Critical Security Vulnerability in libxml2: Heap Use After Free and Integer Overflow Issues
Summary
RLSA-2025:10698: Important: libxml2 security update. Affects libxml2 versions < 0:2.9.7-21.el8_10.1. Fixed in 0:2.9.7-21.el8_10.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libxml2 is a widely-used development library that provides tools for parsing and manipulating XML documents. It supports various XML standards and is integral to many applications that require XML processing. The library is known for its performance and flexibility, but it has recently been identified as vulnerable to several critical security issues that could lead to severe consequences for applications relying on it.
Vulnerability Detail
The vulnerabilities in libxml2 include a heap use after free (UAF) condition and an integer overflow in the xmlBuildQName() function. These issues can lead to denial of service (DoS) attacks, where an attacker can exploit the vulnerabilities to crash applications or cause them to behave unexpectedly. The vulnerabilities are tracked under CVEs: CVE-2025-49794, CVE-2025-49796, and CVE-2025-6021, with a CVSS score of 9.1 indicating a critical severity level.
How To Fix
Minimum fixed version
0:2.9.7-21.el8_10.1
This is the first release that contains the fix.
sudo dnf update libxml2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, if updating is not immediately possible, consider isolating the affected applications from untrusted inputs or disabling features that utilize libxml2 until the library can be updated.
Conclusion
The libxml2 library has critical vulnerabilities that need immediate attention. Users are advised to update to the latest patched version to mitigate risks associated with these vulnerabilities. Regular monitoring and updates are essential to maintaining the security of applications that rely on this library.
See every vulnerability recorded for libxml2 →
FAQ
libxml2 is a development library used for parsing and manipulating XML documents, supporting various XML standards.
The vulnerabilities can lead to denial of service (DoS) attacks, potentially crashing applications or causing unexpected behavior.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
The vulnerabilities have a CVSS score of 9.1, indicating a critical severity level.
You can update libxml2 using the command 'sudo dnf update libxml2' to install the patched version 0:2.9.7-21.el8_10.1.
References
Related vulnerabilities
Recent vulnerabilities recorded for libxml2.
