{"id":"CVE-2022-2309","aliases":["ALPINE-CVE-2022-2309","ALSA-2022:8226","AZL-10058","AZL-10059","BELL-CVE-2022-2309","CLSA-2026-1779225366","CLSA-2026-1791271358","DEBIAN-CVE-2022-2309","DLA-3878-1","EUVD-2022-0148","GHSA-wrxv-2j5q-m38w","MGASA-2022-0331","MGASA-2023-0157","OESA-2022-1790","OESA-2024-1413","OESA-2024-1414","PYSEC-2022-230","RHSA-2022:8226","RLSA-2022:8226","SUSE-SU-2022:2878-1","SUSE-SU-2022:2908-1","UBUNTU-CVE-2022-2309","USN-5760-1","openSUSE-SU-2024:12273-1","openSUSE-SU-2024:12290-1"],"status":"published","title":"NULL Pointer Dereference in lxml/lxml","description":"NULL Pointer Dereference allows attackers to cause a denial of service (or application crash). This only applies when lxml is used together with libxml2 2.9.10 through 2.9.14. libxml2 2.9.9 and earlier are not affected. It allows triggering crashes through forged input data, given a vulnerable code sequence in the application. The vulnerability is caused by the iterwalk function (also used by the canonicalize function). Such code shouldn't be in wide-spread use, given that parsing + iterwalk would usually be replaced with the more efficient iterparse function. However, an XML converter that serialises to C14N would also be vulnerable, for example, and there are legitimate use cases for this code sequence. If untrusted input is received (also remotely) and processed via iterwalk function, a crash can be triggered.","severity":{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.02448,"percentile":0.8448,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-476"],"published":"2022-07-05T09:00:12Z","modified":"2026-11-03T08:01:02Z","fixes":[{"ecosystem":"PyPI","package":"lxml","fixed_in":["4.9.1"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.13","package":"libxml2","fixed_in":["2.9.14-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"libxml2","fixed_in":["2.9.14-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"libxml2","fixed_in":["2.9.14-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"libxml2","fixed_in":["2.9.14-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"libxml2","fixed_in":["2.10.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"libxml2","fixed_in":["2.10.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"libxml2","fixed_in":["2.10.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"libxml2","fixed_in":["2.10.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"libxml2","fixed_in":["2.10.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"libxml2","fixed_in":["2.10.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"libxml2","fixed_in":["2.10.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"libxml2","fixed_in":["2.10.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"py3-lxml","fixed_in":["4.9.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"py3-lxml","fixed_in":["4.9.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"py3-lxml","fixed_in":["4.9.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"py3-lxml","fixed_in":["4.9.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"py3-lxml","fixed_in":["4.9.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"py3-lxml","fixed_in":["4.9.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"py3-lxml","fixed_in":["4.9.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"py3-lxml","fixed_in":["4.9.2-r0"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"python3-lxml","fixed_in":["4.6.5-3.el9"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"libxml2","fixed_in":["2.10.0-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"python-lxml","fixed_in":["4.9.1-1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"libxml2","fixed_in":["2.9.13-12.el9_6.tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"libxml2-devel","fixed_in":["2.9.13-12.el9_6.tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"libxml2-static","fixed_in":["2.9.13-12.el9_6.tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"python3-libxml2","fixed_in":["2.9.13-12.el9_6.tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:PyPI","package":"lxml","fixed_in":["4.6.5.post2+tuxcare"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libxml2","fixed_in":["2.9.14+dfsg-1.3~deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libxml2","fixed_in":["2.9.14+dfsg-1.3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libxml2","fixed_in":["2.9.14+dfsg-1.3"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"lxml","fixed_in":["4.9.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"lxml","fixed_in":["4.9.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"lxml","fixed_in":["4.9.1-1"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"python-lxml","fixed_in":["4.9.1-1.mga8"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"python-lxml","fixed_in":["4.5.2-8.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP3","package":"python-lxml","fixed_in":["4.5.2-8.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"python-lxml","fixed_in":["4.7.1-4.oe2203"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"libxml2","fixed_in":["2.9.10-38.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"libxml2","fixed_in":["2.9.10-40.oe2003sp4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python-lxml","fixed_in":["0:4.6.5-3.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python-lxml-debugsource","fixed_in":["0:4.6.5-3.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python3-lxml","fixed_in":["0:4.6.5-3.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python3-lxml-debuginfo","fixed_in":["0:4.6.5-3.el9"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"python-lxml","fixed_in":["0:4.6.5-3.el9"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15","package":"python-lxml","fixed_in":["4.7.1-150100.6.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"python-lxml","fixed_in":["4.7.1-150200.3.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"python-lxml","fixed_in":["4.7.1-150200.3.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Python 2 15 SP3","package":"python-lxml","fixed_in":["4.7.1-150200.3.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"python-lxml","fixed_in":["4.7.1-150200.3.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"python-lxml","fixed_in":["4.7.1-150200.3.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-BCL","package":"python-lxml","fixed_in":["4.7.1-150200.3.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"python-lxml","fixed_in":["4.7.1-150200.3.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"python-lxml","fixed_in":["4.7.1-150200.3.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 4.1","package":"python-lxml","fixed_in":["4.7.1-150200.3.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"python-lxml","fixed_in":["4.7.1-150200.3.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 4.1","package":"python-lxml","fixed_in":["4.7.1-150200.3.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7","package":"python-lxml","fixed_in":["4.7.1-150200.3.10.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"python-lxml","fixed_in":["4.7.1-150200.3.10.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"python-lxml","fixed_in":["4.7.1-150200.3.10.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"libxml2","fixed_in":["2.9.10+dfsg-5ubuntu0.20.04.5"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"libxml2","fixed_in":["2.9.13+dfsg-1ubuntu0.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"libxml2","fixed_in":["2.10.1-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.14-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.14-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.14-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.14-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"py3-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"py3-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"py3-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"py3-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"py3-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"py3-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"py3-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"py3-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.2-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"python3-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.5-3.el9"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.0-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"python-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.1-1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.13-12.el9_6.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"libxml2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.13-12.el9_6.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"libxml2-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.13-12.el9_6.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"python3-libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.13-12.el9_6.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.6.5"},{"fixed":"4.6.5.post2+tuxcare"}]}],"versions":["4.6.5","4.6.5.post1+tuxcare"]},{"source":"osv","ecosystem":"Debian:12","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.14+dfsg-1.3~deb12u1"}]}],"versions":["2.9.14+dfsg-1.2"]},{"source":"osv","ecosystem":"Debian:13","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.14+dfsg-1.3"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.14+dfsg-1.3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.1-1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.10+dfsg-6.7+deb11u5"}]}],"versions":["2.9.10+dfsg-6.7","2.9.10+dfsg-6.7+deb11u1","2.9.10+dfsg-6.7+deb11u2","2.9.10+dfsg-6.7+deb11u3","2.9.10+dfsg-6.7+deb11u4"],"bundled":2},{"source":"osv","ecosystem":"PyPI","package":"lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.1"}]}],"versions":["1.3.2","1.3.3","1.3.4","1.3.5","1.3.6","2.0","2.0.10","2.0.11","2.0.4","2.0.5","2.0.6","2.0.7","2.0.8","2.0.9","2.1","2.1.1","2.1.2","2.1.3","2.1.4","2.1.5","2.2","2.2.1","2.2.2","2.2.3","2.2.4","2.2.5","2.2.6","2.2.7","2.2.8","2.3","2.3.1","2.3.2","2.3.3","2.3.4","2.3.5","2.3.6","3.0","3.0.2","3.1.0","3.1.1","3.1.2","3.2.0","3.2.1","3.2.2","3.2.3","3.2.4","3.2.5","3.3.0","3.3.1","3.3.2","3.3.3","3.3.4","3.3.5","3.3.6","3.4.0","3.4.1","3.4.2","3.4.3","3.4.4","3.5.0","3.6.0","3.6.1","3.6.2","3.6.3","3.6.4","3.7.0","3.7.1","3.7.2","3.7.3","3.8.0","4.0.0","4.1.0","4.1.1","4.2.0","4.2.1","4.2.2","4.2.3","4.2.4","4.2.5","4.2.6","4.3.0","4.3.2","4.3.3","4.3.4","4.3.5","4.4.0","4.4.1","4.4.2","4.4.3","4.5.0","4.5.1","4.5.2","4.6.0","4.6.1","4.6.2","4.6.3","4.6.4","4.6.5","4.7.1","4.8.0","4.9.0"]},{"source":"osv","ecosystem":"Mageia:8","package":"python-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.1-1.mga8"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.10-7.7.mga8"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"python-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.2-8.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"python-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.2-8.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"python-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.1-4.oe2203"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.10-38.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.10-40.oe2003sp4"}]}]},{"source":"osv","ecosystem":"PyPI","package":"lxml","ranges":[{"type":"GIT","events":[{"introduced":"0"},{"fixed":"86368e9cf70a0ad23cccd5ee32de847149af0c6f"}]},{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.1"}]}],"versions":["0.9","0.9.1","0.9.2","1.0","1.0.1","1.0.2","1.0.3","1.0.4","1.0.beta","1.1","1.1.1","1.1.2","1.1alpha","1.1beta","1.2","1.2.1","1.3","1.3.1","1.3.2","1.3.3","1.3.4","1.3.5","1.3.6","1.3beta","2.0","2.0.1","2.0.10","2.0.11","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.0.8","2.0.9","2.0alpha1","2.0alpha2","2.0alpha3","2.0alpha4","2.0alpha5","2.0alpha6","2.0beta1","2.0beta2","2.1","2.1.1","2.1.2","2.1.3","2.1.4","2.1.5","2.1alpha1","2.1beta1","2.1beta2","2.1beta3","2.2","2.2.1","2.2.2","2.2.3","2.2.4","2.2.5","2.2.6","2.2.7","2.2.8","2.2alpha1","2.2beta1","2.2beta2","2.2beta3","2.2beta4","2.3","2.3.1","2.3.2","2.3.3","2.3.4","2.3.5","2.3.6","2.3alpha1","2.3alpha2","2.3beta1","3.0","3.0.1","3.0.2","3.1.0","3.1.1","3.1.2","3.1beta1","3.2.0","3.2.1","3.2.2","3.2.3","3.2.4","3.2.5","3.3.0","3.3.0beta1","3.3.0beta2","3.3.0beta3","3.3.0beta4","3.3.0beta5","3.3.1","3.3.2","3.3.3","3.3.4","3.3.5","3.3.6","3.4.0","3.4.1","3.4.2","3.4.3","3.4.4","3.5.0","3.5.0b1","3.6.0","3.6.1","3.6.2","3.6.3","3.6.4","3.7.0","3.7.1","3.7.2","3.7.3","3.8.0","4.0.0","4.1.0","4.1.1","4.2.0","4.2.1","4.2.2","4.2.3","4.2.4","4.2.5","4.2.6","4.3.0","4.3.1","4.3.2","4.3.3","4.3.4","4.3.5","4.4.0","4.4.1","4.4.2","4.4.3","4.5.0","4.5.1","4.5.2","4.6.0","4.6.1","4.6.2","4.6.3","4.6.4","4.6.5","4.7.0","4.7.1","4.8.0","4.9.0"]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.5-3.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python-lxml-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.5-3.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python3-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.5-3.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python3-lxml-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.5-3.el9"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"python-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.5-3.el9"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15","package":"python-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.1-150100.6.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"python-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.1-150200.3.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"python-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.1-150200.3.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 2 15 SP3","package":"python-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.1-150200.3.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"python-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.1-150200.3.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"python-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.1-150200.3.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-BCL","package":"python-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.1-150200.3.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"python-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.1-150200.3.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"python-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.1-150200.3.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.1","package":"python-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.1-150200.3.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"python-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.1-150200.3.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 4.1","package":"python-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.1-150200.3.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"python-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.1-150200.3.10.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"python-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.1-150200.3.10.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"python-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.1-150200.3.10.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.2.0-1","3.3.0~beta2-1","3.3.0~beta4-1","3.3.1-1","3.3.2-1","3.3.2-1build1","3.3.3-1","3.3.3-1ubuntu0.1","3.3.3-1ubuntu0.2","3.3.3-1ubuntu0.2+esm1","3.3.3-1ubuntu0.2+esm2","3.3.3-1ubuntu0.2+esm3","3.3.3-1ubuntu0.2+esm5","3.3.3-1ubuntu0.2+esm6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.4.4-1","3.5.0-1","3.5.0-1build1","3.5.0-1ubuntu0.1","3.5.0-1ubuntu0.2","3.5.0-1ubuntu0.3","3.5.0-1ubuntu0.4","3.5.0-1ubuntu0.4+esm2","3.5.0-1ubuntu0.4+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.0.0-1","4.1.0-1","4.2.0-1","4.2.1-1","4.2.1-1ubuntu0.1","4.2.1-1ubuntu0.2","4.2.1-1ubuntu0.3","4.2.1-1ubuntu0.4","4.2.1-1ubuntu0.6","4.2.1-1ubuntu0.6+esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.10+dfsg-5ubuntu0.20.04.5"}]}],"versions":["2.9.4+dfsg1-7ubuntu3","2.9.4+dfsg1-7ubuntu5","2.9.4+dfsg1-8ubuntu1","2.9.4+dfsg1-8ubuntu2","2.9.4+dfsg1-8ubuntu3","2.9.10+dfsg-1ubuntu3","2.9.10+dfsg-4build1","2.9.10+dfsg-5","2.9.10+dfsg-5ubuntu0.20.04.1","2.9.10+dfsg-5ubuntu0.20.04.2","2.9.10+dfsg-5ubuntu0.20.04.3","2.9.10+dfsg-5ubuntu0.20.04.4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.4.1-1","4.4.1-1build1","4.4.2-1","4.5.0-1","4.5.0-1ubuntu0.1","4.5.0-1ubuntu0.2","4.5.0-1ubuntu0.3","4.5.0-1ubuntu0.5","4.5.0-1ubuntu0.5+esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.13+dfsg-1ubuntu0.2"}]}],"versions":["2.9.12+dfsg-4","2.9.12+dfsg-5","2.9.12+dfsg-6","2.9.13+dfsg-1","2.9.13+dfsg-1build1","2.9.13+dfsg-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.6.3+dfsg-0.1","4.6.4-1","4.6.4-1ubuntu1","4.7.1-1","4.8.0-1","4.8.0-1build1","4.8.0-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4+dfsg1-6.1ubuntu1.8"}]}],"versions":["2.9.4+dfsg1-4ubuntu1","2.9.4+dfsg1-5ubuntu1","2.9.4+dfsg1-5ubuntu2","2.9.4+dfsg1-5.1ubuntu1","2.9.4+dfsg1-5.2ubuntu1","2.9.4+dfsg1-6.1ubuntu1","2.9.4+dfsg1-6.1ubuntu1.2","2.9.4+dfsg1-6.1ubuntu1.3","2.9.4+dfsg1-6.1ubuntu1.4","2.9.4+dfsg1-6.1ubuntu1.5","2.9.4+dfsg1-6.1ubuntu1.6","2.9.4+dfsg1-6.1ubuntu1.7"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.10+dfsg-5ubuntu0.20.04.5"}]}],"versions":["2.9.4+dfsg1-7ubuntu3","2.9.4+dfsg1-7ubuntu5","2.9.4+dfsg1-8ubuntu1","2.9.4+dfsg1-8ubuntu2","2.9.4+dfsg1-8ubuntu3","2.9.10+dfsg-1ubuntu3","2.9.10+dfsg-4build1","2.9.10+dfsg-5","2.9.10+dfsg-5ubuntu0.20.04.1","2.9.10+dfsg-5ubuntu0.20.04.2","2.9.10+dfsg-5ubuntu0.20.04.3","2.9.10+dfsg-5ubuntu0.20.04.4"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.13+dfsg-1ubuntu0.2"}]}],"versions":["2.9.12+dfsg-4","2.9.12+dfsg-5","2.9.12+dfsg-6","2.9.13+dfsg-1","2.9.13+dfsg-1build1","2.9.13+dfsg-1ubuntu0.1"],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.1-1.1"}]}]}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"lxml","product":"lxml"},{"vendor":"lxml","product":"lxml/lxml"}],"references":[{"url":"https://huntr.dev/bounties/8264e74f-edda-4c40-9956-49de635105ba","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Issue Tracking","Patch","Third Party Advisory","web","report"]},{"url":"https://github.com/lxml/lxml/commit/86368e9cf70a0ad23cccd5ee32de847149af0c6f","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://security.gentoo.org/glsa/202208-06","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://security.netapp.com/advisory/ntap-20220915-0006/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/URHHSIBTPTALXMECRLAC2EVDNAFSR5NO/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HGYC6L7ENH5VEGN3YWFBYMGKX6WNS7HZ/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/09/msg00021.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-2309","tags":["web","advisory"]},{"url":"https://github.com/lxml/lxml/blob/master/CHANGES.txt","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/lxml/PYSEC-2022-230.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-wrxv-2j5q-m38w","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HGYC6L7ENH5VEGN3YWFBYMGKX6WNS7HZ","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/URHHSIBTPTALXMECRLAC2EVDNAFSR5NO","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20220915-0006","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HGYC6L7ENH5VEGN3YWFBYMGKX6WNS7HZ","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/URHHSIBTPTALXMECRLAC2EVDNAFSR5NO","tags":["web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2022-2309","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:8226","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-2309","tags":["report"]},{"url":"https://bugzilla.redhat.com/2107571","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2022-8226.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2022-2309","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1779225366.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/2xxx/CVE-2022-2309.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-2309","tags":["advisory"]},{"url":"https://github.com/lxml/lxml","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2022-0331.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=30772","tags":["report"]},{"url":"https://lists.suse.com/pipermail/sle-security-updates/2022-August/011973.html","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2023-0157.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=31810","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/O2AHHHTXMCLOVEDOB7VUJWRWH5RXZTEG/","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-5760-1","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=31231","tags":["report"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1790","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1413","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1414","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.1_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2107571","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_8226.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-2309","tags":["advisory","report"]},{"url":"https://errata.rockylinux.org/RLSA-2022:8226","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20222878-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1201253","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-2309","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20222908-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-2309","tags":["report"]},{"url":"https://huntr.dev/bounties/8264e74f-edda-4c40-9956-49de635105ba/","tags":["report"]},{"url":"https://gitlab.gnome.org/GNOME/libxml2/-/issues/378","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6028-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-40303","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-40304","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-2309","title":"NULL Pointer Dereference in lxml/lxml","description":"NULL Pointer Dereference allows attackers to cause a denial of service (or application crash). This only applies when lxml is used together with libxml2 2.9.10 through 2.9.14. libxml2 2.9.9 and earlier are not affected. It allows triggering crashes through forged input data, given a vulnerable code sequence in the application. The vulnerability is caused by the iterwalk function (also used by the canonicalize function). Such code shouldn't be in wide-spread use, given that parsing + iterwalk would usually be replaced with the more efficient iterparse function. However, an XML converter that serialises to C14N would also be vulnerable, for example, and there are legitimate use cases for this code sequence. If untrusted input is received (also remotely) and processed via iterwalk function, a crash can be triggered.","status":"published","published":"2022-07-05T09:00:12Z","modified":"2025-11-04T16:09:31.952Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:34:32.495407Z"}],"euvd":[{"id":"EUVD-2022-0148","description":"NULL Pointer Dereference allows attackers to cause a denial of service (or application crash). This only applies when lxml is used together with libxml2 2.9.10 through 2.9.14. libxml2 2.9.9 and earlier are not affected. It allows triggering crashes through forged input data, given a vulnerable code sequence in the application. The vulnerability is caused by the iterwalk function (also used by the canonicalize function). Such code shouldn't be in wide-spread use, given that parsing + iterwalk would usually be replaced with the more efficient iterparse function. However, an XML converter that serialises to C14N would also be vulnerable, for example, and there are legitimate use cases for this code sequence. If untrusted input is received (also remotely) and processed via iterwalk function, a crash can be triggered.","status":"published","published":"2022-07-05T09:00:12Z","modified":"2025-11-04T16:09:31Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T19:49:29.391161Z"}],"ghsa":[{"id":"GHSA-wrxv-2j5q-m38w","title":"lxml NULL Pointer Dereference allows attackers to cause a denial of service","description":"NULL Pointer Dereference allows attackers to cause a denial of service (or application crash). This only applies when lxml is used together with libxml2 2.9.10 through 2.9.14. libxml2 2.9.9 and earlier are not affected. It allows triggering crashes through forged input data, given a vulnerable code sequence in the application. The vulnerability is caused by the iterwalk function (also used by the canonicalize function). Such code shouldn't be in wide-spread use, given that parsing + iterwalk would usually be replaced with the more efficient iterparse function. However, an XML converter that serialises to C14N would also be vulnerable, for example, and there are legitimate use cases for this code sequence. If untrusted input is received (also remotely) and processed via iterwalk function, a crash can be triggered.","status":"published","published":"2022-07-06T00:00:30Z","modified":"2025-11-04T19:36:23Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"},{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:39:06.376137Z"}],"nvd":[{"id":"CVE-2022-2309","description":"NULL Pointer Dereference allows attackers to cause a denial of service (or application crash). This only applies when lxml is used together with libxml2 2.9.10 through 2.9.14. libxml2 2.9.9 and earlier are not affected. It allows triggering crashes through forged input data, given a vulnerable code sequence in the application. The vulnerability is caused by the iterwalk function (also used by the canonicalize function). Such code shouldn't be in wide-spread use, given that parsing + iterwalk would usually be replaced with the more efficient iterparse function. However, an XML converter that serialises to C14N would also be vulnerable, for example, and there are legitimate use cases for this code sequence. If untrusted input is received (also remotely) and processed via iterwalk function, a crash can be triggered.","status":"published","published":"2022-07-05T10:15:08.763Z","modified":"2026-06-17T04:41:40.237Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:07:22.966735Z"}],"osv":[{"id":"ALPINE-CVE-2022-2309","description":"NULL Pointer Dereference allows attackers to cause a denial of service (or application crash). This only applies when lxml is used together with libxml2 2.9.10 through 2.9.14. libxml2 2.9.9 and earlier are not affected. It allows triggering crashes through forged input data, given a vulnerable code sequence in the application. The vulnerability is caused by the iterwalk function (also used by the canonicalize function). Such code shouldn't be in wide-spread use, given that parsing + iterwalk would usually be replaced with the more efficient iterparse function. However, an XML converter that serialises to C14N would also be vulnerable, for example, and there are legitimate use cases for this code sequence. If untrusted input is received (also remotely) and processed via iterwalk function, a crash can be triggered.","status":"published","published":"2022-07-05T10:15:08.763Z","modified":"2026-11-03T07:18:33.111303862Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T07:51:12.284675Z"},{"id":"AZL-10058","title":"CVE-2022-2309 affecting package libxml2 for versions less than 2.10.0-1","description":"NULL Pointer Dereference allows attackers to cause a denial of service (or application crash). This only applies when lxml is used together with libxml2 2.9.10 through 2.9.14. libxml2 2.9.9 and earlier are not affected. It allows triggering crashes through forged input data, given a vulnerable code sequence in the application. The vulnerability is caused by the iterwalk function (also used by the canonicalize function). Such code shouldn't be in wide-spread use, given that parsing + iterwalk would usually be replaced with the more efficient iterparse function. However, an XML converter that serialises to C14N would also be vulnerable, for example, and there are legitimate use cases for this code sequence. If untrusted input is received (also remotely) and processed via iterwalk function, a crash can be triggered.","status":"published","published":"2022-07-05T10:15:08Z","modified":"2026-04-21T04:19:49.166242Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:00.253976Z"},{"id":"AZL-10059","title":"CVE-2022-2309 affecting package python-lxml for versions less than 4.9.1-1","description":"NULL Pointer Dereference allows attackers to cause a denial of service (or application crash). This only applies when lxml is used together with libxml2 2.9.10 through 2.9.14. libxml2 2.9.9 and earlier are not affected. It allows triggering crashes through forged input data, given a vulnerable code sequence in the application. The vulnerability is caused by the iterwalk function (also used by the canonicalize function). Such code shouldn't be in wide-spread use, given that parsing + iterwalk would usually be replaced with the more efficient iterparse function. However, an XML converter that serialises to C14N would also be vulnerable, for example, and there are legitimate use cases for this code sequence. If untrusted input is received (also remotely) and processed via iterwalk function, a crash can be triggered.","status":"published","published":"2022-07-05T10:15:08Z","modified":"2026-04-21T04:19:49.142179Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:00.253976Z"},{"id":"BELL-CVE-2022-2309","title":"CVE-2022-2309 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:13:44.245025Z","modified":"2026-01-26T09:45:40.576816Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:16.5265Z"},{"id":"CVE-2022-2309","title":"NULL Pointer Dereference in lxml/lxml","description":"NULL Pointer Dereference allows attackers to cause a denial of service (or application crash). This only applies when lxml is used together with libxml2 2.9.10 through 2.9.14. libxml2 2.9.9 and earlier are not affected. It allows triggering crashes through forged input data, given a vulnerable code sequence in the application. The vulnerability is caused by the iterwalk function (also used by the canonicalize function). Such code shouldn't be in wide-spread use, given that parsing + iterwalk would usually be replaced with the more efficient iterparse function. However, an XML converter that serialises to C14N would also be vulnerable, for example, and there are legitimate use cases for this code sequence. If untrusted input is received (also remotely) and processed via iterwalk function, a crash can be triggered.","status":"published","published":"2022-07-05T09:00:12Z","modified":"2026-10-28T02:30:44.608553405Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T15:44:24.061177Z"},{"id":"DEBIAN-CVE-2022-2309","description":"NULL Pointer Dereference allows attackers to cause a denial of service (or application crash). This only applies when lxml is used together with libxml2 2.9.10 through 2.9.14. libxml2 2.9.9 and earlier are not affected. It allows triggering crashes through forged input data, given a vulnerable code sequence in the application. The vulnerability is caused by the iterwalk function (also used by the canonicalize function). Such code shouldn't be in wide-spread use, given that parsing + iterwalk would usually be replaced with the more efficient iterparse function. However, an XML converter that serialises to C14N would also be vulnerable, for example, and there are legitimate use cases for this code sequence. If untrusted input is received (also remotely) and processed via iterwalk function, a crash can be triggered.","status":"published","published":"2022-07-05T10:15:08.763Z","modified":"2026-11-03T08:01:02.461512647Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T08:25:01.007408Z"},{"id":"GHSA-wrxv-2j5q-m38w","title":"lxml NULL Pointer Dereference allows attackers to cause a denial of service","description":"NULL Pointer Dereference allows attackers to cause a denial of service (or application crash). This only applies when lxml is used together with libxml2 2.9.10 through 2.9.14. libxml2 2.9.9 and earlier are not affected. It allows triggering crashes through forged input data, given a vulnerable code sequence in the application. The vulnerability is caused by the iterwalk function (also used by the canonicalize function). Such code shouldn't be in wide-spread use, given that parsing + iterwalk would usually be replaced with the more efficient iterparse function. However, an XML converter that serialises to C14N would also be vulnerable, for example, and there are legitimate use cases for this code sequence. If untrusted input is received (also remotely) and processed via iterwalk function, a crash can be triggered.","status":"published","published":"2022-07-06T00:00:30Z","modified":"2025-11-04T20:44:22.372909Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"},{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T15:46:59.131095Z"},{"id":"OESA-2022-1790","title":"python-lxml security update","description":"The lxml XML toolkit is a Pythonic binding for the C libraries libxml2 and libxslt. \\ It is unique in that it combines the speed and XML feature completeness of these libraries with \\ the simplicity of a native Python API, mostly compatible but superior to the well-known ElementTree API. \\ The latest release works with all CPython versions from 2.7 to 3.7.\r\n\r\nSecurity Fix(es):\r\n\r\nNULL Pointer Dereference allows attackers to cause a denial of service (or application crash). This only applies when lxml is used together with libxml2 2.9.10 through 2.9.14. libxml2 2.9.9 and earlier are not affected. It allows triggering crashes through forged input data, given a vulnerable code sequence in the application. The vulnerability is caused by the iterwalk function (also used by the canonicalize function). Such code shouldn\u0026apos;t be in wide-spread use, given that parsing + iterwalk would usually be replaced with the more efficient iterparse function. However, an XML converter that serialises to C14N would also be vulnerable, for example, and there are legitimate use cases for this code sequence. If untrusted input is received (also remotely) and processed via iterwalk function, a crash can be triggered.(CVE-2022-2309)","status":"published","published":"2022-07-30T11:05:03Z","modified":"2026-08-18T01:16:53.186454762Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"OESA-2024-1413","title":"libxml2 security update","description":"This library allows to manipulate XML files. It includes support to read, modify and write XML and HTML files. There is DTDs support this includes parsing and validation even with complex DtDs, either at parse time or later once the document has been modified. The output can be a simple SAX stream or and in-memory DOM like representations. In this case one can use the built-in XPath and XPointer implementation to select sub nodes or ranges. A flexible Input/Output mechanism is available, with existing HTTP and FTP modules and combined to an URI library.\r\n\r\nSecurity Fix(es):\r\n\r\nNULL Pointer Dereference allows attackers to cause a denial of service (or application crash). This only applies when lxml is used together with libxml2 2.9.10 through 2.9.14. libxml2 2.9.9 and earlier are not affected. It allows triggering crashes through forged input data, given a vulnerable code sequence in the application. The vulnerability is caused by the iterwalk function (also used by the canonicalize function). Such code shouldn\u0026apos;t be in wide-spread use, given that parsing + iterwalk would usually be replaced with the more efficient iterparse function. However, an XML converter that serialises to C14N would also be vulnerable, for example, and there are legitimate use cases for this code sequence. If untrusted input is received (also remotely) and processed via iterwalk function, a crash can be triggered.(CVE-2022-2309)","status":"published","published":"2024-04-12T11:06:51Z","modified":"2026-08-18T01:18:20.721499904Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"OESA-2024-1414","title":"libxml2 security update","description":"This library allows to manipulate XML files. It includes support to read, modify and write XML and HTML files. There is DTDs support this includes parsing and validation even with complex DtDs, either at parse time or later once the document has been modified. The output can be a simple SAX stream or and in-memory DOM like representations. In this case one can use the built-in XPath and XPointer implementation to select sub nodes or ranges. A flexible Input/Output mechanism is available, with existing HTTP and FTP modules and combined to an URI library.\r\n\r\nSecurity Fix(es):\r\n\r\nNULL Pointer Dereference allows attackers to cause a denial of service (or application crash). This only applies when lxml is used together with libxml2 2.9.10 through 2.9.14. libxml2 2.9.9 and earlier are not affected. It allows triggering crashes through forged input data, given a vulnerable code sequence in the application. The vulnerability is caused by the iterwalk function (also used by the canonicalize function). Such code shouldn\u0026apos;t be in wide-spread use, given that parsing + iterwalk would usually be replaced with the more efficient iterparse function. However, an XML converter that serialises to C14N would also be vulnerable, for example, and there are legitimate use cases for this code sequence. If untrusted input is received (also remotely) and processed via iterwalk function, a crash can be triggered.(CVE-2022-2309)","status":"published","published":"2024-04-12T11:06:51Z","modified":"2026-08-18T01:18:20.732578766Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"RHSA-2022:8226","title":"Red Hat Security Advisory: python-lxml security update","status":"published","published":"2024-09-16T08:41:08Z","modified":"2025-11-22T12:41:14Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.139266Z"},{"id":"RLSA-2022:8226","title":"Moderate: python-lxml security update","description":"lxml is an XML processing library providing access to libxml2 and libxslt libraries using the Python ElementTree API. \n\nSecurity Fix(es):\n\n* lxml: NULL Pointer Dereference in lxml (CVE-2022-2309)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 9.1 Release Notes linked from the References section.","status":"published","published":"2022-11-15T06:18:49Z","modified":"2025-10-09T05:47:16.459943Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:24.322216Z"},{"id":"UBUNTU-CVE-2022-2309","description":"NULL Pointer Dereference allows attackers to cause a denial of service (or application crash). This only applies when lxml is used together with libxml2 2.9.10 through 2.9.14. libxml2 2.9.9 and earlier are not affected. It allows triggering crashes through forged input data, given a vulnerable code sequence in the application. The vulnerability is caused by the iterwalk function (also used by the canonicalize function). Such code shouldn't be in wide-spread use, given that parsing + iterwalk would usually be replaced with the more efficient iterparse function. However, an XML converter that serialises to C14N would also be vulnerable, for example, and there are legitimate use cases for this code sequence. If untrusted input is received (also remotely) and processed via iterwalk function, a crash can be triggered.","status":"published","published":"2022-07-05T10:15:00Z","modified":"2026-10-08T12:50:14.335895552Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:53:53.13624Z"},{"id":"ALSA-2022:8226","title":"Moderate: python-lxml security update","description":"lxml is an XML processing library providing access to libxml2 and libxslt libraries using the Python ElementTree API. \n\nSecurity Fix(es):\n\n* lxml: NULL Pointer Dereference in lxml (CVE-2022-2309)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2022-11-15T00:00:00Z","modified":"2026-10-29T11:31:20.124174272Z","updated_at":"2026-11-02T15:27:51.655726Z"},{"id":"CLSA-2026-1779225366","title":"libxml2: Fix of CVE-2022-2309","description":"- CVE-2022-2309: reset nsNr in xmlCtxtReset and htmlCtxtReset to prevent\n  NULL pointer dereference / DoS triggered via crafted XML or HTML input\n  reused across parser context resets","status":"published","published":"2026-05-19T21:16:10Z","modified":"2026-06-01T00:32:53.555339306Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"CLSA-2026-1791271358","title":"TuxCare security update for lxml (1 CVE)","description":"TuxCare rebuilt lxml to address 1 CVE. Fixed in 4.6.5.post2+tuxcare.","status":"published","published":"2026-10-06T07:22:38Z","modified":"2026-10-15T09:48:07.240987408Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"DLA-3878-1","title":"libxml2 - security update","status":"published","published":"2024-09-05T00:00:00Z","modified":"2026-03-09T01:20:38.676387Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"MGASA-2022-0331","title":"Updated python-lxml packages fix security vulnerability","description":"NULL pointer dereference due to state leak between parser runs\n(CVE-2022-2309)\n","status":"published","published":"2022-09-16T19:39:55Z","modified":"2026-04-16T04:42:31.025414506Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"MGASA-2023-0157","title":"Updated libxml2 packages fix security vulnerability","description":"NULL Pointer Dereference allows attackers to cause a denial of service (or\napplication crash). This only applies when lxml is used together with\nlibxml2 2.9.10 through 2.9.14. libxml2 2.9.9 and earlier are not affected.\nIt allows triggering crashes through forged input data, given a vulnerable\ncode sequence in the application. The vulnerability is caused by the\niterwalk function (also used by the canonicalize function). Such code\nshouldn't be in wide-spread use, given that parsing + iterwalk would\nusually be replaced with the more efficient iterparse function. However,\nan XML converter that serialises to C14N would also be vulnerable, for\nexample, and there are legitimate use cases for this code sequence. If\nuntrusted input is received (also remotely) and processed via iterwalk\nfunction, a crash can be triggered. (CVE-2022-2309)\nNULL dereference in xmlSchemaFixupComplexType. (CVE-2023-28484)\nHashing of empty dict strings isn't deterministic. (CVE-2023-29469)\n","status":"published","published":"2023-05-06T18:19:07Z","modified":"2026-04-16T04:42:34.157083933Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"openSUSE-SU-2024:12273-1","title":"python-lxml-doc-4.9.1-2.1 on GA media","description":"These are all security issues fixed in the python-lxml-doc-4.9.1-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:45:51.326393Z","updated_at":"2026-11-02T16:58:35.485255Z"},{"id":"openSUSE-SU-2024:12290-1","title":"libxml2-2-2.10.1-1.1 on GA media","description":"These are all security issues fixed in the libxml2-2-2.10.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:14:29.989567Z","updated_at":"2026-11-02T16:58:35.485255Z"},{"id":"PYSEC-2022-230","description":"NULL Pointer Dereference allows attackers to cause a denial of service (or application crash). This only applies when lxml is used together with libxml2 2.9.10 through 2.9.14. libxml2 2.9.9 and earlier are not affected. It allows triggering crashes through forged input data, given a vulnerable code sequence in the application. The vulnerability is caused by the iterwalk function (also used by the canonicalize function). Such code shouldn't be in wide-spread use, given that parsing + iterwalk would usually be replaced with the more efficient iterparse function. However, an XML converter that serialises to C14N would also be vulnerable, for example, and there are legitimate use cases for this code sequence. If untrusted input is received (also remotely) and processed via iterwalk function, a crash can be triggered.","status":"published","published":"2022-07-05T10:15:00Z","modified":"2023-11-08T04:08:16.338038Z","updated_at":"2026-11-02T15:52:53.449407Z"},{"id":"SUSE-SU-2022:2878-1","title":"Security update for python-lxml","description":"This update for python-lxml fixes the following issues:\n\n- CVE-2022-2309: Fixed NULL pointer dereference due to state leak between parser runs (bsc#1201253).\n","status":"published","published":"2022-08-23T11:51:31Z","modified":"2026-02-04T03:00:25.007663Z","updated_at":"2026-11-02T15:53:50.965375Z"},{"id":"SUSE-SU-2022:2908-1","title":"Security update for python-lxml","description":"This update for python-lxml fixes the following issues:\n\n- CVE-2022-2309: Fixed NULL pointer dereference due to state leak between parser runs (bsc#1201253).\n","status":"published","published":"2022-08-26T09:36:34Z","modified":"2026-02-04T03:06:08.152964Z","updated_at":"2026-11-02T15:53:50.965375Z"},{"id":"USN-5760-1","title":"libxml2 vulnerabilities","description":"It was discovered that libxml2 incorrectly handled certain XML files.\nAn attacker could possibly use this issue to cause a crash.\n(CVE-2022-2309)\n\nIt was discovered that libxml2 incorrectly handled certain XML files.\nAn attacker could possibly use this issue to expose sensitive information\nor cause a crash. (CVE-2022-40303)\n\nIt was discovered that libxml2 incorrectly handled certain XML files.\nAn attacker could possibly use this issue to execute arbitrary code.\n(CVE-2022-40304)\n","status":"published","published":"2022-12-05T11:00:37Z","modified":"2026-04-27T16:32:22.438675926Z","updated_at":"2026-11-02T16:58:16.20937Z"}]}}