VulnerabilityAnalyzed

CVE-2024-40896

This makes classic XXE attacks possible.

CRITICAL 9.1EPSS 1.23%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (1.23%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

In libxml2 2.11 before 2.11.9, 2.12 before 2.12.9, and 2.13 before 2.13.3, the SAX parser can produce events for external entities even if custom SAX handlers try to override entity content (by setting "checked"). This makes classic XXE attacks possible.

CVSS 3.1: 9.1 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
EPSS: 1.23% probability · 67th percentile
CISA KEV: Not listed
Weakness: CWE-611
Affected: xmlsoft/libxml2 · netapp/hci compute node · netapp/solidfire \& hci management node · netapp/solidfire \& hci storage node · netapp/h300s firmware · netapp/h410s firmware · netapp/h500s firmware · netapp/h700s firmware · netapp/h410c firmware
Source: cve@mitre.org

References

https://gitlab.gnome.org/GNOME/libxml2/-/commit/1a8932303969907f6572b1b6aac4081c56adb5c6Issue Tracking
https://gitlab.gnome.org/GNOME/libxml2/-/issues/761Issue Tracking
https://security.netapp.com/advisory/ntap-20250228-0004/Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.