{"id":"CVE-2024-40896","aliases":["AZL-54657","BELL-CVE-2024-40896","BIT-java-2024-40896","BIT-java-min-2024-40896","BIT-jre-2024-40896","EUVD-2024-38822","GHSA-6c2p-rqx3-w4px","JLSEC-2026-468","OESA-2024-1950","RHBA-2025:6597","SUSE-SU-2025:20116-1","SUSE-SU-2025:20418-1","openSUSE-SU-2024:14241-1","openSUSE-SU-2024:14611-1","openSUSE-SU-2025:0024-1"],"status":"published","title":"In libxml2 2.11 before 2.11.9, 2.12 before 2.12.9, and 2.13 before 2.13.3, the SAX parser can...","description":"In libxml2 2.11 before 2.11.9, 2.12 before 2.12.9, and 2.13 before 2.13.3, the SAX parser can produce events for external entities even if custom SAX handlers try to override entity content (by setting \"checked\"). This makes classic XXE attacks possible.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.01218,"percentile":0.68834,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-611"],"published":"2024-08-02T11:07:25Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Azure Linux:3","package":"libxml2","fixed_in":["2.11.5-2"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"libxml2","fixed_in":["2.13.4-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"libxml2","fixed_in":["2.13.4-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"java","fixed_in":["1.8.0","8.0.461"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"java-min","fixed_in":["1.8.0","8.0.461"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"jre","fixed_in":["1.8.0","8.0.461"],"sources":["osv"]},{"ecosystem":"Julia","package":"XML2_jll","fixed_in":["2.13.3+0"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"libxml2","fixed_in":["2.11.5-4.oe2403"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.0","package":"libxml2","fixed_in":["2.11.6-4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.1","package":"libxml2","fixed_in":["2.11.6-slfo.1.1_5.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"libxml2","fixed_in":["2.12.9-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"qt6-webengine","fixed_in":["6.8.1-2.1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP6","package":"qt6-webengine","fixed_in":["6.6.3-bp156.2.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP6","package":"qt6-webengine-docs","fixed_in":["6.6.3-bp156.2.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"qt6-webengine","fixed_in":["6.6.3-bp156.2.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"qt6-webengine-docs","fixed_in":["6.6.3-bp156.2.3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.5-2"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.11.4-r0"},{"fixed":"2.13.4-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.11.4-r0"},{"fixed":"2.13.4-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"java","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.8.0"},{"introduced":"1.9.0"},{"fixed":"8.0.461"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"java-min","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.8.0"},{"introduced":"1.9.0"},{"fixed":"8.0.461"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"jre","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.8.0"},{"introduced":"1.9.0"},{"fixed":"8.0.461"}]}]},{"source":"osv","ecosystem":"Julia","package":"XML2_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"2.11.5+0"},{"fixed":"2.13.3+0"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.5-4.oe2403"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"libxml2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12.5-5.el10_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"libxml2-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12.5-5.el10_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"libxml2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12.5-5.el10_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"python3-libxml2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12.5-5.el10_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12.5-5.el10_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"python3-libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12.5-5.el10_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"libxml2-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12.5-5.el10_0"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.6-4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.6-slfo.1.1_5.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12.9-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"qt6-webengine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.1-2.1"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP6","package":"qt6-webengine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.3-bp156.2.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP6","package":"qt6-webengine-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.3-bp156.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"qt6-webengine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.3-bp156.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"qt6-webengine-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.3-bp156.2.3.1"}]}]}],"products":[{"vendor":"gnome","product":"libxml2"},{"vendor":"libxml2","product":"libxml2"},{"vendor":"netapp","product":"h300s_firmware"},{"vendor":"netapp","product":"h410c_firmware"},{"vendor":"netapp","product":"h410s_firmware"},{"vendor":"netapp","product":"h500s_firmware"},{"vendor":"netapp","product":"h700s_firmware"},{"vendor":"netapp","product":"hci_compute_node"},{"vendor":"netapp","product":"solidfire_\\\u0026_hci_management_node"},{"vendor":"netapp","product":"solidfire_\\\u0026_hci_storage_node"},{"vendor":"xmlsoft","product":"libxml2"}],"references":[{"url":"https://gitlab.gnome.org/GNOME/libxml2/-/issues/761","tags":["Issue Tracking","report","web","article"]},{"url":"https://gitlab.gnome.org/GNOME/libxml2/-/commit/1a8932303969907f6572b1b6aac4081c56adb5c6","tags":["Issue Tracking","report","fix","web","article"]},{"url":"https://security.netapp.com/advisory/ntap-20250228-0004/","tags":["Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-40896","tags":["web","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20250228-0004"},{"url":"https://github.com/advisories/GHSA-6c2p-rqx3-w4px"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2024-40896","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/40xxx/CVE-2024-40896.json","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/security-bulletins/detail?id=openEuler-SA-2024-1950","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHBA-2025:6597","tags":["advisory"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10/html/10.0_release_notes/index","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhba-2025_6597.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-40896","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2333871","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-40896","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-56171","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2346416","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-56171","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56171","tags":["advisory"]},{"url":"https://gitlab.gnome.org/GNOME/libxml2/-/issues/828","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-24928","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2346421","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-24928","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-24928","tags":["advisory"]},{"url":"https://gitlab.gnome.org/GNOME/libxml2/-/issues/847","tags":["article"]},{"url":"https://issues.oss-fuzz.com/issues/392687022","tags":["article"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520116-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1234812","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-40896","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520418-1/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/VNFRSHS45PIJOVDOQPX33OOOOBMDTP7F/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MJTWGGN25MWIFFI6LEBRJNH3QPOW4COP/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1234820","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-40896","description":"In libxml2 2.11 before 2.11.9, 2.12 before 2.12.9, and 2.13 before 2.13.3, the SAX parser can produce events for external entities even if custom SAX handlers try to override entity content (by setting \"checked\"). This makes classic XXE attacks possible.","status":"published","published":"2024-12-23T00:00:00Z","modified":"2025-02-28T13:07:30.165Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:34:07.152829Z"}],"euvd":[{"id":"EUVD-2024-38822","description":"In libxml2 2.11 before 2.11.9, 2.12 before 2.12.9, and 2.13 before 2.13.3, the SAX parser can produce events for external entities even if custom SAX handlers try to override entity content (by setting \"checked\"). This makes classic XXE attacks possible.","status":"published","published":"2024-12-23T00:00:00Z","modified":"2025-02-28T13:07:30Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T20:53:19.898689Z"}],"ghsa":[{"id":"GHSA-6c2p-rqx3-w4px","title":"In libxml2 2.11 before 2.11.9, 2.12 before 2.12.9, and 2.13 before 2.13.3, the SAX parser can...","description":"In libxml2 2.11 before 2.11.9, 2.12 before 2.12.9, and 2.13 before 2.13.3, the SAX parser can produce events for external entities even if custom SAX handlers try to override entity content (by setting \"checked\"). This makes classic XXE attacks possible.","status":"published","published":"2024-12-23T18:30:47Z","modified":"2025-02-28T15:30:59Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T15:00:05.050542Z"}],"nvd":[{"id":"CVE-2024-40896","description":"In libxml2 2.11 before 2.11.9, 2.12 before 2.12.9, and 2.13 before 2.13.3, the SAX parser can produce events for external entities even if custom SAX handlers try to override entity content (by setting \"checked\"). This makes classic XXE attacks possible.","status":"published","published":"2024-12-23T17:15:08.4Z","modified":"2026-06-17T07:46:48.71Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:10:40.507978Z"}],"osv":[{"id":"BELL-CVE-2024-40896","status":"published","published":"2024-12-25T05:57:09.298759Z","modified":"2026-01-26T09:34:54.407275Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:20.200735Z"},{"id":"CVE-2024-40896","description":"In libxml2 2.11 before 2.11.9, 2.12 before 2.12.9, and 2.13 before 2.13.3, the SAX parser can produce events for external entities even if custom SAX handlers try to override entity content (by setting \"checked\"). This makes classic XXE attacks possible.","status":"published","published":"2024-12-23T00:00:00Z","modified":"2026-10-28T10:41:55.665228922Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T15:44:41.618074Z"},{"id":"JLSEC-2026-468","description":"In libxml2 2.11 before 2.11.9, 2.12 before 2.12.9, and 2.13 before 2.13.3, the SAX parser can produce events for external entities even if custom SAX handlers try to override entity content (by setting \"checked\"). This makes classic XXE attacks possible.","status":"published","published":"2026-05-07T16:59:28.152Z","modified":"2026-07-18T00:02:04.341277614Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:47:18.573531Z"},{"id":"OESA-2024-1950","title":"libxml2 security update","description":"This library allows to manipulate XML files. It includes support to read, modify and write XML and HTML files. There is DTDs support this includes parsing and validation even with complex DtDs, either at parse time or later once the document has been modified. The output can be a simple SAX stream or and in-memory DOM like representations. In this case one can use the built-in XPath and XPointer implementation to select sub nodes or ranges. A flexible Input/Output mechanism is available, with existing HTTP and FTP modules and combined to an URI library.\r\n\r\nSecurity Fix(es):\r\n\r\n(CVE-2024-40896)","status":"published","published":"2024-08-02T11:07:25Z","modified":"2026-08-18T01:18:32.377612475Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"RHBA-2025:6597","title":"Red Hat Bug Fix Advisory: libxml2 bug fix and enhancement update","status":"published","published":"2025-05-29T10:02:31Z","modified":"2026-10-14T10:05:56Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"AZL-54657","title":"CVE-2024-40896 affecting package libxml2 for versions less than 2.11.5-2","description":"In libxml2 2.11 before 2.11.9, 2.12 before 2.12.9, and 2.13 before 2.13.3, the SAX parser can produce events for external entities even if custom SAX handlers try to override entity content (by setting \"checked\"). This makes classic XXE attacks possible.","status":"published","published":"2024-12-23T17:15:08Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:20.996398Z"},{"id":"BIT-java-2024-40896","description":"In libxml2 2.11 before 2.11.9, 2.12 before 2.12.9, and 2.13 before 2.13.3, the SAX parser can produce events for external entities even if custom SAX handlers try to override entity content (by setting \"checked\"). This makes classic XXE attacks possible.","status":"published","published":"2026-05-06T14:44:52.133Z","modified":"2026-09-08T08:47:59.892189302Z","updated_at":"2026-11-02T15:28:31.42203Z"},{"id":"BIT-java-min-2024-40896","description":"In libxml2 2.11 before 2.11.9, 2.12 before 2.12.9, and 2.13 before 2.13.3, the SAX parser can produce events for external entities even if custom SAX handlers try to override entity content (by setting \"checked\"). This makes classic XXE attacks possible.","status":"published","published":"2026-05-06T14:44:54.864Z","modified":"2026-09-08T08:47:55.580671212Z","updated_at":"2026-11-02T15:28:31.42203Z"},{"id":"BIT-jre-2024-40896","description":"In libxml2 2.11 before 2.11.9, 2.12 before 2.12.9, and 2.13 before 2.13.3, the SAX parser can produce events for external entities even if custom SAX handlers try to override entity content (by setting \"checked\"). This makes classic XXE attacks possible.","status":"published","published":"2026-05-08T05:46:29.455Z","modified":"2026-09-08T08:48:05.884524109Z","updated_at":"2026-11-02T15:28:31.782692Z"},{"id":"openSUSE-SU-2024:14241-1","title":"libxml2-2-2.12.9-1.1 on GA media","description":"These are all security issues fixed in the libxml2-2-2.12.9-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-08-06T00:00:00Z","modified":"2026-02-04T03:52:52.019371Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"openSUSE-SU-2024:14611-1","title":"libQt6Pdf6-6.8.1-2.1 on GA media","description":"These are all security issues fixed in the libQt6Pdf6-6.8.1-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-12-29T00:00:00Z","modified":"2026-02-04T03:51:07.135926Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"openSUSE-SU-2025:0024-1","title":"Security update for qt6-webengine","description":"This update for qt6-webengine fixes the following issues:\n\n- CVE-2024-40896: Fixed a XML external entity vulnerability related to libxml2 (boo#1234820)\n\n","status":"published","published":"2025-01-23T09:21:43Z","modified":"2026-02-04T02:57:00.592978Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"SUSE-SU-2025:20116-1","title":"Security update for libxml2","description":"This update for libxml2 fixes the following issues:\n\n- CVE-2024-40896: Fixed XML external entity vulnerability (bsc#1234812)\n","status":"published","published":"2025-02-03T09:21:01Z","modified":"2026-03-23T04:48:10.541967Z","updated_at":"2026-11-02T15:53:59.381172Z"},{"id":"SUSE-SU-2025:20418-1","title":"Security update for libxml2","description":"This update for libxml2 fixes the following issues:\n\n- CVE-2024-40896: Fixed XXE vulnerability (bsc#1234812) \n","status":"published","published":"2025-06-13T10:48:44Z","modified":"2026-03-23T04:48:16.426051Z","updated_at":"2026-11-02T15:53:59.92114Z"}]}}