CVE-2025-9714

Uncontrolled recursion in XPath evaluation in libxml2 up to and including version 2.9.14 allows a local attacker to cause a stack overflow via crafted expressions. XPath processing functions xmlXPathRunEval, xmlXPathCtxtCompile, and xmlXPathEvalExpr were resetting recursion depth to zero before making potentially recursive calls. When such functions were called recursively this could allow for uncontrolled recursion and lead to a stack overflow. These functions now preserve recursion depth across recursive calls, allowing recursion depth to be controlled.

Uncontrolled recursion in XPath evaluation in libxml2 up to and including version 2.9.14 allows a local attacker to cause a stack overflow via crafted expressions. XPath processing functions xmlXPathRunEval, xmlXPathCtxtCompile, and xmlXPathEvalExpr were resetting recursion depth to zero before making potentially recursive calls. When such functions were called recursively this could allow for uncontrolled recursion and lead to a stack overflow. These functions now preserve recursion depth across recursive calls, allowing recursion depth to be controlled.

This library allows to manipulate XML files. It includes support to read, modify and write XML and HTML files. There is DTDs support this includes parsing and validation even with complex DtDs, either at parse time or later once the document has been modified. The output can be a simple SAX stream or and in-memory DOM like representations. In this case one can use the built-in XPath and XPointer implementation to select sub nodes or ranges. A flexible Input/Output mechanism is available, with existing HTTP and FTP modules and combined to an URI library.

Security Fix(es):

A flaw was found in libxstl/libxml2. The 'exsltDynMapFunction' function in libexslt/dynamic.c does not contain a recursion depth check, which may cause an infinite loop via a specially crafted XSLT document while handling 'dyn:map()', leading to stack exhaustion and a local denial of service.(CVE-2025-9714)

Libxslt is the XSLT C library developed for the GNOME project

Security Fix(es):

A flaw was found in libxstl/libxml2. The 'exsltDynMapFunction' function in libexslt/dynamic.c does not contain a recursion depth check, which may cause an infinite loop via a specially crafted XSLT document while handling 'dyn:map()', leading to stack exhaustion and a local denial of service.(CVE-2025-9714)

The libxml2 library is a development toolbox providing the implementation of various XML standards.

Security Fix(es):

• libxslt: libxml2: Inifinite recursion at exsltDynMapFunction function in libexslt/dynamic.c (CVE-2025-9714)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The libxml2 library is a development toolbox providing the implementation of various XML standards.

Security Fix(es):

• libxslt: libxml2: Inifinite recursion at exsltDynMapFunction function in libexslt/dynamic.c (CVE-2025-9714)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Uncontrolled recursion in XPath evaluation in libxml2 up to and including version 2.9.14 allows a local attacker to cause a stack overflow via crafted expressions. XPath processing functions xmlXPathRunEval, xmlXPathCtxtCompile, and xmlXPathEvalExpr were resetting recursion depth to zero before making potentially recursive calls. When such functions were called recursively this could allow for uncontrolled recursion and lead to a stack overflow. These functions now preserve recursion depth across recursive calls, allowing recursion depth to be controlled.

The libxml2 library is a development toolbox providing the implementation of various XML standards.

Security Fix(es):

• libxslt: libxml2: Inifinite recursion at exsltDynMapFunction function in libexslt/dynamic.c (CVE-2025-9714)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The libxml2 library is a development toolbox providing the implementation of various XML standards.

Security Fix(es):

• libxslt: libxml2: Inifinite recursion at exsltDynMapFunction function in libexslt/dynamic.c (CVE-2025-9714)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The libxml2 library is a development toolbox providing the implementation of various XML standards.

Security Fix(es):

• libxml2: mingw-libxml2: libxml2: Denial of Service via crafted XML input due to use-after-free (CVE-2026-6653)

Bug Fix(es) and Enhancement(s):

• libxml2: CVE-2025-9714 fix (AlmaLinux-119279) backported wrong upstream commit ? dyn:map recursion still crashes (JIRA:AlmaLinux-249282)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• CVE-2025-9714: preserve recursion depth across recursive calls to prevent stack overflow in XPath evaluation

• SECURITY UPDATE: uncontrolled recursion causing stack overflow via crafted XPath expressions
  • debian/patches/CVE-2025-9714-*.patch: Add comprehensive XPath DoS protection including operation limits, recursion depth controls, and proper handling of recursive invocations to prevent stack overflows and resource exhaustion
  • CVE-2025-9714

• SECURITY UPDATE: uncontrolled recursion leading to stack overflow via crafted XPath expressions
  • debian/patches/CVE-2025-9714.patch: Make XPath depth check work with recursive invocations to prevent stack overflows
  • CVE-2025-9714

• SECURITY UPDATE: uncontrolled recursion causing stack overflow via crafted XPath expressions
  • debian/patches/CVE-2025-9714-*.patch: Add comprehensive XPath DoS protection including operation limits, recursion depth controls, and proper handling of recursive invocations to prevent stack overflows and resource exhaustion
  • CVE-2025-9714

• SECURITY UPDATE: uncontrolled recursion leading to stack overflow via crafted XPath expressions
  • debian/patches/CVE-2025-9714.patch: Make XPath depth check work with recursive invocations to prevent stack overflows
  • CVE-2025-9714

• CVE-2025-9714: additional fixes
• CVE-2025-24928: fix stack-based buffer overflow in xmlSnprintfElements in valid.c
• CVE-2024-56171: fix use-after-free in xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables in xmlschemas.c

• CVE-2025-9714: fix XPath depth check to work with recursive invocations

• revert fixes for CVE-2025-9714 due to build failures due to XPath error

• CVE-2023-29469: guard xmlDictComputeFastKey against namelen <= 0 to prevent out-of-bounds read when hashing zero-length or negative-length keys
• CVE-2023-45322: fix use-after-free in xmlNodeDumpOutputInternal triggered by malformed XML when default error handler interacts with freed memory
• CVE-2024-34459: bound the backwards trim in xmlHTMLPrintFileContext so it cannot overread the buffer when scanning for newline / carriage-return
• CVE-2025-9714: keep and restore XPath context depth across recursive xmlXPathRunEval invocations (EXSLT dyn:map / dyn:evaluate) to avoid stack overflow when the recursion limit was being reset prematurely

• CVE-2023-29469: guard xmlDictComputeFastKey against namelen <= 0 to prevent out-of-bounds read when hashing zero-length or negative-length keys
• CVE-2023-45322: fix use-after-free in xmlNodeDumpOutputInternal triggered by malformed XML when default error handler interacts with freed memory
• CVE-2024-34459: bound the backwards trim in xmlHTMLPrintFileContext so it cannot overread the buffer when scanning for newline / carriage-return
• CVE-2025-9714: keep and restore XPath context depth across recursive xmlXPathRunEval invocations (EXSLT dyn:map / dyn:evaluate) to avoid stack overflow when the recursion limit was being reset prematurely

• CVE-2023-29469: guard xmlDictComputeFastKey against namelen <= 0 to prevent out-of-bounds read when hashing zero-length or negative-length keys
• CVE-2023-45322: fix use-after-free in xmlNodeDumpOutputInternal triggered by malformed XML when default error handler interacts with freed memory
• CVE-2024-34459: bound the backwards trim in xmlHTMLPrintFileContext so it cannot overread the buffer when scanning for newline / carriage-return
• CVE-2025-9714: keep and restore XPath context depth across recursive xmlXPathRunEval invocations (EXSLT dyn:map / dyn:evaluate) to avoid stack overflow when the recursion limit was being reset prematurely

• rebase to 2.9.1-6.0.13.el7_9.6
• replace the TuxCare CVE-2025-9714 backport (Patch229) with the vendor's Patch1007, which guards six evaluation paths where ours guarded three
• CVE-2025-9714: initialise the XPath maxDepth the vendor's patch adds to upstream's XPATH_MAX_RECURSION_DEPTH instead of INT_MAX, which left every recursion guard it adds unreachable
• all other TuxCare CVE patches are unchanged: Patch200-232 remain declared and applied

• rebase to 2.9.1-6.0.13.el7_9.6
• replace the TuxCare CVE-2025-9714 backport (Patch229) with the vendor's Patch1007, which guards six evaluation paths where ours guarded three
• CVE-2025-9714: initialise the XPath maxDepth the vendor's patch adds to upstream's XPATH_MAX_RECURSION_DEPTH instead of INT_MAX, which left every recursion guard it adds unreachable
• all other TuxCare CVE patches are unchanged: Patch200-232 remain declared and applied

• rebase to 2.9.1-6.0.13.el7_9.6
• replace the TuxCare CVE-2025-9714 backport (Patch229) with the vendor's Patch1007, which guards six evaluation paths where ours guarded three
• CVE-2025-9714: initialise the XPath maxDepth the vendor's patch adds to upstream's XPATH_MAX_RECURSION_DEPTH instead of INT_MAX, which left every recursion guard it adds unreachable
• all other TuxCare CVE patches are unchanged: Patch200-232 remain declared and applied

Root has patched CVE-2025-9714 in the rootio-libxml2 package for Root:Debian:12. Multiple fixed versions available.

Root has patched CVE-2025-9714 in the rootio-libxml2 package for Root:Debian:13. Multiple fixed versions available.

This update for libxml2 fixes the following issues:

• CVE-2025-9714: Fixed infinite recursion at exsltDynMapFunction function in libexslt/dynamic.c (bsc#1249076)
• CVE-2025-8732: Fixed infinite recursion in catalog parsing functions when processing malformed SGML catalog files (bsc#1247850)

This update for libxml2 fixes the following issues:

• CVE-2025-9714: Fixed inifinite recursion at exsltDynMapFunction function in libexslt/dynamic.c (bsc#1249076)
• CVE-2025-8732: Fixed infinite recursion in catalog parsing functions when processing malformed SGML catalog files (bsc#1247850)

This update for libxml2 fixes the following issues:

• CVE-2025-9714: Fixed inifinite recursion at exsltDynMapFunction function in libexslt/dynamic.c (bsc#1249076)
• CVE-2025-8732: Fixed infinite recursion in catalog parsing functions when processing malformed SGML catalog files (bsc#1247850)

Nikita Sveshnikov discovered that libxml2 incorrectly handled recursion when processing XPath expressions. An attacker could possibly use this issue to cause a denial of service.