Moderate Security Vulnerability in libxml2: Infinite Recursion Issue
Summary
ALSA-2026:11349: Moderate: libxml2 security update. Affects libxml2 versions < 2.9.7-21.el8_10.4. Fixed in 2.9.7-21.el8_10.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libxml2 is a widely used development toolbox that provides an implementation of various XML standards. It is essential for applications that require XML parsing and manipulation. The library is known for its performance and flexibility, making it a popular choice among developers. However, vulnerabilities in such critical libraries can lead to severe security risks, including application crashes and potential exploitation.
Vulnerability Detail
The vulnerability identified in libxml2 is related to an infinite recursion issue in the exsltDynMapFunction function located in libexslt/dynamic.c. This flaw can lead to excessive resource consumption, potentially causing applications to crash or become unresponsive. The vulnerability is tracked under CVE-2025-9714 and poses a moderate risk to systems utilizing affected versions of the library.
How To Fix
Minimum fixed version
2.9.7-21.el8_10.4
This is the first release that contains the fix.
sudo dnf update libxml2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider limiting the input size or complexity of XML documents processed by the library to mitigate the risk of triggering the infinite recursion issue until the update can be applied.
Conclusion
The libxml2 library has a moderate security vulnerability that can lead to infinite recursion, potentially causing application crashes. It is crucial to update to the latest patched version to mitigate this risk. Users are encouraged to monitor their applications for vulnerabilities using tools like Vulert.
See every vulnerability recorded for libxml2 →
FAQ
The vulnerability involves an infinite recursion issue that can lead to application crashes due to excessive resource consumption.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability can cause applications to crash or become unresponsive, leading to denial of service.
Yes, a patch is available in version 2.9.7-21.el8_10.4 and later. Updating to this version will resolve the issue.
If immediate updating is not possible, consider implementing input size limitations or complexity checks on XML documents processed by libxml2.
Related vulnerabilities
Recent vulnerabilities recorded for libxml2.
