CVE-2022-2309: NULL Pointer Dereference in lxml
Summary
CVE-2022-2309: NULL Pointer Dereference allows attackers to cause a denial of service (or application crash). Affects lxml across 2 version ranges.
< 4.9.1
< 86368e9cf70a0ad23cccd5ee32de847149af0c6f
Fixed in 86368e9cf70a0ad23cccd5ee32de847149af0c6f. How to fix ↓
Also tracked for
- libxml2 · Alpine:v3.13
The same CVE-2022-2309 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
lxml is a Python library that provides a powerful and easy-to-use interface for parsing and manipulating XML and HTML documents. It is widely used in various applications for XML processing. However, versions of lxml prior to 4.9.1 are vulnerable to a NULL Pointer Dereference when used with libxml2 2.9.10 through 2.9.14. This vulnerability can be triggered by processing untrusted input via the iterwalk function, leading to a denial of service or application crash.
Vulnerability Detail
The vulnerability arises from a code sequence in the iterwalk function, which is also used by the canonicalize function. While iterwalk is not commonly used due to its inefficiency compared to iterparse, there are legitimate use cases where this code sequence is employed. If untrusted input is received and processed through iterwalk, it can result in a crash. Attackers can exploit this vulnerability by providing forged input data to trigger crashes in applications that use lxml with the affected versions of libxml2. The vulnerability has the potential to disrupt the availability of the application and may require manual intervention to restart the application.
How To Fix
Latest published version: 6.1.3 as of 22 Oct 2026
pip install --upgrade "lxml==6.1.3"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
86368e9cf70a0ad23cccd5ee32de847149af0c6f
This is the first release that contains the fix.
pip install --upgrade "lxml==86368e9cf70a0ad23cccd5ee32de847149af0c6f"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the patched version of lxml is not immediately feasible, a possible workaround is to replace the usage of iterwalk with the more efficient iterparse function. By using iterparse, the vulnerable code sequence can be avoided, reducing the risk of triggering the NULL Pointer Dereference. However, this workaround may require modifications to the codebase and should be thoroughly tested to ensure it does not introduce any unintended side effects.
Conclusion
The NULL Pointer Dereference vulnerability in lxml can result in a denial of service or application crash when processing untrusted input via the iterwalk function. It is crucial to upgrade to lxml version 4.9.1 or later to mitigate this vulnerability. Alternatively, replacing iterwalk with iterparse can serve as a temporary workaround. Regularly applying security patches and staying informed about vulnerabilities is essential to maintain the security and stability of applications.
See every vulnerability recorded for lxml →
FAQ
The vulnerability can lead to a denial of service or application crash. This can disrupt the availability of the affected application and may require manual intervention to restore normal operation.
Versions of lxml prior to 4.9.1 are vulnerable to this issue.
At the time of this advisory, there are no known public exploits specifically targeting this vulnerability. However, it is always recommended to apply security patches promptly to mitigate the risk.
Yes, this vulnerability is assigned CVE-2022-2309.
You can find more information about this vulnerability in the official CVE entry (CVE-2022-2309) and the GitHub Security Advisory (GHSA-wrxv-2j5q-m38w).
References
Related vulnerabilities
Recent vulnerabilities recorded for lxml.
