xmloxide

xmloxide A pure Rust reimplementation of libxml2 — the de facto standard XML/HTML parsing library in the open-source world. libxml2 became officially unmaintained in December 2025 with known security issues. xmloxide aims to be a memory-safe, high-performance replacement that passes the same...

libxml2-exploit

libxml2-exploit An example exploit for CVE-2017-7376 Install Download this repo and a vulnerable version of libxml2, e.g. v2.7.7: root@kitploit: git clone https://github.com/brahmstaedt/libxml2-exploit.git cd libxml2-exploit wget https://github.com/GNOME/libxml2/archive/v2.7.7.zip unzip v2.7.7.zi...

ROOT-OS-DEBIAN-12-CVE-2026-6653 CVE-2026-6653 in libxml2 - Patched by Root

Root has patched CVE-2026-6653 in the libxml2 package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2026-6732 CVE-2026-6732 in libxml2 - Patched by Root

Root has patched CVE-2026-6732 in the libxml2 package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2026-6653 CVE-2026-6653 in libxml2 - Patched by Root

Root has patched CVE-2026-6653 in the libxml2 package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2025-12863 CVE-2025-12863 in libxml2 - Patched by Root

Root has patched CVE-2025-12863 in the libxml2 package for Root:Debian:13. Multiple fixed versions available...

CVE-2026-74860

A flaw was found in libxml2 with Python bindings enabled. A remote att...

CVE-2026-86141

A NULL pointer dereference in libxml2's xmlRegNewParserCtxt function allows a local attacker to cause a denial of service DoS. The flaw occurs when strlen is called on an unverified pointer following a failed xmlStrdup memory allocation, resulting in a process crash...

CVE-2026-86137

A flaw was found in libxml2. This out-of-bounds read vulnerability, specifically within the xmlFAParsePosCharGroup function, could allow an attacker to cause a denial of service. By processing specially crafted XML input, the affected component may attempt to read data beyond its allocated memory...

CVE-2024-58377

Rejected CVE Nokogiri before 1.16.5, when using bundled libxml2, is affected by the libxml2 flaw CVE-2024-34459...

CVE-2026-74860

A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition DTD with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callbac...

CVE-2026-74860 Libxml2: double-free/uaf in libxml2 python bindings

A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition DTD with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callbac...

CVE-2026-74860

CVE-2026-74860 affects libxml2 when compiled with Python bindings enabled. A remote attacker can supply a specially crafted XML document containing a DTD with enumerated attribute values , triggering a double-free in the SAX attributeDecl callback handler (a string is freed twice). The flaw resul...

EUVD-2026-72691

A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition DTD with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callbac...

CVE-2026-74860 Libxml2: double-free/uaf in libxml2 python bindings

A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition DTD with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callbac...

EulerOS 2.0 SP12 : libxml2 (EulerOS-SA-2026-3281)

According to the versions of the libxml2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Use After Free in libxml2's xmlParseInternalSubset from GNOME libxml2 version 2.9.11 to 2.11.0 allows a remote attacker to cause a...

CVE-2026-86144

A flaw in libxml2's XInclude processing xmlXIncludeProcess and xmlXIncludeProcessTree fails to propagate parser flags like XMLPARSENONET. This allows custom resource loaders to fetch external network resources, potentially enabling Server-Side Request Forgery SSRF, XML External Entity XXE...

CVE-2026-86143

An integer overflow in the libxml2 xmlIO module occurs when data backlogs exceed maximum integer limits. This flaw passes negative length values to downstream write callbacks, creating an unsafe state that can lead to data corruption or compromise application confidentiality and integrity...

CVE-2026-86142

A flaw in libxml2's xmlXPtrEvalXPtrPart function allows a local attacker to cause a heap-based buffer overflow. An integer overflow while processing an oversized xpointer expression leads to incorrect memory allocation and an out-of-bounds write, potentially resulting in information disclosure,...

CVE-2026-86139

A flaw was found in libxml2. An integer overflow vulnerability exists in the xmlURIEscapeStr function within uri.c. This flaw could potentially lead to memory corruption, allowing an attacker to achieve information disclosure or arbitrary code execution. Mitigation To mitigate this developers mus...