7251 matches found
xmloxide
xmloxide Una reimplementación pura en Rust de libxml2 — la biblioteca de análisis XML/HTML de facto en el mundo del código abierto. libxml2 quedó oficialmente sin mantenimiento en diciembre de 2025 con problemas de seguridad conocidos. xmloxide aspira a ser un reemplazo seguro en memoria y de alt...
EUVD-2026-71823
In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, the XMLPARSENONET flag, if without it a custom resource loader accesses the internet and triggers XML external entity injection, SSRF, or ...
CVE-2026-86144
In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, the XMLPARSENONET flag, if without it a custom resource loader accesses the internet and triggers XML external entity injection, SSRF, or ...
CVE-2026-86144
In libxml2 versions before 2.15.4 , the functions xmlXIncludeProcess and xmlXIncludeProcessTree in the xinclude module fail to propagate parseFlags (such as XML_PARSE_NONET) to subsequent XInclude processing. When an application uses a custom resource loader, this can allow network access even wh...
CVE-2026-86143
libxml2 versions before 2.15.4 contain an integer overflow flaw in the xmlIO component. An inconsistency between xmlOutputWriteCallback and xmlBufUse allows negative lengths to reach write callbacks due to a missing overflow check before invoking the callback. The security impact depends on how t...
CVE-2026-86143
In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks, aka a lack of a check for integer overflow before calling writecallback. This has security relevance for many types of uses of that length value within a...
EUVD-2026-71822
In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks, aka a lack of a check for integer overflow before calling writecallback. This has security relevance for many types of uses of that length value within a...
CVE-2026-86142
In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation...
EUVD-2026-71835
In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation...
CVE-2026-86142
libxml2 versions prior to 2.15.4 are affected by a heap-based buffer overflow in the xmlXPtrEvalXPtrPart function, caused by an xpointer length saturation in xmlXPtrEval. This allows a local attacker (no privileges required, high complexity) to achieve high impact on confidentiality and integrity...
CVE-2026-86141
xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup failure, i.e., it does not calculate a string length after NULL checking...
EUVD-2026-71834
xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup failure, i.e., it does not calculate a string length after NULL checking...
CVE-2026-86141
libxml2 versions before 2.15.4 contain a NULL pointer dereference in the xmlregexp module, specifically in the xmlRegNewParserCtxt function. The root cause is a missing string length calculation after a strdup failure and NULL check, leading to a potential crash. The CVSS 3.1 score is 2.9 (Low) w...
CVE-2026-86140
CVE-2026-86140 affects libxml2 versions prior to 2.15.4 . The vulnerability resides in the xmlSnprintfElements function within valid.c , where a strcat call causes a stack-based buffer overflow . The CVSS 3.1 score is 8.0 (HIGH) with a local attack vector, low complexity, and no privileges or use...
EUVD-2026-71833
In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-based buffer overflow...
CVE-2026-86140
In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-based buffer overflow...
CVE-2026-86139
In libxml2 before 2.15.4, xmlURIEscapeStr in uri.c has an integer overflow...
CVE-2026-86139
libxml2 before version 2.15.4 is affected by an integer overflow in the xmlURIEscapeStr function (uri.c). The vulnerability is rated CVSS 3.1 6.9 MEDIUM (AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L), indicating a local attack vector with high complexity but no privileges or user interaction required, pot...