CVE-2022-2309: lxml NULL Pointer Dereference allows attackers to cause a denial of service
Summary
CVE-2022-2309: lxml NULL Pointer Dereference allows attackers to cause a denial of service. Affects lxml versions < 4.9.1. Fixed in 4.9.1. How to fix ↓
Also tracked for
- libxml2 · Alpine:v3.13
The same CVE-2022-2309 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
lxml is a Python library that provides a powerful and easy-to-use interface for parsing and manipulating XML and HTML documents. It is widely used in various applications for XML processing. However, versions of lxml prior to 4.9.1 are vulnerable to a NULL Pointer Dereference when used together with libxml2 2.9.10 through 2.9.14. This vulnerability can be exploited by attackers to cause a denial of service or application crash.
Vulnerability Detail
The vulnerability arises from the iterwalk function in lxml, which is also used by the canonicalize function. While this code sequence is not commonly used due to the availability of more efficient alternatives like iterparse, there are legitimate use cases for it, such as XML converters that serialize to C14N. If untrusted input is received and processed via the iterwalk function, a crash can be triggered. This vulnerability can be exploited remotely by sending forged input data to the application. The impact of this vulnerability is a denial of service, potentially disrupting the availability of the affected application.
How To Fix
Latest published version: 6.1.3 as of 22 Oct 2026
pip install --upgrade "lxml==6.1.3"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.9.1
This is the first release that contains the fix.
pip install --upgrade "lxml==4.9.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version of lxml is not immediately feasible, a possible workaround is to avoid using the iterwalk function and replace it with the more efficient iterparse function. This can help mitigate the risk of exploitation. Here is an example of how to replace iterwalk with iterparse:
import lxml.etree as ET
Original code using iterwalk
for event, element in ET.iterwalk(tree): # Process the XML element ...
Updated code using iterparse
for event, element in ET.iterparse(tree): if event == 'end': # Process the XML element ...
By making this change, the vulnerable code sequence is no longer present, reducing the risk of a crash.
Conclusion
In conclusion, the vulnerability CVE-2022-2309 affects versions of lxml prior to 4.9.1 when used with libxml2 2.9.10 through 2.9.14. It allows attackers to cause a denial of service or application crash by exploiting the NULL Pointer Dereference in the iterwalk function. Upgrading to lxml 4.9.1 or later is the recommended solution, but if immediate upgrade is not possible, replacing iterwalk with iterparse can serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for lxml →
FAQ
lxml is a Python library that provides an interface for parsing and manipulating XML and HTML documents. It is widely used in various applications for XML processing.
Versions of lxml prior to 4.9.1 are affected when used together with libxml2 2.9.10 through 2.9.14. Versions 2.9.9 and earlier are not affected.
The vulnerability allows attackers to cause a denial of service or application crash. By exploiting the vulnerability, an attacker can send forged input data to trigger a crash, potentially disrupting the availability of the affected application.
Yes, if upgrading to the latest version of lxml is not immediately feasible, a workaround is to replace the vulnerable iterwalk function with the more efficient iterparse function. This can help mitigate the risk of exploitation.
To fix this vulnerability, it is recommended to upgrade lxml to version 4.9.1 or later. This version includes the necessary fixes to prevent the NULL Pointer Dereference. Users should update their dependencies and ensure that the updated version of lxml is being used in their applications.
Related vulnerabilities
Recent vulnerabilities recorded for lxml.
