CVE-2024-40896: libxml2
CVSS: 9.1v3.1CriticalAnalyzed
AliasesSUSE-SU-2025:20116-1SUSE-SU-2025:20418-1openSUSE-SU-2025:0024-1CGA-c4qf-hwx3-qg32CGA-w8vp-hwg6-x3fjopenSUSE-SU-2024:14241-1openSUSE-SU-2024:14611-1CGA-44f4-xm8w-jphgCGA-48fq-f923-w6hxCGA-4xf3-r6hx-92mmCGA-544c-xr8g-6f7gCGA-5vpx-vvc5-5wv9CGA-69jf-x75p-hr6pCGA-76rv-c8f8-r857CGA-7ppm-cc7j-7f47CGA-8fxc-2px7-rp7gCGA-8j28-c5pj-gfqxCGA-cxf5-9m39-2m9fCGA-f399-36p8-2pvwCGA-f7pr-w9wx-g8p2CGA-f9x7-gc5r-985wCGA-gchc-9xp2-rhq6CGA-h27c-m2mc-8rrqCGA-h84c-hg37-9qgfCGA-jfc9-4vqp-4fr9CGA-jfw7-7c37-wqrhCGA-jm6f-jh49-g9gjCGA-jqfv-gx4g-hc2vCGA-jxg9-qghp-6fcjCGA-pv33-hv5w-4xx6CGA-q22c-h5x9-mxq8CGA-r9rq-pq3f-39v4CGA-rp67-9p9x-c3rmCGA-rw3j-8gjc-c7p9CGA-rx4f-3844-46mpCGA-v48q-63vv-cj89CGA-v8wr-m6xx-45q4CGA-wv39-7hm7-jcw4CGA-x6vg-54f4-66p4
Published 23-12-2024Last modified 28-02-2025
Vulnerability summary
CVE-2024-40896 is a critical (CVSS 9.1) vulnerability in libxml2. EPSS estimates a 1.22% chance of exploitation in the next 30 days, higher than 68.1% of scored vulnerabilities.
CVSS score
9.1/10
010
Critical · v3.1 (CVE.org)EPSS score
1.22%
0%100%
Low · -0.01 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 1 · Related 7Timeline
- 23-12-2024PublishedVulnerability first disclosed.
- 28-02-2025Last modifiedVulnerability information updated.
Description
In libxml2 2.11 before 2.11.9, 2.12 before 2.12.9, and 2.13 before 2.13.3, the SAX parser can produce events for external entities even if custom SAX handlers try to override entity content (by setting "checked"). This makes classic XXE attacks possible.
CVSS metrics
4 scores · 4 sources · 1 versionCritical 9.1Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:HSourcesAll 4 agree
- OSV · WolfiEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
- OSV · ChainguardEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
- NVDNIST9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
EPSS trend
Probability
1.22%
Chance of exploitation in the next 30 days
Percentile
68%
Versus all other CVEs
30-day change
-0.01 pp
From 1.23% on 18-09-2026
18-09-202618-10-2026
EPSS score1.22%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard17 products
- openjdk-11-openj9-default-policy< 0.53.0-r0
- openjdk-17-openj9-default-policy< 0.53.0-r0
- openjdk-21-openj9-default-policy< 0.53.0-r0
- openjdk-25-openj9< 0.59.0-r1
- openjdk-25-openj9-dbg< 0.59.0-r1
Opensuse4 products
- libxml2&distro=openSUSE Tumbleweed< 2.12.9-1.1
- qt6-webengine-docs&distro=openSUSE Leap 15.6< 6.6.3-bp156.2.3.1
- qt6-webengine&distro=openSUSE Leap 15.6< 6.6.3-bp156.2.3.1
- qt6-webengine&distro=openSUSE Tumbleweed< 6.8.1-2.1
Suse4 products
- libxml2&distro=SUSE Linux Micro 6.0< 2.11.6-4.1
- libxml2&distro=SUSE Linux Micro 6.1< 2.11.6-slfo.1.1_5.1
- qt6-webengine-docs&distro=SUSE Package Hub 15 SP6< 6.6.3-bp156.2.3.1
- qt6-webengine&distro=SUSE Package Hub 15 SP6< 6.6.3-bp156.2.3.1
Libxml21 product
- libxml2≥ 2.11.0, < 2.11.9 | ≥ 2.12.0, < 2.12.9 | ≥ 2.13.0, < 2.13.3
Wolfi1 product
- openjdk-7-jreAll versions (No fix recorded)
Xmlsoft1 product
- libxml2≥ 2.11.0, < 2.11.9 | ≥ 2.12.0, < 2.12.9 | ≥ 2.13.0, < 2.13.3
7 vendors · 36 products
References
12 links- lists.opensuse.org/archives/…Advisory
Show all 12 references
- lists.opensuse.org/archives/…Advisory