Moderate Security Update for libxslt: Addressing Use-After-Free Vulnerability
Summary
ALSA-2026:26355: Moderate: libxslt security update. Affects libxslt versions < 1.1.32-6.4.el8_10. Fixed in 1.1.32-6.4.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libxslt is a widely used library designed for transforming XML files into various textual formats, including HTML and plain text, utilizing the XSLT stylesheet transformation mechanism. It is integral in applications that require XML data manipulation and presentation. However, a recently identified vulnerability poses a risk to its stability and security, necessitating immediate attention.
Vulnerability Detail
The vulnerability identified as CVE-2025-10911 is a use-after-free issue that occurs when key data is improperly managed across different runtime environments (RVT). This flaw can lead to potential exploitation, allowing attackers to manipulate memory and execute arbitrary code, which may compromise the integrity and confidentiality of the system utilizing libxslt.
How To Fix
Minimum fixed version
1.1.32-6.4.el8_10
This is the first release that contains the fix.
sudo dnf update libxsltTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, no specific workarounds are provided for this vulnerability. The best course of action is to apply the available security update as outlined in the 'how_to_fix' section.
Conclusion
The libxslt library has a moderate security vulnerability that requires immediate attention. By updating to the patched version, users can protect their systems from potential exploitation. Utilizing tools like Vulert can further enhance security monitoring and vulnerability management.
See every vulnerability recorded for libxslt →
FAQ
The vulnerability is a use-after-free issue that can lead to memory corruption and potential code execution.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file like package-lock.json. Visit Vulert Scanner to check your application without any signup.
Failure to address this vulnerability may result in unauthorized access, data breaches, or system instability due to potential exploitation.
Yes, the vulnerability is fixed in libxslt version 1.1.32-6.4.el8_10 and later.
While no specific workarounds are available, it is crucial to prioritize updating the package as soon as possible to ensure system security.
Related vulnerabilities
Recent vulnerabilities recorded for libxslt.
