Moderate: libxml2 security update

libxml2 Updated 02 Oct 2025

Summary

23/01/2023

Disclosed on

N/A

Severity

Yes i

Fix available

High

Severity

8.2

CVSS Score

RLSA-2023:0338: Moderate: libxml2 security update. Affects libxml2 versions < 0:2.9.13-3.el9_1. Fixed in 0:2.9.13-3.el9_1. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

The libxml2 library is a development toolbox providing the implementation of various XML standards. It is used by applications to parse and manipulate XML data. The library is widely used in various software systems and frameworks.

Vulnerability Detail

The libxml2 library is affected by two security vulnerabilities:

Integer overflows with XML_PARSE_HUGE (CVE-2022-40303): This vulnerability allows an attacker to cause an integer overflow by providing a specially crafted XML file. This can lead to a heap-based buffer overflow, potentially resulting in arbitrary code execution.
Dictionary corruption caused by entity reference cycles (CVE-2022-40304): This vulnerability allows an attacker to create entity reference cycles in an XML file, leading to dictionary corruption. This can result in a denial of service (DoS) condition or potential arbitrary code execution.

Both vulnerabilities have a CVSS score of 8.2, indicating a moderate severity level.

How To Fix

Minimum fixed version

0:2.9.13-3.el9_1

This is the first release that contains the fix.

sudo dnf update libxml2

Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →

Workaround

There are no known workarounds for these vulnerabilities.

Conclusion

The libxml2 library is affected by two moderate-severity vulnerabilities. To mitigate these vulnerabilities, it is crucial to update the libxml2 library to version 2.9.13-3.el9_1 or later. For further support on vulnerability remediation, you can contact DevNack.com.

See every vulnerability recorded for libxml2 →

FAQ

What is libxml2?

Libxml2 is a development toolbox for parsing and manipulating XML data. It is widely used in various software systems and frameworks.

What is the impact of these vulnerabilities?

These vulnerabilities can potentially lead to arbitrary code execution or denial of service (DoS) conditions.

How can I check if my application is affected?

You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) and Vulert will provide real-time alerts for open-source vulnerabilities.