CVE catalog

CVE-2021-3517

libxml2: CVE-2021-3517

Severity: High · CVSS 8.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Published: Apr 22, 2021, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 16.99% · Oct 25, 2026

There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be processed by an application linked with the affected functionality of libxml2 could trigger an out-of-bounds read. The most likely impact of this flaw is to application availability, with some potential impact to confidentiality and integrity if an attacker is able to use memory information to further exploit the application.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	libxml2	sid	`2.15.4+dfsg-1`	fixed
Debian	libxml2	forky	`2.15.4+dfsg-1`	fixed
Debian	libxml2	trixie	`2.12.7+dfsg+really2.9.14-2.1+deb13u3`	fixed
Debian	libxml2	trixie-security	`2.12.7+dfsg+really2.9.14-2.1+deb13u1`	fixed
Debian	libxml2	bookworm	`2.9.14+dfsg-1.3~deb12u6`	fixed
Debian	libxml2	bookworm-security	`2.9.14+dfsg-1.3~deb12u4`	fixed
Cpe	libxml2	Not reported	`2.9.11`	fixed
Cpe	jboss_core_services	Not reported	Not reported	unknown
Cpe	enterprise_linux	Not reported	Not reported	unknown
Cpe	fedora	Not reported	Not reported	unknown
Cpe	debian_linux	Not reported	Not reported	unknown
Cpe	active_iq_unified_manager	Not reported	Not reported	unknown
Cpe	clustered_data_ontap	Not reported	Not reported	unknown
Cpe	clustered_data_ontap_antivirus_connector	Not reported	Not reported	unknown
Cpe	e-series_santricity_os_controller	Not reported	Not reported	unknown
Cpe	e-series_santricity_storage_manager	Not reported	Not reported	unknown
Cpe	e-series_santricity_web_services	Not reported	Not reported	unknown
Cpe	hci_management_node	Not reported	Not reported	unknown
Cpe	manageability_software_development_kit	Not reported	Not reported	unknown
Cpe	oncommand_insight	Not reported	Not reported	unknown
Cpe	oncommand_workflow_automation	Not reported	Not reported	unknown
Cpe	ontap_select_deploy_administration_utility	Not reported	Not reported	unknown
Cpe	santricity_unified_manager	Not reported	Not reported	unknown
Cpe	snapdrive	Not reported	Not reported	unknown
Alpine	libxml2	3.10	`2.9.9-r5`	fixed
Alpine	libxml2	3.11	`2.9.10-r5`	fixed
Alpine	libxml2	3.12	`2.9.10-r6`	fixed
Alpine	libxml2	3.13	`2.9.10-r7`	fixed
Alpine	libxml2	3.14	`2.9.11-r0`	fixed
Alpine	libxml2	3.15	`2.9.11-r0`	fixed
Alpine	libxml2	3.16	`2.9.11-r0`	fixed
Alpine	libxml2	3.17	`2.9.11-r0`	fixed
Alpine	libxml2	3.18	`2.9.11-r0`	fixed
Alpine	libxml2	3.19	`2.9.11-r0`	fixed
Alpine	libxml2	3.20	`2.9.11-r0`	fixed
Alpine	libxml2	3.21	`2.9.11-r0`	fixed
Alpine	libxml2	3.22	`2.9.11-r0`	fixed
Alpine	libxml2	3.23	`2.9.11-r0`	fixed
Alpine	libxml2	3.24	`2.9.11-r0`	fixed
Ubuntu	libxml2	pro	`2.9.2+zdfsg1-4`	vulnerable
Ubuntu	libxml2	pro	`2.9.2+zdfsg1-4ubuntu1`	vulnerable
Ubuntu	libxml2	pro	`2.9.2+zdfsg1-4ubuntu2`	vulnerable
Ubuntu	libxml2	pro	`2.9.2+zdfsg1-4ubuntu3`	vulnerable
Ubuntu	libxml2	pro	`2.9.3+dfsg1-1`	vulnerable
Ubuntu	libxml2	pro	`2.9.3+dfsg1-1ubuntu0.1`	vulnerable
Ubuntu	libxml2	pro	`2.9.3+dfsg1-1ubuntu0.2`	vulnerable
Ubuntu	libxml2	pro	`2.9.3+dfsg1-1ubuntu0.3`	vulnerable
Ubuntu	libxml2	pro	`2.9.3+dfsg1-1ubuntu0.4`	vulnerable
Ubuntu	libxml2	pro	`2.9.3+dfsg1-1ubuntu0.5`	vulnerable
Ubuntu	libxml2	pro	`2.9.3+dfsg1-1ubuntu0.6`	vulnerable
Ubuntu	libxml2	pro	`2.9.3+dfsg1-1ubuntu0.7`	vulnerable
Ubuntu	libxml2	pro	`2.9.3+dfsg1-1ubuntu0.7+esm1`	fixed
Ubuntu	libxml2	18.04	`2.9.4+dfsg1-4ubuntu1`	vulnerable
Ubuntu	libxml2	18.04	`2.9.4+dfsg1-5ubuntu1`	vulnerable
Ubuntu	libxml2	18.04	`2.9.4+dfsg1-5ubuntu2`	vulnerable
Ubuntu	libxml2	18.04	`2.9.4+dfsg1-5.1ubuntu1`	vulnerable
Ubuntu	libxml2	18.04	`2.9.4+dfsg1-5.2ubuntu1`	vulnerable
Ubuntu	libxml2	18.04	`2.9.4+dfsg1-6.1ubuntu1`	vulnerable
Ubuntu	libxml2	18.04	`2.9.4+dfsg1-6.1ubuntu1.2`	vulnerable
Ubuntu	libxml2	18.04	`2.9.4+dfsg1-6.1ubuntu1.3`	vulnerable
Ubuntu	libxml2	18.04	`2.9.4+dfsg1-6.1ubuntu1.4`	fixed
Ubuntu	libxml2	20.04	`2.9.4+dfsg1-7ubuntu3`	vulnerable
Ubuntu	libxml2	20.04	`2.9.4+dfsg1-7ubuntu5`	vulnerable
Ubuntu	libxml2	20.04	`2.9.4+dfsg1-8ubuntu1`	vulnerable
Ubuntu	libxml2	20.04	`2.9.4+dfsg1-8ubuntu2`	vulnerable
Ubuntu	libxml2	20.04	`2.9.4+dfsg1-8ubuntu3`	vulnerable
Ubuntu	libxml2	20.04	`2.9.10+dfsg-1ubuntu3`	vulnerable
Ubuntu	libxml2	20.04	`2.9.10+dfsg-4build1`	vulnerable
Ubuntu	libxml2	20.04	`2.9.10+dfsg-5`	vulnerable
Ubuntu	libxml2	20.04	`2.9.10+dfsg-5ubuntu0.20.04.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	libxml2	source	sid	`2.9.10+dfsg-6.6`	not yet assigned	Not reported	[987738]
Debian	libxml2	source	forky	`2.9.10+dfsg-6.6`	not yet assigned	Not reported	[987738]
Debian	libxml2	source	trixie	`2.9.10+dfsg-6.6`	not yet assigned	Not reported	[987738]
Debian	libxml2	source	bookworm	`2.9.10+dfsg-6.6`	not yet assigned	Not reported	[987738]
Cpe	libxml2	cpe	Not reported	`2.9.11`	Not reported	NVD-CVE-2021-3517	Not reported
Alpine	libxml2	apk	3.10	`2.9.9-r5`	Not reported	ALPINE-CVE-2021-3517	Not reported
Alpine	libxml2	apk	3.11	`2.9.10-r5`	Not reported	ALPINE-CVE-2021-3517	Not reported
Alpine	libxml2	apk	3.12	`2.9.10-r6`	Not reported	ALPINE-CVE-2021-3517	Not reported
Alpine	libxml2	apk	3.13	`2.9.10-r7`	Not reported	ALPINE-CVE-2021-3517	Not reported
Alpine	libxml2	apk	3.14	`2.9.11-r0`	Not reported	ALPINE-CVE-2021-3517	Not reported
Alpine	libxml2	apk	3.15	`2.9.11-r0`	Not reported	ALPINE-CVE-2021-3517	Not reported
Alpine	libxml2	apk	3.16	`2.9.11-r0`	Not reported	ALPINE-CVE-2021-3517	Not reported
Alpine	libxml2	apk	3.17	`2.9.11-r0`	Not reported	ALPINE-CVE-2021-3517	Not reported
Alpine	libxml2	apk	3.18	`2.9.11-r0`	Not reported	ALPINE-CVE-2021-3517	Not reported
Alpine	libxml2	apk	3.19	`2.9.11-r0`	Not reported	ALPINE-CVE-2021-3517	Not reported
Alpine	libxml2	apk	3.20	`2.9.11-r0`	Not reported	ALPINE-CVE-2021-3517	Not reported
Alpine	libxml2	apk	3.21	`2.9.11-r0`	Not reported	ALPINE-CVE-2021-3517	Not reported
Alpine	libxml2	apk	3.22	`2.9.11-r0`	Not reported	ALPINE-CVE-2021-3517	Not reported
Alpine	libxml2	apk	3.23	`2.9.11-r0`	Not reported	ALPINE-CVE-2021-3517	Not reported
Alpine	libxml2	apk	3.24	`2.9.11-r0`	Not reported	ALPINE-CVE-2021-3517	Not reported
Ubuntu	libxml2	deb	pro	`2.9.3+dfsg1-1ubuntu0.7+esm1`	Not reported	UBUNTU-CVE-2021-3517	Not reported
Ubuntu	libxml2	deb	18.04	`2.9.4+dfsg1-6.1ubuntu1.4`	Not reported	UBUNTU-CVE-2021-3517	Not reported
Ubuntu	libxml2	deb	20.04	`2.9.10+dfsg-5ubuntu0.20.04.1`	Not reported	UBUNTU-CVE-2021-3517	Not reported

[Debian bug #987738]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

[libxml2]Unknown
Details (4)
- 2.9.14+dfsg-1.3~deb12u6 · amd64 · bookworm
  Fixed · Fixed: 2.9.10+dfsg-6.6
  dsa · libxml2 · debian · bookworm
- 2.9.14+dfsg-1.3~deb12u6 · arm64 · bookworm
  Fixed · Fixed: 2.9.10+dfsg-6.6
  dsa · libxml2 · debian · bookworm
- 2.9.14+dfsg-1.3~deb12u4 · amd64 · bookworm-security
  Fixed · Fixed: 2.9.10+dfsg-6.6
  dsa · libxml2 · debian · bookworm
- 2.9.14+dfsg-1.3~deb12u4 · arm64 · bookworm-security
  Fixed · Fixed: 2.9.10+dfsg-6.6
  dsa · libxml2 · debian · bookworm
[libxml2-dev]Unknown
Source package: [libxml2]
Details (4)
- 2.9.14+dfsg-1.3~deb12u6 · amd64 · bookworm
  Fixed · Fixed: 2.9.10+dfsg-6.6
  dsa · libxml2 · debian · bookworm
- 2.9.14+dfsg-1.3~deb12u6 · arm64 · bookworm
  Fixed · Fixed: 2.9.10+dfsg-6.6
  dsa · libxml2 · debian · bookworm
- 2.9.14+dfsg-1.3~deb12u4 · amd64 · bookworm-security
  Fixed · Fixed: 2.9.10+dfsg-6.6
  dsa · libxml2 · debian · bookworm
- 2.9.14+dfsg-1.3~deb12u4 · arm64 · bookworm-security
  Fixed · Fixed: 2.9.10+dfsg-6.6
  dsa · libxml2 · debian · bookworm
[libxml2-doc]Unknown
Source package: [libxml2]
Details (4)
- 2.9.14+dfsg-1.3~deb12u6 · all · bookworm
  Fixed · Fixed: 2.9.10+dfsg-6.6
  dsa · libxml2 · debian · bookworm
- 2.9.14+dfsg-1.3~deb12u6 · all · bookworm
  Fixed · Fixed: 2.9.10+dfsg-6.6
  dsa · libxml2 · debian · bookworm
- 2.9.14+dfsg-1.3~deb12u4 · all · bookworm-security
  Fixed · Fixed: 2.9.10+dfsg-6.6
  dsa · libxml2 · debian · bookworm
- 2.9.14+dfsg-1.3~deb12u4 · all · bookworm-security
  Fixed · Fixed: 2.9.10+dfsg-6.6
  dsa · libxml2 · debian · bookworm
[libxml2-utils]Unknown
Source package: [libxml2]
Details (4)
- 2.9.14+dfsg-1.3~deb12u6 · amd64 · bookworm
  Fixed · Fixed: 2.9.10+dfsg-6.6
  dsa · libxml2 · debian · bookworm
- 2.9.14+dfsg-1.3~deb12u6 · arm64 · bookworm
  Fixed · Fixed: 2.9.10+dfsg-6.6
  dsa · libxml2 · debian · bookworm
- 2.9.14+dfsg-1.3~deb12u4 · amd64 · bookworm-security
  Fixed · Fixed: 2.9.10+dfsg-6.6
  dsa · libxml2 · debian · bookworm
- 2.9.14+dfsg-1.3~deb12u4 · arm64 · bookworm-security
  Fixed · Fixed: 2.9.10+dfsg-6.6
  dsa · libxml2 · debian · bookworm
[python3-libxml2]Unknown
Source package: [libxml2]
Details (4)
- 2.9.14+dfsg-1.3~deb12u6 · amd64 · bookworm
  Fixed · Fixed: 2.9.10+dfsg-6.6
  dsa · libxml2 · debian · bookworm
- 2.9.14+dfsg-1.3~deb12u6 · arm64 · bookworm
  Fixed · Fixed: 2.9.10+dfsg-6.6
  dsa · libxml2 · debian · bookworm
- 2.9.14+dfsg-1.3~deb12u4 · amd64 · bookworm-security
  Fixed · Fixed: 2.9.10+dfsg-6.6
  dsa · libxml2 · debian · bookworm
- 2.9.14+dfsg-1.3~deb12u4 · arm64 · bookworm-security
  Fixed · Fixed: 2.9.10+dfsg-6.6
  dsa · libxml2 · debian · bookworm

Observed: Oct 23, 2026, 5:58:27 PM UTC

References

[CERT-Bund public advisories] · [CISA cybersecurity advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]