UpHeron
All vulnerabilities

Servers and applications

CVE-2024-40896

In libxml2 2.11 before 2.11.9, 2.12 before 2.12.9, and 2.13 before 2.13.3, the SAX parser can produce events for external entities even if custom SAX handlers try to override entity content (by setting "checked"). This makes classic XXE attacks possible.

Severity
Critical 9.1
Published
23 Dec 2024
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
2.11.9, 2.12.9, 2.13.3
Sources
NVD

Affected software

SoftwareAffected versions
libxml2Servers and applications · cpe:a:xmlsoft:libxml2
  • From 2.11.0 before 2.11.9
  • From 2.12.0 before 2.12.9
  • From 2.13.0 before 2.13.3

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2024-40896
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2024-40896