Infinite loop in Libxml2 - CVE-2025-8732

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU117630

Infinite loop in Libxml2 - CVE-2025-8732

Published: October 24, 2025


Vulnerability identifier: #VU117630
CSH Severity: Low
CVSS v4: 1.8 [CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-8732
CWE-ID: CWE-835
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop within the xmlParseSGMLCatalog() function in catalog.c when parsing untrusted SGML catalogs. A remote attacker can trick the victim into passing a specially crafted SGML catalogs to the application and perform a denial of service (DoS) attack.


Affected software

Libxml2
SUSE Linux Enterprise Server 12 SP5 LTSS Extended
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Micro for Rancher
SUSE Linux Enterprise Micro
Ubuntu
Python 3 Module
Basesystem Module
openSUSE Leap
openEuler
libxml2 (Ubuntu package)
libxml2-debugsource
libxml2-2-debuginfo
libxml2-doc
libxml2-tools
python-libxml2-debugsource
libxml2-2
libxml2-2-debuginfo-32bit
python-libxml2-debuginfo
python-libxml2
libxml2-devel
libxml2-2-32bit
libxml2-tools-debuginfo
python3-libxml2-python
python-libxml2-python-debugsource
python3-libxml2-python-debuginfo
libxml2-help
python3-libxml2
libxml2-debuginfo
libxml2
python3-libxml2-debuginfo
python311-libxml2
python311-libxml2-debuginfo
libxml2-2-64bit-debuginfo
libxml2-python-debugsource
libxml2-2-32bit-debuginfo
libxml2-devel-32bit
libxml2-2-64bit
libxml2-devel-64bit

How to mitigate CVE-2025-8732

Install updates from vendor's repository.

libxml2 (Ubuntu package) - addressed in versions 2.9.1+dfsg1-3ubuntu4.13+esm11, 2.9.3+dfsg1-1ubuntu0.7+esm12, 2.9.4+dfsg1-6.1ubuntu1.9+esm7, 2.9.10+dfsg-5ubuntu0.20.04.10+esm4, 2.9.13+dfsg-1ubuntu0.11, 2.9.14+dfsg-1.3ubuntu3.7, 2.14.5+dfsg-0.2ubuntu0.1
libxml2-debugsource - addressed in versions 2.9.4-46.93.1, 2.9.7-150000.3.88.1, 2.9.14-150400.5.50.1, 2.10.3-150500.5.38.1, 2.12.10-150700.4.11.1
libxml2-2-debuginfo - addressed in versions 2.9.4-46.93.1, 2.9.7-150000.3.88.1, 2.9.14-150400.5.50.1, 2.10.3-150500.5.38.1, 2.12.10-150700.4.11.1
libxml2-doc - addressed in versions 2.9.4-46.93.1, 2.9.14-150400.5.50.1, 2.10.3-150500.5.38.1
libxml2-tools - addressed in versions 2.9.4-46.93.1, 2.9.7-150000.3.88.1, 2.9.14-150400.5.50.1, 2.10.3-150500.5.38.1, 2.12.10-150700.4.11.1
python-libxml2-debugsource - update to 2.9.4-46.93.1
libxml2-2 - addressed in versions 2.9.4-46.93.1, 2.9.7-150000.3.88.1, 2.9.14-150400.5.50.1, 2.10.3-150500.5.38.1, 2.12.10-150700.4.11.1
libxml2-2-debuginfo-32bit - update to 2.9.4-46.93.1
python-libxml2-debuginfo - update to 2.9.4-46.93.1
python-libxml2 - update to 2.9.4-46.93.1
libxml2-devel - addressed in versions 2.9.4-46.93.1, 2.9.14-150400.5.50.1, 2.10.3-150500.5.38.1, 2.12.10-150700.4.11.1
libxml2-2-32bit - addressed in versions 2.9.4-46.93.1, 2.9.14-150400.5.50.1, 2.10.3-150500.5.38.1, 2.12.10-150700.4.11.1
libxml2-tools-debuginfo - addressed in versions 2.9.4-46.93.1, 2.9.7-150000.3.88.1, 2.9.14-150400.5.50.1, 2.10.3-150500.5.38.1, 2.12.10-150700.4.11.1
python3-libxml2-python - update to 2.9.7-150000.3.88.1
python-libxml2-python-debugsource - update to 2.9.7-150000.3.88.1
python3-libxml2-python-debuginfo - update to 2.9.7-150000.3.88.1
libxml2-help - update to 2.9.14-26
python3-libxml2 - update to 2.9.14-26
libxml2-devel - update to 2.9.14-26
libxml2-debugsource - update to 2.9.14-26
libxml2-debuginfo - update to 2.9.14-26
libxml2 - update to 2.9.14-26
python3-libxml2-debuginfo - addressed in versions 2.9.14-150400.5.50.1, 2.10.3-150500.5.38.1, 2.12.10-150700.4.11.1
python311-libxml2 - addressed in versions 2.9.14-150400.5.50.1, 2.10.3-150500.5.38.1, 2.12.10-150700.4.11.1
python311-libxml2-debuginfo - addressed in versions 2.9.14-150400.5.50.1, 2.10.3-150500.5.38.1, 2.12.10-150700.4.11.1
libxml2-2-64bit-debuginfo - addressed in versions 2.9.14-150400.5.50.1, 2.10.3-150500.5.38.1
python3-libxml2 - addressed in versions 2.9.14-150400.5.50.1, 2.10.3-150500.5.38.1, 2.12.10-150700.4.11.1
libxml2-python-debugsource - addressed in versions 2.9.14-150400.5.50.1, 2.10.3-150500.5.38.1, 2.12.10-150700.4.11.1
libxml2-2-32bit-debuginfo - addressed in versions 2.9.14-150400.5.50.1, 2.10.3-150500.5.38.1, 2.12.10-150700.4.11.1
libxml2-devel-32bit - addressed in versions 2.9.14-150400.5.50.1, 2.10.3-150500.5.38.1
libxml2-2-64bit - addressed in versions 2.9.14-150400.5.50.1, 2.10.3-150500.5.38.1
libxml2-devel-64bit - addressed in versions 2.9.14-150400.5.50.1, 2.10.3-150500.5.38.1

External References

Related Security Bulletins