed Hat:enterprise_linux:3::as |
before 0:2.5.10-11 | 0:2.5.10-11 |
libxml2-develRed Hat:enterprise_linux:3::as |
before 0:2.5.10-11 | 0:2.5.10-11 |
libxml2-pythonRed Hat:enterprise_linux:3::as |
before 0:2.5.10-11 | 0:2.5.10-11 |
libxml2Red Hat:enterprise_linux:3::desktop |
before 0:2.5.10-11 | 0:2.5.10-11 |
libxml2-debuginfoRed Hat:enterprise_linux:3::desktop |
before 0:2.5.10-11 | 0:2.5.10-11 |
libxml2-develRed Hat:enterprise_linux:3::desktop |
before 0:2.5.10-11 | 0:2.5.10-11 |
libxml2-pythonRed Hat:enterprise_linux:3::desktop |
before 0:2.5.10-11 | 0:2.5.10-11 |
libxml2Red Hat:enterprise_linux:3::es |
before 0:2.5.10-11 | 0:2.5.10-11 |
libxml2-debuginfoRed Hat:enterprise_linux:3::es |
before 0:2.5.10-11 | 0:2.5.10-11 |
libxml2-develRed Hat:enterprise_linux:3::es |
before 0:2.5.10-11 | 0:2.5.10-11 |
libxml2-pythonRed Hat:enterprise_linux:3::es |
before 0:2.5.10-11 | 0:2.5.10-11 |
libxml2Red Hat:enterprise_linux:3::ws |
before 0:2.5.10-11 | 0:2.5.10-11 |
libxml2-debuginfoRed Hat:enterprise_linux:3::ws |
before 0:2.5.10-11 | 0:2.5.10-11 |
libxml2-develRed Hat:enterprise_linux:3::ws |
before 0:2.5.10-11 | 0:2.5.10-11 |
libxml2-pythonRed Hat:enterprise_linux:3::ws |
before 0:2.5.10-11 | 0:2.5.10-11 |
libxml2Red Hat:enterprise_linux:4::as |
before 0:2.6.16-12.3 | 0:2.6.16-12.3 |
libxml2-debuginfoRed Hat:enterprise_linux:4::as |
before 0:2.6.16-12.3 | 0:2.6.16-12.3 |
libxml2-develRed Hat:enterprise_linux:4::as |
before 0:2.6.16-12.3 | 0:2.6.16-12.3 |
libxml2-pythonRed Hat:enterprise_linux:4::as |
before 0:2.6.16-12.3 | 0:2.6.16-12.3 |
libxml2Red Hat:enterprise_linux:4::desktop |
before 0:2.6.16-12.3 | 0:2.6.16-12.3 |
libxml2-debuginfoRed Hat:enterprise_linux:4::desktop |
before 0:2.6.16-12.3 | 0:2.6.16-12.3 |
libxml2-develRed Hat:enterprise_linux:4::desktop |
before 0:2.6.16-12.3 | 0:2.6.16-12.3 |
libxml2-pythonRed Hat:enterprise_linux:4::desktop |
before 0:2.6.16-12.3 | 0:2.6.16-12.3 |
libxml2Red Hat:enterprise_linux:4::es |
before 0:2.6.16-12.3 | 0:2.6.16-12.3 |
libxml2-debuginfoRed Hat:enterprise_linux:4::es |
before 0:2.6.16-12.3 | 0:2.6.16-12.3 |
libxml2-develRed Hat:enterprise_linux:4::es |
before 0:2.6.16-12.3 | 0:2.6.16-12.3 |
libxml2-pythonRed Hat:enterprise_linux:4::es |
before 0:2.6.16-12.3 | 0:2.6.16-12.3 |
libxml2Red Hat:enterprise_linux:4::ws |
before 0:2.6.16-12.3 | 0:2.6.16-12.3 |
libxml2-debuginfoRed Hat:enterprise_linux:4::ws |
before 0:2.6.16-12.3 | 0:2.6.16-12.3 |
libxml2-develRed Hat:enterprise_linux:4::ws |
before 0:2.6.16-12.3 | 0:2.6.16-12.3 |
libxml2-pythonRed Hat:enterprise_linux:4::ws |
before 0:2.6.16-12.3 | 0:2.6.16-12.3 |
libxml2Red Hat:enterprise_linux:5::client_workstation |
before 0:2.6.26-2.1.2.4 | 0:2.6.26-2.1.2.4 |
libxml2-debuginfoRed Hat:enterprise_linux:5::client_workstation |
before 0:2.6.26-2.1.2.4 | 0:2.6.26-2.1.2.4 |
libxml2-develRed Hat:enterprise_linux:5::client_workstation |
before 0:2.6.26-2.1.2.4 | 0:2.6.26-2.1.2.4 |
libxml2Red Hat:enterprise_linux:5::client |
before 0:2.6.26-2.1.2.4 | 0:2.6.26-2.1.2.4 |
libxml2-debuginfoRed Hat:enterprise_linux:5::client |
before 0:2.6.26-2.1.2.4 | 0:2.6.26-2.1.2.4 |
libxml2-pythonRed Hat:enterprise_linux:5::client |
before 0:2.6.26-2.1.2.4 | 0:2.6.26-2.1.2.4 |
libxml2Red Hat:enterprise_linux:5::server |
before 0:2.6.26-2.1.2.4 | 0:2.6.26-2.1.2.4 |
libxml2-debuginfoRed Hat:enterprise_linux:5::server |
before 0:2.6.26-2.1.2.4 | 0:2.6.26-2.1.2.4 |
libxml2-develRed Hat:enterprise_linux:5::server |
before 0:2.6.26-2.1.2.4 | 0:2.6.26-2.1.2.4 |
libxml2-pythonRed Hat:enterprise_linux:5::server |
before 0:2.6.26-2.1.2.4 | 0:2.6.26-2.1.2.4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2008-3281 is a medium vulnerability (CVSS 6.5) in Xmlsoft Libxml2, published August 22, 2008. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.51%, the 84th percentile. Fixed in libxml2 2.6.32.dfsg-3.
References
usn.ubuntu.com/644-1
support.apple.com/kb/HT3639
secunia.com/advisories/31855
securitytracker.com/id?1020728
vupen.com/english/advisories/2009/1621
redhat.com/archives/fedora-package-announce/2008-September/msg00347.html
Show 44 moreShow less
rhn.redhat.com/errata/RHSA-2008-0836.html
lists.apple.com/archives/security-announce/2009/jun/msg00002.html
vmware.com/security/advisories/VMSA-2008-0017.html
xmlsoft.org/news.html
securityfocus.com/archive/1/497962/100/0/threaded
ubuntu.com/usn/usn-640-1
security.gentoo.org/glsa/glsa-200812-06.xml
lists.opensuse.org/opensuse-security-announce/2008-09/msg00004.html
wiki.rpath.com/Advisories:rPSA-2008-0325
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6496
mandriva.com/security/advisories?name=MDVSA-2008:192
svn.gnome.org/viewvc/libxml2?view=revision&revision=3772
debian.org/security/2008/dsa-1631
bugzilla.redhat.com/show_bug.cgi?id=458086
mail.gnome.org/archives/xml/2008-August/msg00034.html
lists.vmware.com/pipermail/security-announce/2008/000039.html
nvd.nist.gov/vuln/detail/CVE-2008-3281
github.com/advisories/GHSA-x9c5-c5mj-wjjx
security-tracker.debian.org/tracker/CVE-2008-3281
access.redhat.com/errata/RHSA-2008:0836
security.access.redhat.com/data/csaf/v2/advisories/2008/rhsa-2008_0836.json
cve.org/CVERecord?id=CVE-2008-3281