Uncontrolled Recursion in Libxml2 - CVE-2025-9714

Vulnerability identifier: #VU115166

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-9714

CWE-ID: CWE-674

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to uncontrolled recursion in XPath evaluation within the xmlXPathRunEval() function in xpath.c. A remote attacker can pass specially crated XML data to the application and perform a denial of service (DoS) attack.

Libxml2
SUSE Linux Enterprise Server 12 SP5 LTSS Extended
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Micro for Rancher
SUSE Linux Enterprise Micro
Anolis OS
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Ubuntu
openSUSE Leap
openEuler
Storage Defender - Resiliency Service
DataStage on Cloud Pak for Data
IBM supplied MQ Advanced container images
IBM Qradar SIEM
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
libxslt
libxslt-debuginfo
libxslt-debugsource
libxslt-devel
python2-libxslt
libxslt-help
libxml2 (Ubuntu package)
libxml2 (Red Hat package)
libxml2-2-debuginfo-32bit
python-libxml2
python-libxml2-debuginfo
libxml2-2-debuginfo
libxml2-debugsource
libxml2-tools-debuginfo
libxml2-2-32bit
libxml2-devel
libxml2-2
python-libxml2-debugsource
libxml2-tools
libxml2-doc
libxml2
python3-libxml2
python3-libxml2-python
python-libxml2-python-debugsource
python3-libxml2-python-debuginfo
libxml2-debuginfo
python2-libxml2
libxml2-help
libxml2-2-64bit-debuginfo
libxml2-devel-64bit
python311-libxml2
python3-libxml2-debuginfo
python311-libxml2-debuginfo
libxml2-2-64bit
libxml2-python-debugsource
libxml2-2-32bit-debuginfo
libxml2-devel-32bit
IBM Power Hardware Management Console (HMC)
App Connect Enterprise Certified Container
AppDynamics NodeJS Agent
AI Inference Server
AI Inference Server Model Optimization Tools
IBM MQ Operator
Red Hat OpenShift Container Platform
OpenShift Virtualization

Install updates from vendor's website.

Libxml2 - update to 2.10.0
DataStage on Cloud Pak for Data - update to 5.3.1 patch 3
IBM Qradar SIEM - update to 7.5.0 Update Pack 16
IBM Power Hardware Management Console (HMC) - addressed in versions 10.3.1064.1, 11.1.1112.1
App Connect Enterprise Certified Container - update to 12.19.0
AppDynamics NodeJS Agent - update to 25.12.1
libxslt - update to 1.1.34-10
libxslt-debuginfo - update to 1.1.34-10
libxslt-debugsource - update to 1.1.34-10
libxslt-devel - update to 1.1.34-10
python2-libxslt - update to 1.1.34-10
libxslt-help - update to 1.1.34-10
libxml2 (Ubuntu package) - addressed in versions 2.9.1+dfsg1-3ubuntu4.13+esm9, 2.9.3+dfsg1-1ubuntu0.7+esm10, 2.9.4+dfsg1-6.1ubuntu1.9+esm5, 2.9.10+dfsg-5ubuntu0.20.04.10+esm2, 2.9.13+dfsg-1ubuntu0.9, 2.9.14+dfsg-1.3ubuntu3.5, 2.12.7+dfsg+really2.9.14-0.4ubuntu0.3
libxml2 (Red Hat package) - addressed in versions 2.9.1-6.el7_9.14, 2.9.7-9.el8_4.9, 2.9.7-13.el8_6.13, 2.9.7-16.el8_8.13, 2.9.7-21.el8_10.4, 2.9.13-1.el9_0.8, 2.9.13-3.el9_2.10, 2.9.13-12.el9_6.1, 2.9.13-13.el9_4, 2.9.13-14.el9_7
libxml2-2-debuginfo-32bit - update to 2.9.4-46.93.1
python-libxml2 - update to 2.9.4-46.93.1
python-libxml2-debuginfo - update to 2.9.4-46.93.1
libxml2-2-debuginfo - addressed in versions 2.9.4-46.93.1, 2.9.7-150000.3.88.1, 2.9.14-150400.5.50.1
libxml2-debugsource - addressed in versions 2.9.4-46.93.1, 2.9.7-150000.3.88.1, 2.9.14-150400.5.50.1
libxml2-tools-debuginfo - addressed in versions 2.9.4-46.93.1, 2.9.7-150000.3.88.1, 2.9.14-150400.5.50.1
libxml2-2-32bit - addressed in versions 2.9.4-46.93.1, 2.9.14-150400.5.50.1
libxml2-devel - addressed in versions 2.9.4-46.93.1, 2.9.14-150400.5.50.1
libxml2-2 - addressed in versions 2.9.4-46.93.1, 2.9.7-150000.3.88.1, 2.9.14-150400.5.50.1
python-libxml2-debugsource - update to 2.9.4-46.93.1
libxml2-tools - addressed in versions 2.9.4-46.93.1, 2.9.7-150000.3.88.1, 2.9.14-150400.5.50.1
libxml2-doc - addressed in versions 2.9.4-46.93.1, 2.9.14-150400.5.50.1
libxml2 - update to 2.9.7-21.0.1
libxml2-devel - update to 2.9.7-21.0.1
python3-libxml2 - update to 2.9.7-21.0.1
python3-libxml2-python - update to 2.9.7-150000.3.88.1
python-libxml2-python-debugsource - update to 2.9.7-150000.3.88.1
python3-libxml2-python-debuginfo - update to 2.9.7-150000.3.88.1
python3-libxml2 - update to 2.9.10-50
libxml2 - update to 2.9.10-50
libxml2-debuginfo - update to 2.9.10-50
libxml2-debugsource - update to 2.9.10-50
libxml2-devel - update to 2.9.10-50
python2-libxml2 - update to 2.9.10-50
libxml2-help - update to 2.9.10-50
libxml2-2-64bit-debuginfo - update to 2.9.14-150400.5.50.1
libxml2-devel-64bit - update to 2.9.14-150400.5.50.1
python311-libxml2 - update to 2.9.14-150400.5.50.1
python3-libxml2-debuginfo - update to 2.9.14-150400.5.50.1
python311-libxml2-debuginfo - update to 2.9.14-150400.5.50.1
libxml2-2-64bit - update to 2.9.14-150400.5.50.1
libxml2-python-debugsource - update to 2.9.14-150400.5.50.1
python3-libxml2 - update to 2.9.14-150400.5.50.1
libxml2-2-32bit-debuginfo - update to 2.9.14-150400.5.50.1
libxml2-devel-32bit - update to 2.9.14-150400.5.50.1
AI Inference Server - update to 3.2.5
AI Inference Server Model Optimization Tools - update to 3.2.5
IBM MQ Operator - update to 3.9.0
Red Hat OpenShift Container Platform - addressed in versions 4.13.63, 4.14.61, 4.15.61, 4.16.56, 4.17.47, 4.18.32, 4.19.23, 4.20.12
OpenShift Virtualization - update to 4.19.17
IBM supplied MQ Advanced container images - addressed in versions 9.4.0.17-r2, 9.4.5.0-r1

• https://gitlab.gnome.org/GNOME/libxml2/-/commit/677a42645ef22b5a50741bad5facf9d8a8bc6d21

• Remote denial of service in libxml2
• Ubuntu update for libxml2
• openEuler 20.03 LTS SP4 update for libxslt
• openEuler 20.03 LTS SP4 update for libxml2
• SUSE update for libxml2
• SUSE update for libxml2
• SUSE update for libxml2
• Red Hat Enterprise Linux 9 update for libxml2
• Red Hat Enterprise Linux 9 update for libxml2
• Red Hat Enterprise Linux 9 update for libxml2
• Red Hat Enterprise Linux 9 update for libxml2
• Red Hat Enterprise Linux 9 update for libxml2
• Multiple vulnerabilities in Red Hat AI Inference Server Model Optimization Tools
• Multiple vulnerabilities in Red Hat AI Inference Server (TPU)
• Multiple vulnerabilities in Red Hat AI Inference Server (CUDA)
• Multiple vulnerabilities in Red Hat AI Inference Server (ROCm)
• Multiple vulnerabilities in Red Hat AI Inference Server (ROCm)
• Multiple vulnerabilities in IBM App Connect Enterprise Certified Container
• Multiple vulnerabilities in OpenShift Virtualization 4.19
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.17
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.13
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.20
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.16
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.14
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.18
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.19
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.15
• Multiple vulnerabilities in IBM MQ Operator and Queue manager container images
• Multiple vulnerabilities in IBM Storage Defender - Resiliency Service
• Splunk AppDynamics NodeJS Agent update for third-party components
• Red Hat Enterprise Linux 8 update for libxml2
• Red Hat Enterprise Linux 8 update for libxml2
• Anolis OS update for libxml2
• Red Hat Enterprise Linux 8 update for libxml2
• Red Hat Enterprise Linux 8 update for libxml2
• Red Hat Enterprise Linux 7 Extended Lifecycle Support update for libxml2
• Multiple vulnerabilities in IBM DataStage on Cloud Pak for Data
• IBM Power Hardware Management Console (HMC) update for libxml2
• Multiple vulnerabilities in IBM QRadar SIEM