Memory Leak Vulnerability in libxml2: CVE-2019-19956
Summary
ALPINE-CVE-2019-19956: xmlParseBalancedChunkMemoryRecover in parser.c in libxml2 before 2.9.10 has a memory leak related to newDoc->oldNs. Affects libxml2 versions < 2.9.9-r3. Fixed in 2.9.9-r3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
libxml2 is a widely used XML parsing library that provides a range of functionalities for processing XML and HTML documents. It is known for its performance and compliance with standards. However, certain versions of libxml2 are vulnerable to a memory leak issue, which can lead to increased memory consumption and potential application instability.
Vulnerability Detail
The vulnerability identified as CVE-2019-19956 arises from the function xmlParseBalancedChunkMemoryRecover in parser.c within libxml2 versions prior to 2.9.10. This function has a memory leak associated with the newDoc->oldNs variable, which can lead to excessive memory usage over time. If exploited, this vulnerability could result in degraded application performance or crashes due to memory exhaustion.
How To Fix
Minimum fixed version
2.9.9-r3
This is the first release that contains the fix.
sudo apk add --upgrade libxml2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not possible, consider limiting the usage of libxml2 in your application or monitoring memory usage closely to mitigate the impact of the memory leak until a proper fix can be applied.
Conclusion
CVE-2019-19956 is a significant vulnerability in libxml2 that can lead to memory leaks and application instability. It is crucial to update to the patched versions as soon as possible to mitigate the risks associated with this vulnerability.
See every vulnerability recorded for libxml2 →
FAQ
CVE-2019-19956 is a memory leak vulnerability in the libxml2 library that can lead to increased memory consumption.
Versions of libxml2 prior to 2.9.10 are affected, with specific fixes available for different Alpine Linux versions.
The memory leak can lead to application instability, crashes, or performance degradation due to excessive memory usage.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time using just a manifest file. Visit Vulert Scanner to check your application without signup.
The CVSS score for CVE-2019-19956 is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for libxml2.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
