Moderate Vulnerability in libvirt: Denial of Service via XML Parsing
Summary
ALSA-2026:18748: Moderate: libvirt security update. Affects libvirt versions < 11.10.0-12.el9_8.alma.1. Fixed in 11.10.0-12.el9_8.alma.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libvirt is a toolkit used for managing platform virtualization. It provides a unified API for interacting with various virtualization technologies, including Kernel-based Virtual Machine (KVM). The libvirt package includes user-space components that allow users to create, manage, and interact with virtual machines. This package is essential for users who rely on virtualization for development, testing, and production environments. However, a recent vulnerability has been identified that could lead to denial of service attacks through improper XML parsing.
Vulnerability Detail
The vulnerability, identified as CVE-2025-12748, arises from a flaw in the XML parsing functionality of libvirt. An attacker could exploit this vulnerability by sending specially crafted XML data to the libvirt service, causing it to crash or become unresponsive. This denial of service could disrupt virtual machine operations and affect the availability of services relying on these virtual machines. The issue is particularly concerning for environments that require high availability and reliability.
How To Fix
Minimum fixed version
11.10.0-12.el9_8.alma.1
This is the first release that contains the fix.
sudo dnf update libvirtTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to the libvirt service to trusted users only, thereby minimizing the risk of exploitation until the package can be updated. This can be done by modifying the access control settings in the virtualization management configuration.
Conclusion
The libvirt package has a moderate vulnerability that can lead to denial of service attacks due to improper XML parsing. Users are advised to update their packages to the latest version to mitigate this risk. Additionally, using tools like Vulert can help monitor for vulnerabilities in real-time.
See every vulnerability recorded for libvirt →
FAQ
CVE-2025-12748 is a vulnerability in the libvirt package that allows for denial of service attacks through improper XML parsing.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability could lead to service disruptions, causing virtual machines to crash or become unresponsive, which can affect the availability of critical services.
It is recommended to regularly check for updates and apply them promptly to ensure that your system is protected against known vulnerabilities.
Vulert is a service that monitors and alerts users in real-time for open-source vulnerabilities in their software using just a manifest file like package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for libvirt.
