CVE-2024-40896
In libxml2 2.11 before 2.11.9, 2.12 before 2.12.9, and 2.13 before 2.13.3, the SAX parser can produce events for external entities even if custom SAX handlers try to override entity content (by setting "checked"). This makes classic XXE attacks possible.
- Score
- CVSS 3.1 9.1 Critical
- Status
- Analyzed - cve@mitre.org
- Published
- 2024-12-23
- Last modified
- 2025-02-28
- Weaknesses
- CWE-611
Affected products
- Libxml2 (Libxml2)
- H300s Firmware (Netapp)
- H410c Firmware (Netapp)
- H410s Firmware (Netapp)
- H500s Firmware (Netapp)
- H700s Firmware (Netapp)
- Hci Compute Node (Netapp)
- Solidfire & Hci Management Node (Netapp)
- Solidfire & Hci Storage Node (Netapp)
- Libxml2 (Xmlsoft)
References
- https://gitlab.gnome.org/GNOME/libxml2/-/commit/1a8932303969907f6572b1b6aac4081c56adb5c6
- https://gitlab.gnome.org/GNOME/libxml2/-/issues/761
- https://security.netapp.com/advisory/ntap-20250228-0004/
