JLSEC-2025-72 There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11

🗓️ 17 Oct 2025 17:40:51Reported by GoogleType

osv🔗 osv.dev👁 1 Views

Out-of-bounds read in xml entity encoding of libxml2 before 2.9.11; crafted files may affect availability.

Reporter	Title	Published	Views	Family All 241
IBM Security Bulletins	Security Bulletin: IBM RackSwitch firmware products are affected by vulnerabilities in Libxml2	7 Dec 202323:00	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Flex System switch firmware products are affected by vulnerabilities in Libxml2	7 Dec 202323:00	–	ibm
IBM Security Bulletins	Security Bulletin: Cloud Pak for Security uses packages that are vulnerable to several CVEs	19 Oct 202115:38	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities fixed in Cloud Pak for Automation components	19 Jan 202216:26	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Security Vulnerabilities fixed in IBM Security Verify Access	7 Jan 202200:24	–	ibm
Tenable Nessus	Amazon Linux 2 : libxml2 (ALAS-2021-1662)	4 Jan 202300:00	–	nessus
Tenable Nessus	Amazon Linux 2 : java-11-amazon-corretto (ALAS-2021-1718)	5 Nov 202100:00	–	nessus
Tenable Nessus	Amazon Linux 2 : java-1.8.0-amazon-corretto (ALASCORRETTO8-2024-012)	31 May 202400:00	–	nessus
Tenable Nessus	Amazon Linux AMI : libxml2 (ALAS-2023-1743)	4 May 202300:00	–	nessus
Tenable Nessus	Alibaba Cloud Linux 3 : 0047: libxml2 (ALINUX3-SA-2021:0047)	14 May 202500:00	–	nessus

Source	Link
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
lists	www.lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
lists	www.lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
lists	www.lists.debian.org/debian-lts-announce/2021/05/msg00008.html
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BZOMV5J4PMZAORVT64BKLV6YIZAFDGX6/
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QVM4UJ3376I6ZVOYMHBNX4GY3NIV52WV/
security	www.security.gentoo.org/glsa/202107-05
security	www.security.netapp.com/advisory/ntap-20210625-0002/
security	www.security.netapp.com/advisory/ntap-20211022-0004/
oracle	www.oracle.com/security-alerts/cpuapr2022.html

06 Nov 2025 23:02Current

6.5Medium risk

Vulners AI Score6.5

CVSS 27.5

CVSS 3.18.6

EPSS0.00107

SSVC