---
id: CVE-2021-3537
title: >-
  A vulnerability found in libxml2 in versions before 2.9.11 shows that it did
  not propagate errors while parsing XML mixed content, causing a NULL
  dereference
summary: >-
  A vulnerability found in libxml2 in versions before 2.9.11 shows that it did
  not propagate errors while parsing XML mixed content, causing a NULL
  dereference. If an untrusted XML document was parsed in recovery mode and
  post-validated, t…
severity: medium
cvss: 5.9
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-476
  - CWE-476
vendor: xmlsoft
product: libxml2
affected:
  - libxml2 < 2.9.11
  - jboss_core_services
  - enterprise_linux = 6.0
  - enterprise_linux = 7.0
  - enterprise_linux = 8.0
  - debian_linux = 9.0
  - fedora = 33
  - fedora = 34
  - active_iq_unified_manager
  - clustered_data_ontap
  - clustered_data_ontap_antivirus_connector
  - manageability_software_development_kit
  - ontap_select_deploy_administration_utility
  - snapdrive
  - hci_h410c_firmware
  - >-
    communications_cloud_native_core_network_function_cloud_native_environment =
    1.10.0
  - enterprise_manager_base_platform = 13.4.0.0
  - enterprise_manager_base_platform = 13.5.0.0
  - enterprise_manager_ops_center = 12.4.0.0
  - mysql_workbench <= 8.0.26
  - openjdk = 8
  - peoplesoft_enterprise_peopletools = 8.58
  - real_user_experience_insight = 13.4.1.0
  - real_user_experience_insight = 13.5.1.0
patched:
  - libxml2 2.9.11
published: '2021-05-14'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T10:17:45.043'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2021-3537'
references:
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=1956522'
    label: secalert@redhat.com
  - url: 'https://lists.debian.org/debian-lts-announce/2021/05/msg00008.html'
    label: secalert@redhat.com
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BZOMV5J4PMZAORVT64BKLV6YIZAFDGX6/
    label: secalert@redhat.com
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QVM4UJ3376I6ZVOYMHBNX4GY3NIV52WV/
    label: secalert@redhat.com
  - url: 'https://security.gentoo.org/glsa/202107-05'
    label: secalert@redhat.com
  - url: 'https://security.netapp.com/advisory/ntap-20210625-0002/'
    label: secalert@redhat.com
  - url: 'https://www.oracle.com/security-alerts/cpuapr2022.html'
    label: secalert@redhat.com
  - url: 'https://www.oracle.com/security-alerts/cpujul2022.html'
    label: secalert@redhat.com
  - url: 'https://www.oracle.com/security-alerts/cpuoct2021.html'
    label: secalert@redhat.com
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=1956522'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://lists.debian.org/debian-lts-announce/2021/05/msg00008.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BZOMV5J4PMZAORVT64BKLV6YIZAFDGX6/
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QVM4UJ3376I6ZVOYMHBNX4GY3NIV52WV/
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://security.gentoo.org/glsa/202107-05'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://security.netapp.com/advisory/ntap-20210625-0002/'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://www.oracle.com/security-alerts/cpuapr2022.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://www.oracle.com/security-alerts/cpujul2022.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://www.oracle.com/security-alerts/cpuoct2021.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-398330.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
tags:
  - nvd
epss: 0.03503
epssPercentile: 0.88906
ingestedAt: '2026-10-14T10:25:41.189Z'
---

## Overview

A vulnerability found in libxml2 in versions before 2.9.11 shows that it did not propagate errors while parsing XML mixed content, causing a NULL dereference. If an untrusted XML document was parsed in recovery mode and post-validated, the flaw could be used to crash the application. The highest threat from this vulnerability is to system availability.

## Affected

- `libxml2 < 2.9.11`
- `jboss_core_services`
- `enterprise_linux = 6.0`
- `enterprise_linux = 7.0`
- `enterprise_linux = 8.0`
- `debian_linux = 9.0`
- `fedora = 33`
- `fedora = 34`
- `active_iq_unified_manager`
- `clustered_data_ontap`
- `clustered_data_ontap_antivirus_connector`
- `manageability_software_development_kit`
- `ontap_select_deploy_administration_utility`
- `snapdrive`
- `hci_h410c_firmware`
- `communications_cloud_native_core_network_function_cloud_native_environment = 1.10.0`
- `enterprise_manager_base_platform = 13.4.0.0`
- `enterprise_manager_base_platform = 13.5.0.0`
- `enterprise_manager_ops_center = 12.4.0.0`
- `mysql_workbench <= 8.0.26`
- `openjdk = 8`
- `peoplesoft_enterprise_peopletools = 8.58`
- `real_user_experience_insight = 13.4.1.0`
- `real_user_experience_insight = 13.5.1.0`

## Remediation

Upgrade past the affected range:

- `libxml2 2.9.11`