--- id: CVE-2025-6021 title: >- A flaw was found in libxml2's xmlBuildQName function, where integer overflows in buffer size calculations can lead to a stack-based buffer overflow summary: >- A flaw was found in libxml2's xmlBuildQName function, where integer overflows in buffer size calculations can lead to a stack-based buffer overflow. This issue can result in memory corruption or a denial of service when processing crafte… severity: high cvss: 7.5 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H' cwe: - CWE-787 vendor: xmlsoft product: libxml2 affected: - libxml2 < 2.14.4 - jboss_core_services - openshift_container_platform = 4.12 - openshift_container_platform = 4.13 - openshift_container_platform = 4.14 - openshift_container_platform = 4.15 - openshift_container_platform = 4.16 - openshift_container_platform = 4.17 - openshift_container_platform = 4.18 - openshift_container_platform_for_arm64 = 4.13 - openshift_container_platform_for_arm64 = 4.14 - openshift_container_platform_for_arm64 = 4.15 - openshift_container_platform_for_arm64 = 4.16 - openshift_container_platform_for_arm64 = 4.17 - openshift_container_platform_for_arm64 = 4.18 - openshift_container_platform_for_ibm_z = 4.13 - openshift_container_platform_for_ibm_z = 4.14 - openshift_container_platform_for_ibm_z = 4.15 - openshift_container_platform_for_ibm_z = 4.16 - openshift_container_platform_for_ibm_z = 4.17 - openshift_container_platform_for_ibm_z = 4.18 - openshift_container_platform_for_linuxone = 4.13 - openshift_container_platform_for_linuxone = 4.14 - openshift_container_platform_for_linuxone = 4.15 - openshift_container_platform_for_linuxone = 4.16 - openshift_container_platform_for_linuxone = 4.17 - openshift_container_platform_for_linuxone = 4.18 - openshift_container_platform_for_power = 4.13 - openshift_container_platform_for_power = 4.14 - openshift_container_platform_for_power = 4.15 - openshift_container_platform_for_power = 4.16 - openshift_container_platform_for_power = 4.17 - openshift_container_platform_for_power = 4.18 - enterprise_linux = 8.0 - enterprise_linux = 9.0 - enterprise_linux = 10.0 - enterprise_linux_eus = 8.4 - enterprise_linux_eus = 8.6 - enterprise_linux_eus = 8.8 - enterprise_linux_eus = 9.4 - enterprise_linux_eus = 9.6 - enterprise_linux_eus = 10.0 - enterprise_linux_for_arm_64 = 8.0_aarch64 - enterprise_linux_for_arm_64 = 9.0_aarch64 - enterprise_linux_for_arm_64 = 9.4_aarch64 - enterprise_linux_for_arm_64 = 10.0_aarch64 - enterprise_linux_for_arm_64_eus = 9.4_aarch64 - enterprise_linux_for_arm_64_eus = 9.6_aarch64 - enterprise_linux_for_arm_64_eus = 10.0_aarch64 - enterprise_linux_for_ibm_z_systems = 8.0_s390x - enterprise_linux_for_ibm_z_systems = 9.4_s390x - enterprise_linux_for_ibm_z_systems = 10.0_s390x - enterprise_linux_for_ibm_z_systems_eus = 9.0_s390x - enterprise_linux_for_ibm_z_systems_eus = 9.4_s390x - enterprise_linux_for_ibm_z_systems_eus = 9.6_s390x - enterprise_linux_for_ibm_z_systems_eus = 10.0_s390x - enterprise_linux_for_power_little_endian = 8.0_ppc64le - enterprise_linux_for_power_little_endian = 9.0_ppc64le - enterprise_linux_for_power_little_endian = 10.0_ppc64le - enterprise_linux_for_power_little_endian_eus = 9.4_ppc64le - enterprise_linux_for_power_little_endian_eus = 9.6_ppc64le - enterprise_linux_for_power_little_endian_eus = 10.0_ppc64le - enterprise_linux_server = 7.0 - enterprise_linux_server_aus = 8.2 - enterprise_linux_server_aus = 8.4 - enterprise_linux_server_aus = 8.6 - enterprise_linux_server_aus = 9.2 - enterprise_linux_server_aus = 9.4 - enterprise_linux_server_aus = 9.6 - >- enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions = 9.4_ppc64le - enterprise_linux_server_tus = 8.8 - in-vehicle_operating_system = 1.0 patched: - libxml2 2.14.4 published: '2025-06-12' updated: '2026-09-18' sourceUpdated: '2026-09-18T18:17:04.593' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-6021' references: - url: 'https://access.redhat.com/errata/RHSA-2025:10630' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2025:10698' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2025:10699' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2025:11580' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2025:11673' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2025:12098' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2025:12099' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2025:12199' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2025:12237' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2025:12239' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2025:12240' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2025:12241' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2025:13267' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2025:13289' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2025:13325' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2025:13335' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2025:13336' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2025:14059' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2025:14396' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2025:15308' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2025:15672' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2025:19020' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:7519' label: secalert@redhat.com - url: 'https://access.redhat.com/security/cve/CVE-2025-6021' label: secalert@redhat.com - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2372406' label: secalert@redhat.com - url: 'https://gitlab.gnome.org/GNOME/libxml2/-/issues/926' label: secalert@redhat.com - url: 'https://lists.debian.org/debian-lts-announce/2025/07/msg00014.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://cert-portal.siemens.com/productcert/html/ssa-032379.html' label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e - url: 'https://gitlab.gnome.org/GNOME/libxml2/-/issues/926' label: 134c704f-9b21-4f2e-91b3-4a467353bcc0 - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-6021.json - url: 'https://www.cve.org/CVERecord?id=CVE-2025-6021' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-6021' tags: - nvd - cve.org - exploit-available - csaf - vex - red-hat exploitAvailable: true ssvc: exploitation: poc automatable: 'yes' technicalImpact: partial timestamp: '2025-09-03T14:41:19.578427Z' epss: 0.01367 epssPercentile: 0.7021 ingestedAt: '2026-06-29T13:24:34.365Z' --- ## Overview A flaw was found in libxml2's xmlBuildQName function, where integer overflows in buffer size calculations can lead to a stack-based buffer overflow. This issue can result in memory corruption or a denial of service when processing crafted input. ## Affected - `libxml2 < 2.14.4` - `jboss_core_services` - `openshift_container_platform = 4.12` - `openshift_container_platform = 4.13` - `openshift_container_platform = 4.14` - `openshift_container_platform = 4.15` - `openshift_container_platform = 4.16` - `openshift_container_platform = 4.17` - `openshift_container_platform = 4.18` - `openshift_container_platform_for_arm64 = 4.13` - `openshift_container_platform_for_arm64 = 4.14` - `openshift_container_platform_for_arm64 = 4.15` - `openshift_container_platform_for_arm64 = 4.16` - `openshift_container_platform_for_arm64 = 4.17` - `openshift_container_platform_for_arm64 = 4.18` - `openshift_container_platform_for_ibm_z = 4.13` - `openshift_container_platform_for_ibm_z = 4.14` - `openshift_container_platform_for_ibm_z = 4.15` - `openshift_container_platform_for_ibm_z = 4.16` - `openshift_container_platform_for_ibm_z = 4.17` - `openshift_container_platform_for_ibm_z = 4.18` - `openshift_container_platform_for_linuxone = 4.13` - `openshift_container_platform_for_linuxone = 4.14` - `openshift_container_platform_for_linuxone = 4.15` - `openshift_container_platform_for_linuxone = 4.16` - `openshift_container_platform_for_linuxone = 4.17` - `openshift_container_platform_for_linuxone = 4.18` - `openshift_container_platform_for_power = 4.13` - `openshift_container_platform_for_power = 4.14` - `openshift_container_platform_for_power = 4.15` - `openshift_container_platform_for_power = 4.16` - `openshift_container_platform_for_power = 4.17` - `openshift_container_platform_for_power = 4.18` - `enterprise_linux = 8.0` - `enterprise_linux = 9.0` - `enterprise_linux = 10.0` - `enterprise_linux_eus = 8.4` - `enterprise_linux_eus = 8.6` - `enterprise_linux_eus = 8.8` - `enterprise_linux_eus = 9.4` - `enterprise_linux_eus = 9.6` - `enterprise_linux_eus = 10.0` - `enterprise_linux_for_arm_64 = 8.0_aarch64` - `enterprise_linux_for_arm_64 = 9.0_aarch64` - `enterprise_linux_for_arm_64 = 9.4_aarch64` - `enterprise_linux_for_arm_64 = 10.0_aarch64` - `enterprise_linux_for_arm_64_eus = 9.4_aarch64` - `enterprise_linux_for_arm_64_eus = 9.6_aarch64` - `enterprise_linux_for_arm_64_eus = 10.0_aarch64` - `enterprise_linux_for_ibm_z_systems = 8.0_s390x` - `enterprise_linux_for_ibm_z_systems = 9.4_s390x` - `enterprise_linux_for_ibm_z_systems = 10.0_s390x` - `enterprise_linux_for_ibm_z_systems_eus = 9.0_s390x` - `enterprise_linux_for_ibm_z_systems_eus = 9.4_s390x` - `enterprise_linux_for_ibm_z_systems_eus = 9.6_s390x` - `enterprise_linux_for_ibm_z_systems_eus = 10.0_s390x` - `enterprise_linux_for_power_little_endian = 8.0_ppc64le` - `enterprise_linux_for_power_little_endian = 9.0_ppc64le` - `enterprise_linux_for_power_little_endian = 10.0_ppc64le` - `enterprise_linux_for_power_little_endian_eus = 9.4_ppc64le` - `enterprise_linux_for_power_little_endian_eus = 9.6_ppc64le` - `enterprise_linux_for_power_little_endian_eus = 10.0_ppc64le` - `enterprise_linux_server = 7.0` - `enterprise_linux_server_aus = 8.2` - `enterprise_linux_server_aus = 8.4` - `enterprise_linux_server_aus = 8.6` - `enterprise_linux_server_aus = 9.2` - `enterprise_linux_server_aus = 9.4` - `enterprise_linux_server_aus = 9.6` - `enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions = 9.4_ppc64le` - `enterprise_linux_server_tus = 8.8` - `in-vehicle_operating_system = 1.0` ## Remediation Upgrade past the affected range: - `libxml2 2.14.4` ## Vendor advisories - **RHSA-2025:12240** · Red Hat · fixed in: Red Hat Enterprise Linux Server (v. 7 ELS), Red Hat Enterprise Linux Server Optional (v. 7 ELS) · released 2025-07-30 · [advisory](https://access.redhat.com/errata/RHSA-2025:12240) - **RHSA-2025:15308** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.12 · released 2025-09-11 · [advisory](https://access.redhat.com/errata/RHSA-2025:15308) - **RHSA-2025:15672** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.13 · released 2025-09-18 · [advisory](https://access.redhat.com/errata/RHSA-2025:15672) - **RHSA-2025:13289** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.14 · released 2025-08-14 · [advisory](https://access.redhat.com/errata/RHSA-2025:13289) - **RHSA-2025:14396** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.15 · released 2025-08-27 · [advisory](https://access.redhat.com/errata/RHSA-2025:14396) - **RHSA-2025:13336** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.16 · released 2025-08-13 · [advisory](https://access.redhat.com/errata/RHSA-2025:13336) - **RHSA-2025:14059** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.17 · released 2025-08-27 · [advisory](https://access.redhat.com/errata/RHSA-2025:14059) - **RHSA-2025:13325** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.18 · released 2025-08-13 · [advisory](https://access.redhat.com/errata/RHSA-2025:13325) - **RHSA-2025:11673** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.19 · released 2025-07-29 · [advisory](https://access.redhat.com/errata/RHSA-2025:11673) - **RHSA-2025:10630** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) · released 2025-07-08 · [advisory](https://access.redhat.com/errata/RHSA-2025:10630) - **RHSA-2025:10698** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux BaseOS (v. 8) · released 2025-07-09 · [advisory](https://access.redhat.com/errata/RHSA-2025:10698) - **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 6, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 6, Red Hat OpenShift Container Platform 4 · updated 2026-09-18 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-6021.json)