Skip to content
fr Sign in
9.1 Critical

CVE-2024-40896 In libxml2 2.11 before 2.11.9, 2.12 before 2.12.9, and 2.13 before 2.13.3, the SAX parser can produce events for…

Description

In libxml2 2.11 before 2.11.9, 2.12 before 2.12.9, and 2.13 before 2.13.3, the SAX parser can produce events for external entities even if custom SAX handlers try to override entity content (by setting "checked"). This makes classic XXE attacks possible.

Affected products and versions

Product Affected versions Fixed in
libxml2 2.13 2.13.0 → < 2.13.3 2.13.3
libxml2 2.12 2.12.0 → < 2.12.9 2.12.9
libxml2 2.11 2.11.0 → < 2.11.9 2.11.9

References

Timeline

  1. Published
  2. Last modified

Other CVEs of libxml2

The 2 CVEs of libxml2 →
CVE-2025-9714 Uncontrolled recursion in XPath evaluation in libxml2 up to and including version 2.9.14 allows a local attacker to… 6.2 Medium
Track this CVE