CVE-2021-3541Medium· 6.5▾ SunlitA flaw was found in libxml2. Exponential entity expansion attack its possible bypassing all existing protection mechanisms and leading to denial of service.
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0.4 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 14.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
2.0%
2.0% → 2.1%
A flaw was found in libxml2. Exponential entity expansion attack its possible bypassing all existing protection mechanisms and leading to denial of service.
libxml2 < 2.9.11jboss_core_serviceszfs_storage_appliance_kit = 8.8active_iq_unified_managercloud_backupclustered_data_ontapclustered_data_ontap_antivirus_connectormanageability_software_development_kitontap_select_deploy_administration_utilitysmi-s_providersnapdriveh410c_firmwareh300s_firmwareh500s_firmwareh700s_firmwareh300e_firmwareh500e_firmwareh700e_firmwareh410s_firmwareUpgrade past the affected range:
libxml2 2.9.11Connected by shared product, vendor, weakness, or advisory.
CVE-2021-3517High· 8.6There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11
CVE-2021-3516High· 7.8There's a flaw in libxml2's xmllint in versions before 2.9.11
CVE-2024-34459High· 7.5An issue was discovered in xmllint (from libxml2) before 2.11.8 and 2.12.x before 2.12.7
CVE-2023-45322Medium· 6.5libxml2 through 2.11.5 has a use-after-free that can only occur after a certain memory allocation fails
CVE-2023-39615Medium· 6.5Xmlsoft Libxml2 v2.11.0 was discovered to contain an out-of-bounds read via the xmlSAX2StartElement() function at /libxml2/SAX2.c
CVE-2023-29469Medium· 6.5An issue was discovered in libxml2 before 2.10.4