CVE-2008-4409: libxml2 2.7.0 and 2.7.1 does not properly… (CVSS 5.0)

Description

libxml2 2.7.0 and 2.7.1 does not properly handle "predefined entities definitions" in entities, which allows context-dependent attackers to cause a denial of service (memory consumption and application crash), as demonstrated by use of xmllint on a certain XML document, a different vulnerability than CVE-2003-1564 and CVE-2008-3281.

Exploit likelihood

8.53%Down 4.0 points since Feb 4, 2022

Affected products

xmlsoft libxml2

Affected packages

Affected packages
Package	Affected	Fixed
`libxml2` openSUSE:Tumbleweed From an advisory covering 32 CVEs	before 2.9.4-1.22	2.9.4-1.22
`python-libxml2` openSUSE:Tumbleweed From an advisory covering 16 CVEs	before 2.9.4-1.4	2.9.4-1.4

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	libxml2 - Denial of Service	2008-10-02

What each source reports

NVD Score used5.0

libxml2 2.7.0 and 2.7.1 does not properly handle "predefined entities definitions" in entities, which allows context-dependent attackers to cause a denial of service (memory consumption and application crash), as demonstrated by use of xmllint on a certain XML document, a different vulnerability than CVE-2003-1564 and CVE-2008-3281.

Record: CVE-2008-4409
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness: CWE-399
Updated: 2026-11-02

CVE ListNo score

libxml2 2.7.0 and 2.7.1 does not properly handle "predefined entities definitions" in entities, which allows context-dependent attackers to cause a denial of service (memory consumption and application crash), as demonstrated by use of xmllint on a certain XML document, a different vulnerability than CVE-2003-1564 and CVE-2008-3281.

Record: CVE-2008-4409
Updated: 2026-11-02

EUVDEUVD-2008-4390No score

libxml2 2.7.0 and 2.7.1 does not properly handle "predefined entities definitions" in entities, which allows context-dependent attackers to cause a denial of service (memory consumption and application crash), as demonstrated by use of xmllint on a certain XML document, a different vulnerability than CVE-2003-1564 and CVE-2008-3281.

Record: EUVD-2008-4390
Updated: 2026-11-03

GitHub AdvisoriesGHSA-34h5-p5c9-pjw6No score

libxml2 2.7.0 and 2.7.1 does not properly handle "predefined entities definitions" in entities,...

libxml2 2.7.0 and 2.7.1 does not properly handle "predefined entities definitions" in entities, which allows context-dependent attackers to cause a denial of service (memory consumption and application crash), as demonstrated by use of xmllint on a certain XML document, a different vulnerability than CVE-2003-1564 and CVE-2008-3281.

Record: GHSA-34h5-p5c9-pjw6
Updated: 2026-11-02

OSVopenSUSE-SU-2024:10192-1No score

libxml2-2-2.9.4-1.22 on GA media

These are all security issues fixed in the libxml2-2-2.9.4-1.22 package on the GA media of openSUSE Tumbleweed.