Moderate Vulnerability in libxslt: Use-After-Free Issue
Summary
RLSA-2026:28584: Moderate: libxslt security update. Affects libxslt versions < 0:1.1.39-8.el10_2.1. Fixed in 0:1.1.39-8.el10_2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libxslt is a widely used library designed for transforming XML files into various textual formats, including HTML and plain text, utilizing the XSLT stylesheet transformation mechanism. It is integral for applications that require XML data manipulation and representation. However, a security vulnerability has been identified that could potentially compromise the integrity of applications relying on this library.
Vulnerability Detail
The vulnerability identified as CVE-2025-10911 is a use-after-free issue that occurs when key data is stored across different runtime variable tables (RVT). This flaw can lead to unauthorized access to sensitive data or application crashes, posing a significant risk to systems that utilize libxslt for XML transformations. The impact of this vulnerability is classified with a CVSS score of 5.5, indicating a moderate severity level.
How To Fix
Minimum fixed version
0:1.1.39-8.el10_2.1
This is the first release that contains the fix.
sudo dnf update libxsltTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, if updating the package is not immediately feasible, consider isolating the application using libxslt from untrusted input sources to mitigate potential exploitation of this vulnerability.
Conclusion
In summary, the libxslt library has a moderate vulnerability (CVE-2025-10911) that can lead to serious security risks. It is crucial to update to the patched version to mitigate these risks. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for libxslt →
FAQ
The vulnerability is a use-after-free issue that can lead to unauthorized access to sensitive data or application crashes.
You can use the Vulert playground at Vulert Scanner to check if your application is affected without requiring any signup.
The CVSS score of this vulnerability is 5.5, indicating a moderate severity level.
Update the libxslt package to the patched version using 'sudo yum update libxslt' to secure your application.
Yes, you can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for libxslt.
