CVE-2025-49796Libxml: type confusion leads to denial of service (dos)

Description

A vulnerability was found in libxml2. Processing certain sch:name elements from the input XML file can trigger a memory corruption issue. This flaw allows an attacker to craft a malicious XML input file that can lead libxml to crash, resulting in a denial of service or other possible undefined behavior due to sensitive data being corrupted in memory.

Timeline

Scores

EPSS (exploitation in 30 days)

1.6% · top 23% of all CVEs (14 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: yes · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.1.

Affected products

• libxml2

  • affected < 2.15.0

• Red Hat · Red Hat Enterprise Linux 10

  • unaffected 0:2.12.5-7.el10_0 – < *

• Red Hat · Red Hat Enterprise Linux 7 Extended Lifecycle Support

  • unaffected 0:2.9.1-6.el7_9.10 – < *

• Red Hat · Red Hat Enterprise Linux 8

  • unaffected 0:2.9.7-21.el8_10.1 – < *

• Red Hat · Red Hat Enterprise Linux 8

  • unaffected 0:2.9.7-21.el8_10.1 – < *

• Red Hat · Red Hat Enterprise Linux 8.2 Advanced Update Support

  • unaffected 0:2.9.7-9.el8_2.3 – < *

• Red Hat · Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support

  • unaffected 0:2.9.7-9.el8_4.6 – < *

• Red Hat · Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On

  • unaffected 0:2.9.7-9.el8_4.6 – < *

• Red Hat · Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support

  • unaffected 0:2.9.7-13.el8_6.10 – < *

• Red Hat · Red Hat Enterprise Linux 8.6 Telecommunications Update Service

  • unaffected 0:2.9.7-13.el8_6.10 – < *

• Red Hat · Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions

  • unaffected 0:2.9.7-13.el8_6.10 – < *

• Red Hat · Red Hat Enterprise Linux 8.8 Telecommunications Update Service

  • unaffected 0:2.9.7-16.el8_8.9 – < *

• Red Hat · Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions

  • unaffected 0:2.9.7-16.el8_8.9 – < *

• Red Hat · Red Hat Enterprise Linux 9

  • unaffected 0:2.9.13-10.el9_6 – < *

• Red Hat · Red Hat Enterprise Linux 9

  • unaffected 0:2.9.13-10.el9_6 – < *

• Red Hat · Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions

  • unaffected 0:2.9.13-1.el9_0.5 – < *

• Red Hat · Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

  • unaffected 0:2.9.13-3.el9_2.7 – < *

• Red Hat · Red Hat Enterprise Linux 9.4 Extended Update Support

  • unaffected 0:2.9.13-10.el9_4 – < *

• Red Hat · Red Hat JBoss Core Services 2.4.62.SP2

  All versions: unaffected

• Red Hat · Red Hat OpenShift Container Platform 4.12

  • unaffected 412.86.202510291903-0 – < *

• Red Hat · Red Hat OpenShift Container Platform 4.13

  • unaffected 413.92.202510150118-0 – < *

• Red Hat · Red Hat OpenShift Container Platform 4.14

  • unaffected 414.92.202510211419-0 – < *

• Red Hat · Red Hat OpenShift Container Platform 4.15

  • unaffected 415.92.202609140326-0 – < *

• Red Hat · Red Hat OpenShift Container Platform 4.16

  • unaffected 416.94.202609011112-0 – < *

• Red Hat · Red Hat OpenShift Container Platform 4.17

  • unaffected 417.94.202510112152-0 – < *

• Red Hat · Red Hat OpenShift Container Platform 4.18

  • unaffected 418.94.202510230424-0 – < *

• Red Hat · Red Hat OpenShift Container Platform 4.19

  • unaffected 4.19.9.6.202510140714-0 – < *

• Red Hat · Red Hat OpenShift Container Platform 4.20

  • unaffected 4.20.9.6.202509251656-0 – < *

• Red Hat · Red Hat Web Terminal 1.11 on RHEL 9

  • unaffected 1.11-19 – < *

• Red Hat · Red Hat Web Terminal 1.11 on RHEL 9

  • unaffected 1.11-8 – < *

• Red Hat · Red Hat Web Terminal 1.12 on RHEL 9

  • unaffected 1.12-4 – < *

• Red Hat · RHOSS-1.36-RHEL-8

  • unaffected 1.36.0-11 – < *

• Red Hat · RHOSS-1.36-RHEL-8

  • unaffected 1.36.0-11 – < *

• Red Hat · RHOSS-1.36-RHEL-8

  • unaffected 1.36.0-11 – < *

• Red Hat · RHOSS-1.36-RHEL-8

  • unaffected 1.36.0-10 – < *

• Red Hat · RHOSS-1.36-RHEL-8

  • unaffected 1.36.0-10 – < *

• Red Hat · RHOSS-1.36-RHEL-8

  • unaffected 1.36.0-4 – < *

• Red Hat · RHOSS-1.36-RHEL-8

  • unaffected 1.36.0-9 – < *

• Red Hat · RHOSS-1.36-RHEL-8

  • unaffected 1.36.0-12 – < *

• Red Hat · RHOSS-1.36-RHEL-8

  • unaffected 1.36.0-18 – < *

• Red Hat · RHOSS-1.36-RHEL-8

  • unaffected 1.36.0-11 – < *

• Red Hat · RHOSS-1.36-RHEL-8

  • unaffected 1.36.0-7 – < *

• Red Hat · cert-manager operator for Red Hat OpenShift 1.16

  • unaffected v1.16.5-1760515757 – < *

• Red Hat · OpenShift File Integrity Operator - FIO 1

  • unaffected v1.3 – < *

• Red Hat · Red Hat Discovery 2

  • unaffected 2.0.1-1754478727 – < *

• Red Hat · Red Hat Hardened Images

  • unaffected 2.15.2-0.3.hum1 – < *

• Red Hat · Red Hat Insights proxy 1.5

  • unaffected 1.5.5-1754504343 – < *

• Red Hat · Red Hat Enterprise Linux 6

  All versions: unknown

What to do

Workaround: There's no available mitigation other than to avoid processing untrusted XML documents if the user is unable/unwilling to update the library.

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• EUVD EUVD-2025-18415 (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2025-49796](https://cveledger.app/badge/CVE-2025-49796.svg)](https://cveledger.app/cve/CVE-2025-49796)

Record last updated 4 Nov 2026, 21:35 UTC.