NULL Pointer Dereference Vulnerability in libxml2: Denial of Service Risk
Summary
UBUNTU-CVE-2025-49795: A NULL pointer dereference vulnerability was found in libxml2 when processing XPath XML expressions. Affects libxml2 versions 2.9.1+dfsg1-3ubuntu2 – 2.9.1+dfsg1-3ubuntu4.9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libxml2 is a widely used XML parsing library that provides a range of functionalities for processing XML and HTML documents. It is known for its performance and compliance with standards, making it a popular choice in various applications. However, a recently discovered NULL pointer dereference vulnerability poses a significant risk, allowing attackers to exploit this flaw through crafted XML inputs, potentially leading to denial of service.
Vulnerability Detail
The vulnerability arises from a NULL pointer dereference when libxml2 processes XPath XML expressions. This flaw can be exploited by an attacker who crafts a malicious XML input, causing the application to crash or become unresponsive. The technical implications of this vulnerability are severe, as it can lead to service disruptions and impact the availability of applications relying on libxml2 for XML processing.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider validating and sanitizing XML inputs before processing them with libxml2. This can help mitigate the risk of exploitation by ensuring that only well-formed and expected XML structures are processed.
Conclusion
The NULL pointer dereference vulnerability in libxml2 poses a significant risk to applications that rely on this library for XML processing. It is crucial to update to the latest patched version to mitigate potential denial of service attacks. Additionally, implementing input validation can serve as a temporary workaround until the update is applied.
See every vulnerability recorded for libxml2 →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
Affected versions include libxml2 versions prior to 2.9.14 across various Ubuntu LTS releases.
You can use Vulert, which allows you to monitor and alert for open-source vulnerabilities in your software using just a manifest file. Visit Vulert Scanner to check if your application is affected without requiring any signup.
The potential impacts include denial of service, application crashes, and disruptions in services relying on libxml2 for XML processing.
Yes, you can validate and sanitize XML inputs before processing them with libxml2 to reduce the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for libxml2.
