--- id: CVE-2021-3518 title: There's a flaw in libxml2 in versions before 2.9.11 summary: >- There's a flaw in libxml2 in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by an application linked with libxml2 could trigger a use-after-free. The greatest impact from this flaw is to confiden… severity: high cvss: 8.8 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H' cwe: - CWE-416 - CWE-416 vendor: xmlsoft product: libxml2 affected: - libxml2 < 2.9.11 - debian_linux = 9.0 - jboss_core_services - enterprise_linux = 8.0 - fedora = 33 - fedora = 34 - active_iq_unified_manager - clustered_data_ontap - clustered_data_ontap_antivirus_connector - manageability_software_development_kit - ontap_select_deploy_administration_utility - snapdrive - hci_h410c_firmware - >- communications_cloud_native_core_network_function_cloud_native_environment = 1.10.0 - enterprise_manager_base_platform = 13.4.0.0 - enterprise_manager_base_platform = 13.5.0.0 - enterprise_manager_ops_center = 12.4.0.0 - mysql_workbench <= 8.0.26 - peoplesoft_enterprise_peopletools = 8.58 - real_user_experience_insight = 13.4.1.0 - real_user_experience_insight = 13.5.1.0 patched: - libxml2 2.9.11 published: '2021-05-18' updated: '2026-10-14' sourceUpdated: '2026-10-14T10:17:44.110' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2021-3518' references: - url: 'http://seclists.org/fulldisclosure/2021/Jul/54' label: secalert@redhat.com - url: 'http://seclists.org/fulldisclosure/2021/Jul/55' label: secalert@redhat.com - url: 'http://seclists.org/fulldisclosure/2021/Jul/58' label: secalert@redhat.com - url: 'http://seclists.org/fulldisclosure/2021/Jul/59' label: secalert@redhat.com - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=1954242' label: secalert@redhat.com - url: >- https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E label: secalert@redhat.com - url: >- https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E label: secalert@redhat.com - url: 'https://lists.debian.org/debian-lts-announce/2021/05/msg00008.html' label: secalert@redhat.com - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BZOMV5J4PMZAORVT64BKLV6YIZAFDGX6/ label: secalert@redhat.com - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QVM4UJ3376I6ZVOYMHBNX4GY3NIV52WV/ label: secalert@redhat.com - url: 'https://security.gentoo.org/glsa/202107-05' label: secalert@redhat.com - url: 'https://security.netapp.com/advisory/ntap-20210625-0002/' label: secalert@redhat.com - url: 'https://support.apple.com/kb/HT212601' label: secalert@redhat.com - url: 'https://support.apple.com/kb/HT212602' label: secalert@redhat.com - url: 'https://support.apple.com/kb/HT212604' label: secalert@redhat.com - url: 'https://support.apple.com/kb/HT212605' label: secalert@redhat.com - url: 'https://www.oracle.com/security-alerts/cpuapr2022.html' label: secalert@redhat.com - url: 'https://www.oracle.com/security-alerts/cpujul2022.html' label: secalert@redhat.com - url: 'https://www.oracle.com/security-alerts/cpuoct2021.html' label: secalert@redhat.com - url: 'http://seclists.org/fulldisclosure/2021/Jul/54' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://seclists.org/fulldisclosure/2021/Jul/55' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://seclists.org/fulldisclosure/2021/Jul/58' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://seclists.org/fulldisclosure/2021/Jul/59' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=1954242' label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://lists.debian.org/debian-lts-announce/2021/05/msg00008.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BZOMV5J4PMZAORVT64BKLV6YIZAFDGX6/ label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QVM4UJ3376I6ZVOYMHBNX4GY3NIV52WV/ label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://security.gentoo.org/glsa/202107-05' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://security.netapp.com/advisory/ntap-20210625-0002/' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://support.apple.com/kb/HT212601' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://support.apple.com/kb/HT212602' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://support.apple.com/kb/HT212604' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://support.apple.com/kb/HT212605' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpuapr2022.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpujul2022.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpuoct2021.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://cert-portal.siemens.com/productcert/html/ssa-398330.html' label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e tags: - nvd epss: 0.21859 epssPercentile: 0.97602 ingestedAt: '2026-10-14T10:25:41.189Z' --- ## Overview There's a flaw in libxml2 in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by an application linked with libxml2 could trigger a use-after-free. The greatest impact from this flaw is to confidentiality, integrity, and availability. ## Affected - `libxml2 < 2.9.11` - `debian_linux = 9.0` - `jboss_core_services` - `enterprise_linux = 8.0` - `fedora = 33` - `fedora = 34` - `active_iq_unified_manager` - `clustered_data_ontap` - `clustered_data_ontap_antivirus_connector` - `manageability_software_development_kit` - `ontap_select_deploy_administration_utility` - `snapdrive` - `hci_h410c_firmware` - `communications_cloud_native_core_network_function_cloud_native_environment = 1.10.0` - `enterprise_manager_base_platform = 13.4.0.0` - `enterprise_manager_base_platform = 13.5.0.0` - `enterprise_manager_ops_center = 12.4.0.0` - `mysql_workbench <= 8.0.26` - `peoplesoft_enterprise_peopletools = 8.58` - `real_user_experience_insight = 13.4.1.0` - `real_user_experience_insight = 13.5.1.0` ## Remediation Upgrade past the affected range: - `libxml2 2.9.11`