{"id":"CVE-2025-49795","aliases":["ALPINE-CVE-2025-49795","ALSA-2025:10630","AZL-64098","AZL-64121","BELL-CVE-2025-49795","EUVD-2025-18416","GHSA-gg7j-w83p-fxr9","MGASA-2025-0269","OESA-2025-1768","OESA-2025-1769","OESA-2025-1770","RHSA-2025:10630","RHSA-2026:7519","RLSA-2025:10630","SUSE-SU-2025:02260-1","SUSE-SU-2025:02314-1","SUSE-SU-2025:20564-1","SUSE-SU-2025:20607-1","UBUNTU-CVE-2025-49795","openSUSE-SU-2025:15321-1"],"status":"published","title":"Libxml: null pointer dereference leads to denial of service (dos)","description":"A NULL pointer dereference vulnerability was found in libxml2 when processing XPath XML expressions. This flaw allows an attacker to craft a malicious XML input to libxml2, leading to a denial of service.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00592,"percentile":0.48566,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-825"],"published":"2025-06-12T05:59:32.82722Z","modified":"2026-11-05T21:15:56Z","fixes":[{"ecosystem":"Alpine:v3.21","package":"libxml2","fixed_in":["2.13.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"libxml2","fixed_in":["2.13.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"libxml2","fixed_in":["2.13.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"libxml2","fixed_in":["2.13.9-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"libxml2","fixed_in":["2.10.4-9"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"libxml2","fixed_in":["2.11.5-7"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"libxml2","fixed_in":["2.10.4-r6"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"libxml2","fixed_in":["2.13.8-r2"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"libxml2","fixed_in":["2.13.8-r2"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:23","package":"libxml2","fixed_in":["2.10.4-r6"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:25","package":"libxml2","fixed_in":["2.13.8-r2"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"libxml2","fixed_in":["2.13.8-r2"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"libxml2","fixed_in":["2.14.5+dfsg-0.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.21","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13.9-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12.5-7.el10_0"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"libxml2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12.5-7.el10_0"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"libxml2-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12.5-7.el10_0"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"python3-libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12.5-7.el10_0"}]}],"bundled":4},{"source":"osv","ecosystem":"Azure Linux:2","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.4-9"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.5-7"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.10.3-r2"},{"fixed":"2.10.4-r6"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.13.8-r0"},{"fixed":"2.13.8-r2"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.10.3-r2"},{"fixed":"2.13.8-r2"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:23","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.10.3-r2"},{"fixed":"2.10.4-r6"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:25","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.13.8-r0"},{"fixed":"2.13.8-r2"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.10.3-r2"},{"fixed":"2.13.8-r2"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.4-1.8.mga9"}]}],"bundled":7},{"source":"osv","ecosystem":"Mageia:9","package":"libxslt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.38-1.2.mga9"}]}],"bundled":7},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.5-8.oe2403"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.9-5.oe2403sp1"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.9-5.oe2403sp2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"libxml2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12.5-7.el10_0"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"libxml2-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12.5-7.el10_0"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"libxml2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12.5-7.el10_0"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"python3-libxml2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12.5-7.el10_0"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12.5-7.el10_0"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"python3-libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12.5-7.el10_0"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"libxml2-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12.5-7.el10_0"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.15.2-0.3.hum1"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libxml2-16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.15.2-0.3.hum1"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libxml2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.15.2-0.3.hum1"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libxml2-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.15.2-0.3.hum1"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3-libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.15.2-0.3.hum1"}]}],"bundled":13},{"source":"osv","ecosystem":"Rocky Linux:10","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12.5-7.el10_0"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12.10-150700.4.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"libxml2-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12.10-150700.4.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP7","package":"libxml2-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12.10-150700.4.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.3-150500.5.29.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"libxml2-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.3-150500.5.29.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.3-150500.5.29.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"libxml2-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.3-150500.5.29.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP6","package":"libxml2-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.3-150500.5.29.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.3-150500.5.29.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"libxml2-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.3-150500.5.29.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.3-150500.5.29.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"libxml2-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.3-150500.5.29.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.3-150500.5.29.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"libxml2-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.3-150500.5.29.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.3-150500.5.29.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"libxml2-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.3-150500.5.29.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.3-150500.5.29.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"libxml2-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.3-150500.5.29.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.6-10.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.6-slfo.1.1_6.1"}]}],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.14.5+dfsg-0.2"}]}],"versions":["2.12.7+dfsg+really2.9.14-0.4","2.12.7+dfsg+really2.9.14-0.4ubuntu0.1","2.12.7+dfsg+really2.9.14-1","2.14.3+dfsg-0exp1","2.14.3+dfsg-0exp2","2.14.3+dfsg-0exp3","2.14.4+dfsg-0exp1","2.14.5+dfsg-0exp1","2.14.5+dfsg-0exp2","2.14.5+dfsg-0.1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13.8-2.1"}]}],"bundled":5}],"products":[{"vendor":"gnome","product":"libxml2"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat hardened images"},{"vendor":"red hat","product":"red hat jboss core services 2.4.62.sp2"},{"vendor":"siemens","product":"ruggedcom rst2428p"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2025:10630","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:19020","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:7519","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-49795","tags":["vdb-entry","x_refsource_REDHAT","report","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2372379","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://gitlab.gnome.org/GNOME/libxml2/-/issues/932","tags":["report","article"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-253495.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-49795","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-gg7j-w83p-fxr9"},{"url":"https://security.alpinelinux.org/vuln/CVE-2025-49795","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-49794","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-49796","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-6021","tags":["report"]},{"url":"https://bugzilla.redhat.com/2372373","tags":["report"]},{"url":"https://bugzilla.redhat.com/2372379","tags":["report"]},{"url":"https://bugzilla.redhat.com/2372385","tags":["report"]},{"url":"https://bugzilla.redhat.com/2372406","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2025-10630.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2025-49795","tags":["advisory"]},{"url":"https://access.redhat.com/downloads/content/package-browser/","tags":["web"]},{"url":"https://catalog.redhat.com/software/containers/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/49xxx/CVE-2025-49795.json","tags":["advisory"]},{"url":"https://gitlab.gnome.org/GNOME/libxml2/","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2025-0269.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=34378","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2025/06/16/6","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2025/07/11/2","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1768","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-49794","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-49796","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1769","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1770","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-6021","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2372373","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2372385","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2372406","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_10630.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-6021","tags":["advisory"]},{"url":"https://gitlab.gnome.org/GNOME/libxml2/-/issues/926","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-49794","tags":["advisory"]},{"url":"https://gitlab.gnome.org/GNOME/libxml2/-/issues/931","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-49795","tags":["advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-49796","tags":["advisory"]},{"url":"https://gitlab.gnome.org/GNOME/libxml2/-/issues/933","tags":["article"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-32415","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-32414","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-6170","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-9714","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-26434","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-0992","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-0990","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-0989","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-1757","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7519.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2372952","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-6170","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-6170","tags":["advisory"]},{"url":"https://gitlab.gnome.org/GNOME/libxml2/-/issues/941","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2392605","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-9714","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-9714","tags":["advisory"]},{"url":"https://gitlab.gnome.org/GNOME/libxml2/-/commit/677a42645ef22b5a50741bad5facf9d8a8bc6d21","tags":["article"]},{"url":"https://gitlab.gnome.org/GNOME/libxslt/-/issues/148","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2393475","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-26434","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-26434","tags":["advisory"]},{"url":"https://gitlab.gnome.org/GNOME/libxml2/-/commit/5e7874015ef5ed8b2705eb2f7b0960f56f7760ea","tags":["article"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-26434","tags":["article"]},{"url":"https://source.android.com/security/bulletin/android-16","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2358121","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-32414","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-32414","tags":["advisory"]},{"url":"https://gitlab.gnome.org/GNOME/libxml2/-/issues/889","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2360768","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-32415","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-32415","tags":["advisory"]},{"url":"https://gitlab.gnome.org/GNOME/libxml2/-/issues/890","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2429933","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-0989","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0989","tags":["advisory"]},{"url":"https://gitlab.gnome.org/GNOME/libxml2/-/issues/998","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2429959","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-0990","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0990","tags":["advisory"]},{"url":"https://gitlab.gnome.org/GNOME/libxml2/-/issues/1018","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2429975","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-0992","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0992","tags":["advisory"]},{"url":"https://gitlab.gnome.org/GNOME/libxml2/-/issues/1019","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2435940","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-1757","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1757","tags":["advisory"]},{"url":"https://gitlab.gnome.org/GNOME/libxml2/-/issues/1009","tags":["article"]},{"url":"https://errata.rockylinux.org/RLSA-2025:10630","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502260-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1244554","tags":["report"]},{"url":"https://bugzilla.suse.com/1244555","tags":["report"]},{"url":"https://bugzilla.suse.com/1244557","tags":["report"]},{"url":"https://bugzilla.suse.com/1244590","tags":["report"]},{"url":"https://bugzilla.suse.com/1244700","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-49794","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-49795","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-49796","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6021","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6170","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502314-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520564-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1244580","tags":["report"]},{"url":"https://bugzilla.suse.com/1246296","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-7425","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520607-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-49795","tags":["report"]},{"url":"https://gitlab.gnome.org/GNOME/libxml2/-/commit/499bcb78ab389f60c2fd634ce410d4bb85c18765","tags":["report"]},{"url":"https://gitlab.gnome.org/GNOME/libxml2/-/commit/24d7e15914588cb45e7fb41cbe4fcf785e1a4861","tags":["report"]},{"url":"https://gitlab.gnome.org/GNOME/libxml2/-/commit/c24909ba2601848825b49a60f988222da3019667","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-49795","title":"Libxml: null pointer dereference leads to denial of service (dos)","description":"A NULL pointer dereference vulnerability was found in libxml2 when processing XPath XML expressions. This flaw allows an attacker to craft a malicious XML input to libxml2, leading to a denial of service.","status":"published","published":"2025-06-16T15:19:29.871Z","modified":"2026-11-04T21:35:53.969Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-825"],"updated_at":"2026-11-04T22:39:14.734949Z"}],"euvd":[{"id":"EUVD-2025-18416","description":"A NULL pointer dereference vulnerability was found in libxml2 when processing XPath XML expressions. This flaw allows an attacker to craft a malicious XML input to libxml2, leading to a denial of service.","status":"published","published":"2025-06-16T15:19:29Z","modified":"2026-11-04T21:35:53Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-04T23:47:19.24864Z"}],"ghsa":[{"id":"GHSA-gg7j-w83p-fxr9","title":"A NULL pointer dereference vulnerability was found in libxml2 when processing XPath XML...","description":"A NULL pointer dereference vulnerability was found in libxml2 when processing XPath XML expressions. This flaw allows an attacker to craft a malicious XML input to libxml2, leading to a denial of service.","status":"published","published":"2025-06-16T18:32:19Z","modified":"2026-06-02T15:32:54Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-825"],"updated_at":"2026-11-02T15:08:29.586291Z"}],"nvd":[{"id":"CVE-2025-49795","description":"A NULL pointer dereference vulnerability was found in libxml2 when processing XPath XML expressions. This flaw allows an attacker to craft a malicious XML input to libxml2, leading to a denial of service.","status":"published","published":"2025-06-16T16:15:19.203Z","modified":"2026-11-04T22:17:36.903Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-825"],"updated_at":"2026-11-04T23:43:37.864413Z"}],"osv":[{"id":"ALPINE-CVE-2025-49795","description":"A NULL pointer dereference vulnerability was found in libxml2 when processing XPath XML expressions. This flaw allows an attacker to craft a malicious XML input to libxml2, leading to a denial of service.","status":"published","published":"2025-06-16T16:15:19.203Z","modified":"2026-08-27T22:18:02.988507613Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:50.269992Z"},{"id":"BELL-CVE-2025-49795","status":"published","published":"2025-06-12T05:59:32.82722Z","modified":"2026-01-26T09:40:29.613897Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:22.495824Z"},{"id":"CVE-2025-49795","title":"Libxml: null pointer dereference leads to denial of service (dos)","description":"A NULL pointer dereference vulnerability was found in libxml2 when processing XPath XML expressions. This flaw allows an attacker to craft a malicious XML input to libxml2, leading to a denial of service.","status":"published","published":"2025-06-16T15:19:29.871Z","modified":"2026-11-05T21:15:56.15185289Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-825"],"updated_at":"2026-11-05T22:01:21.792402Z"},{"id":"OESA-2025-1768","title":"libxml2 security update","description":"This library allows to manipulate XML files. It includes support to read, modify and write XML and HTML files. There is DTDs support this includes parsing and validation even with complex DtDs, either at parse time or later once the document has been modified. The output can be a simple SAX stream or and in-memory DOM like representations. In this case one can use the built-in XPath and XPointer implementation to select sub nodes or ranges. A flexible Input/Output mechanism is available, with existing HTTP and FTP modules and combined to an URI library.\r\n\r\nSecurity Fix(es):\n\nA use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under certain circumstances when the XML schematron has the \u0026lt;sch:name path=\u0026quot;...\u0026quot;/\u0026gt; schema elements. This flaw allows a malicious actor to craft a malicious XML document used as input for libxml, resulting in the program\u0026apos;s crash using libxml or other possible undefined behaviors.(CVE-2025-49794)\n\nA NULL pointer dereference vulnerability was found in libxml2 when processing XPath XML expressions. This flaw allows an attacker to craft a malicious XML input to libxml2, leading to a denial of service.(CVE-2025-49795)\n\nA vulnerability was found in libxml2. Processing certain sch:name elements from the input XML file can trigger a memory corruption issue. This flaw allows an attacker to craft a malicious XML input file that can lead libxml to crash, resulting in a denial of service or other possible undefined behavior due to sensitive data being corrupted in memory.(CVE-2025-49796)","status":"published","published":"2025-07-11T11:08:51Z","modified":"2026-08-18T01:18:52.656259716Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-1769","title":"libxml2 security update","description":"This library allows to manipulate XML files. It includes support to read, modify and write XML and HTML files. There is DTDs support this includes parsing and validation even with complex DtDs, either at parse time or later once the document has been modified. The output can be a simple SAX stream or and in-memory DOM like representations. In this case one can use the built-in XPath and XPointer implementation to select sub nodes or ranges. A flexible Input/Output mechanism is available, with existing HTTP and FTP modules and combined to an URI library.\r\n\r\nSecurity Fix(es):\n\nA use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under certain circumstances when the XML schematron has the \u0026lt;sch:name path=\u0026quot;...\u0026quot;/\u0026gt; schema elements. This flaw allows a malicious actor to craft a malicious XML document used as input for libxml, resulting in the program\u0026apos;s crash using libxml or other possible undefined behaviors.(CVE-2025-49794)\n\nA NULL pointer dereference vulnerability was found in libxml2 when processing XPath XML expressions. This flaw allows an attacker to craft a malicious XML input to libxml2, leading to a denial of service.(CVE-2025-49795)\n\nA vulnerability was found in libxml2. Processing certain sch:name elements from the input XML file can trigger a memory corruption issue. This flaw allows an attacker to craft a malicious XML input file that can lead libxml to crash, resulting in a denial of service or other possible undefined behavior due to sensitive data being corrupted in memory.(CVE-2025-49796)","status":"published","published":"2025-07-11T11:08:51Z","modified":"2026-08-18T01:18:52.741138501Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-1770","title":"libxml2 security update","description":"This library allows to manipulate XML files. It includes support to read, modify and write XML and HTML files. There is DTDs support this includes parsing and validation even with complex DtDs, either at parse time or later once the document has been modified. The output can be a simple SAX stream or and in-memory DOM like representations. In this case one can use the built-in XPath and XPointer implementation to select sub nodes or ranges. A flexible Input/Output mechanism is available, with existing HTTP and FTP modules and combined to an URI library.\r\n\r\nSecurity Fix(es):\n\nA use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under certain circumstances when the XML schematron has the \u0026lt;sch:name path=\u0026quot;...\u0026quot;/\u0026gt; schema elements. This flaw allows a malicious actor to craft a malicious XML document used as input for libxml, resulting in the program\u0026apos;s crash using libxml or other possible undefined behaviors.(CVE-2025-49794)\n\nA NULL pointer dereference vulnerability was found in libxml2 when processing XPath XML expressions. This flaw allows an attacker to craft a malicious XML input to libxml2, leading to a denial of service.(CVE-2025-49795)\n\nA vulnerability was found in libxml2. Processing certain sch:name elements from the input XML file can trigger a memory corruption issue. This flaw allows an attacker to craft a malicious XML input file that can lead libxml to crash, resulting in a denial of service or other possible undefined behavior due to sensitive data being corrupted in memory.(CVE-2025-49796)\n\nA vulnerability was found in xmlsoft libxml2 (Document Processing Software) (version now known). It has been declared as critical.The CWE definition for the vulnerability is CWE-121. A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).As an impact it is known to affect confidentiality, integrity, and availability.There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-18175).(CVE-2025-6021)","status":"published","published":"2025-07-11T11:08:51Z","modified":"2026-08-18T01:18:53.122804279Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"RHSA-2025:10630","title":"Red Hat Security Advisory: libxml2 security update","status":"published","published":"2025-07-09T10:05:09Z","modified":"2026-10-15T10:09:33Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:15.137262Z"},{"id":"RHSA-2026:7519","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-04-20T10:11:16Z","modified":"2026-10-15T10:27:00Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RLSA-2025:10630","title":"Important: libxml2 security update","description":"The libxml2 library is a development toolbox providing the implementation of various XML standards.\n\nSecurity Fix(es):\n\n* libxml: Heap use after free (UAF) leads to Denial of service (DoS) (CVE-2025-49794)\n\n* libxml: Null pointer dereference leads to Denial of service (DoS) (CVE-2025-49795)\n\n* libxml: Type confusion leads to Denial of service (DoS) (CVE-2025-49796)\n\n* libxml2: Integer Overflow in xmlBuildQName() Leads to Stack Buffer Overflow in libxml2 (CVE-2025-6021)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-10-03T19:56:45.27031Z","modified":"2025-10-08T17:12:45.155625Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:24.923365Z"},{"id":"UBUNTU-CVE-2025-49795","description":"A NULL pointer dereference vulnerability was found in libxml2 when processing XPath XML expressions. This flaw allows an attacker to craft a malicious XML input to libxml2, leading to a denial of service.","status":"published","published":"2025-06-16T16:15:00Z","modified":"2026-04-22T16:03:45.481737Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:55:50.31802Z"},{"id":"ALSA-2025:10630","title":"Important: libxml2 security update","description":"The libxml2 library is a development toolbox providing the implementation of various XML standards.  \n\nSecurity Fix(es):  \n\n  * libxml: Heap use after free (UAF) leads to Denial of service (DoS) (CVE-2025-49794)\n  * libxml: Null pointer dereference leads to Denial of service (DoS) (CVE-2025-49795)\n  * libxml: Type confusion leads to Denial of service (DoS) (CVE-2025-49796)\n  * libxml2: Integer Overflow in xmlBuildQName() Leads to Stack Buffer Overflow in libxml2 (CVE-2025-6021)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-07-08T00:00:00Z","modified":"2026-10-29T11:58:17.690275Z","updated_at":"2026-11-02T15:27:53.030731Z"},{"id":"AZL-64098","title":"CVE-2025-49795 affecting package libxml2 for versions less than 2.10.4-9","description":"A NULL pointer dereference vulnerability was found in libxml2 when processing XPath XML expressions. This flaw allows an attacker to craft a malicious XML input to libxml2, leading to a denial of service.","status":"published","published":"2025-06-16T16:15:19Z","modified":"2026-04-21T04:32:17.768323Z","updated_at":"2026-11-02T15:28:07.805289Z"},{"id":"AZL-64121","title":"CVE-2025-49795 affecting package libxml2 for versions less than 2.11.5-7","description":"A NULL pointer dereference vulnerability was found in libxml2 when processing XPath XML expressions. This flaw allows an attacker to craft a malicious XML input to libxml2, leading to a denial of service.","status":"published","published":"2025-06-16T16:15:19Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:21.518778Z"},{"id":"MGASA-2025-0269","title":"Updated libxml2 \u0026 libxslt packages fix security vulnerabilities","description":"Heap use after free (UAF) leads to Denial of service (DoS).\n(CVE-2025-49794)\nNull pointer dereference leads to Denial of service (DoS).\n(CVE-2025-49795)\nType confusion leads to Denial of service (DoS). (CVE-2025-49796)\nInteger Overflow Leading to Buffer Overflow in xmlBuildQName().\n(CVE-2025-6021)\nStack-based Buffer Overflow in xmllint Shell. (CVE-2025-6170)\nType confusion in xmlNode.psvi between stylesheet and source nodes.\n(CVE-2025-7424)\nHeap-use-after-free in xmlFreeID caused by `atype` corruption.\n(CVE-2025-7425)\n","status":"published","published":"2025-11-09T07:52:10Z","modified":"2026-04-16T04:44:01.959141776Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2025:15321-1","title":"libxml2-2-2.13.8-2.1 on GA media","description":"These are all security issues fixed in the libxml2-2-2.13.8-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-07-08T00:00:00Z","modified":"2026-03-23T04:53:38.77285Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"SUSE-SU-2025:02260-1","title":"Security update for libxml2","description":"This update for libxml2 fixes the following issues:\n\n- CVE-2025-49794: Fixed a heap use after free which could lead to denial of service. (bsc#1244554)\n- CVE-2025-49796: Fixed type confusion which could lead to denial of service. (bsc#1244557)\n- CVE-2025-49795: Fixed a null pointer dereference which could lead to denial of service. (bsc#1244555)\n- CVE-2025-6170: Fixed a stack buffer overflow which could lead to a crash. (bsc#1244700)\n- CVE-2025-6021: Fixed an integer overflow in xmlBuildQName() which could lead to stack buffer overflow. (bsc#1244590)\n","status":"published","published":"2025-07-09T17:04:33Z","modified":"2026-02-04T02:55:27.952477Z","updated_at":"2026-11-02T15:53:56.647031Z"},{"id":"SUSE-SU-2025:02314-1","title":"Security update for libxml2","description":"This update for libxml2 fixes the following issues:\n\n- CVE-2025-49794: Fixed a heap use after free which could lead to denial of service. (bsc#1244554)\n- CVE-2025-49796: Fixed type confusion which could lead to denial of service. (bsc#1244557)\n- CVE-2025-49795: Fixed a null pointer dereference which could lead to denial of service. (bsc#1244555)\n- CVE-2025-6170: Fixed a stack buffer overflow which could lead to a crash. (bsc#1244700)\n- CVE-2025-6021: Fixed an integer overflow in xmlBuildQName() which could lead to stack buffer overflow. (bsc#1244590)\n","status":"published","published":"2025-07-15T12:34:11Z","modified":"2026-03-23T04:48:33.248034Z","updated_at":"2026-11-02T15:53:56.647031Z"},{"id":"SUSE-SU-2025:20564-1","title":"Security update for libxml2","description":"This update for libxml2 fixes the following issues:\n\n- CVE-2025-6021: Integer Overflow in xmlBuildQName() Leads to Stack Buffer Overflow in libxml2 [bsc#1244580]\n- CVE-2025-6170: stack buffer overflow may lead to a crash [bsc#1244700]\n- CVE-2025-7425: Heap Use-After-Free in libxslt caused by atype corruption in xmlAttrPtr [bsc#1246296]\n- CVE-2025-49794: heap use after free (UAF) can lead to Denial of service (DoS) [bsc#1244554]\n- CVE-2025-49795: null pointer dereference may lead to Denial of service (DoS) [bsc#1244555]\n- CVE-2025-49796: type confusion may lead to Denial of service (DoS) [bsc#1244557]\n","status":"published","published":"2025-08-21T08:01:26Z","modified":"2026-03-23T04:47:03.954327Z","updated_at":"2026-11-02T15:53:59.92114Z"},{"id":"SUSE-SU-2025:20607-1","title":"Security update for libxml2","description":"This update for libxml2 fixes the following issues:\n\n- CVE-2025-6021: Integer Overflow in xmlBuildQName() Leads to Stack Buffer Overflow in libxml2 [bsc#1244580]\n- CVE-2025-6170: stack buffer overflow may lead to a crash [bsc#1244700]\n- CVE-2025-7425: Heap Use-After-Free in libxslt caused by atype corruption in xmlAttrPtr [bsc#1246296]\n- CVE-2025-49794: heap use after free (UAF) can lead to Denial of service (DoS) [bsc#1244554]\n- CVE-2025-49795: null pointer dereference may lead to Denial of service (DoS) [bsc#1244555]\n- CVE-2025-49796: type confusion may lead to Denial of service (DoS) [bsc#1244557]\n","status":"published","published":"2025-08-27T09:46:19Z","modified":"2026-03-23T04:49:00.467629Z","updated_at":"2026-11-02T15:53:59.92114Z"}]}}