CVE catalog

CVE-2021-3541

libxml2: CVE-2021-3541

[CVE catalog]

Severity
Medium · CVSS 6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
2.07% · Oct 25, 2026

A flaw was found in libxml2. Exponential entity expansion attack its possible bypassing all existing protection mechanisms and leading to denial of service.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlibxml2sid2.15.4+dfsg-1fixed
Debianlibxml2forky2.15.4+dfsg-1fixed
Debianlibxml2trixie2.12.7+dfsg+really2.9.14-2.1+deb13u3fixed
Debianlibxml2trixie-security2.12.7+dfsg+really2.9.14-2.1+deb13u1fixed
Debianlibxml2bookworm2.9.14+dfsg-1.3~deb12u6fixed
Debianlibxml2bookworm-security2.9.14+dfsg-1.3~deb12u4fixed
Cpelibxml2Not reported2.9.11fixed
Cpejboss_core_servicesNot reportedNot reportedunknown
Cpezfs_storage_appliance_kitNot reportedNot reportedunknown
Cpeactive_iq_unified_managerNot reportedNot reportedunknown
Cpecloud_backupNot reportedNot reportedunknown
Cpeclustered_data_ontapNot reportedNot reportedunknown
Cpeclustered_data_ontap_antivirus_connectorNot reportedNot reportedunknown
Cpemanageability_software_development_kitNot reportedNot reportedunknown
Cpeontap_select_deploy_administration_utilityNot reportedNot reportedunknown
Cpesmi-s_providerNot reportedNot reportedunknown
CpesnapdriveNot reportedNot reportedunknown
Cpeh410c_firmwareNot reportedNot reportedunknown
Cpeh300s_firmwareNot reportedNot reportedunknown
Cpeh500s_firmwareNot reportedNot reportedunknown
Cpeh700s_firmwareNot reportedNot reportedunknown
Cpeh300e_firmwareNot reportedNot reportedunknown
Cpeh500e_firmwareNot reportedNot reportedunknown
Cpeh700e_firmwareNot reportedNot reportedunknown
Cpeh410s_firmwareNot reportedNot reportedunknown
Alpinelibxml23.112.9.12-r0fixed
Alpinelibxml23.122.9.12-r0fixed
Alpinelibxml23.132.9.11-r0fixed
Alpinelibxml23.152.9.11-r0fixed
Alpinelibxml23.162.9.11-r0fixed
Alpinelibxml23.172.9.11-r0fixed
Alpinelibxml23.182.9.11-r0fixed
Alpinelibxml23.192.9.11-r0fixed
Alpinelibxml23.202.9.11-r0fixed
Alpinelibxml23.212.9.11-r0fixed
Alpinelibxml23.222.9.11-r0fixed
Alpinelibxml23.232.9.11-r0fixed
Alpinelibxml23.242.9.11-r0fixed
Ubuntulibxml220.042.9.4+dfsg1-7ubuntu3vulnerable
Ubuntulibxml220.042.9.4+dfsg1-7ubuntu5vulnerable
Ubuntulibxml220.042.9.4+dfsg1-8ubuntu1vulnerable
Ubuntulibxml220.042.9.4+dfsg1-8ubuntu2vulnerable
Ubuntulibxml220.042.9.4+dfsg1-8ubuntu3vulnerable
Ubuntulibxml220.042.9.10+dfsg-1ubuntu3vulnerable
Ubuntulibxml220.042.9.10+dfsg-4build1vulnerable
Ubuntulibxml220.042.9.10+dfsg-5vulnerable
Ubuntulibxml220.042.9.10+dfsg-5ubuntu0.20.04.1fixed
Suselibxml2linux enterprise high performance computing 15 sp1-ltss2.9.7-150000.3.57.1fixed
Susepython-libxml2-pythonlinux enterprise high performance computing 15 sp1-ltss2.9.7-150000.3.57.1fixed
Suselibxml2linux enterprise high performance computing 15 sp2-ltss2.9.7-150000.3.57.1fixed
Susepython-libxml2-pythonlinux enterprise high performance computing 15 sp2-ltss2.9.7-150000.3.57.1fixed
Suselibxml2linux enterprise high performance computing 15 sp3-espos2.9.7-150000.3.57.1fixed
Susepython-libxml2-pythonlinux enterprise high performance computing 15 sp3-espos2.9.7-150000.3.57.1fixed
Suselibxml2linux enterprise high performance computing 15 sp3-ltss2.9.7-150000.3.57.1fixed
Susepython-libxml2-pythonlinux enterprise high performance computing 15 sp3-ltss2.9.7-150000.3.57.1fixed
Suselibxml2linux enterprise real time 15 sp32.9.7-150000.3.57.1fixed
Susepython-libxml2-pythonlinux enterprise real time 15 sp32.9.7-150000.3.57.1fixed
Suselibxml2linux enterprise server 15 sp1-ltss2.9.7-150000.3.57.1fixed
Susepython-libxml2-pythonlinux enterprise server 15 sp1-ltss2.9.7-150000.3.57.1fixed
Suselibxml2linux enterprise server 15 sp2-ltss2.9.7-150000.3.57.1fixed
Susepython-libxml2-pythonlinux enterprise server 15 sp2-ltss2.9.7-150000.3.57.1fixed
Suselibxml2linux enterprise server 15 sp3-ltss2.9.7-150000.3.57.1fixed
Susepython-libxml2-pythonlinux enterprise server 15 sp3-ltss2.9.7-150000.3.57.1fixed
Suselibxml2linux enterprise server for sap applications 15 sp12.9.7-150000.3.57.1fixed
Susepython-libxml2-pythonlinux enterprise server for sap applications 15 sp12.9.7-150000.3.57.1fixed
Suselibxml2linux enterprise server for sap applications 15 sp22.9.7-150000.3.57.1fixed
Susepython-libxml2-pythonlinux enterprise server for sap applications 15 sp22.9.7-150000.3.57.1fixed
Suselibxml2linux enterprise server for sap applications 15 sp32.9.7-150000.3.57.1fixed
Susepython-libxml2-pythonlinux enterprise server for sap applications 15 sp32.9.7-150000.3.57.1fixed
Suselibxml2manager proxy 4.22.9.7-150000.3.57.1fixed
Susepython-libxml2-pythonmanager proxy 4.22.9.7-150000.3.57.1fixed
Suselibxml2manager server 4.22.9.7-150000.3.57.1fixed
Susepython-libxml2-pythonmanager server 4.22.9.7-150000.3.57.1fixed
Suselibxml2linux enterprise micro 5.12.9.7-150000.3.57.1fixed
Suselibxml2linux enterprise micro 5.22.9.7-150000.3.57.1fixed
Susepython-libxml2-pythonlinux enterprise micro 5.22.9.7-150000.3.57.1fixed
Suselibxml2enterprise storage 72.9.7-150000.3.57.1fixed
Susepython-libxml2-pythonenterprise storage 72.9.7-150000.3.57.1fixed
Suselibxml2enterprise storage 7.12.9.7-150000.3.57.1fixed
Susepython-libxml2-pythonenterprise storage 7.12.9.7-150000.3.57.1fixed
Opensusepython-libxml2-pythonleap 15.42.9.7-150000.3.57.1fixed
Suselibxml2linux enterprise module for basesystem 15 sp22.9.7-3.37.1fixed
Susepython-libxml2-pythonlinux enterprise module for basesystem 15 sp22.9.7-3.37.1fixed
Suselibxml2linux enterprise module for basesystem 15 sp32.9.7-3.37.1fixed
Susepython-libxml2-pythonlinux enterprise module for basesystem 15 sp32.9.7-3.37.1fixed
Susepython-libxml2-pythonlinux enterprise module for python 2 15 sp22.9.7-3.37.1fixed
Susepython-libxml2-pythonlinux enterprise module for python 2 15 sp32.9.7-3.37.1fixed
Suselibxml2linux enterprise micro 5.02.9.7-3.37.1fixed
Suselibxml2linux enterprise software development kit 12 sp52.9.4-46.46.1fixed
Suselibxml2linux enterprise server 12 sp52.9.4-46.46.1fixed
Susepython-libxml2linux enterprise server 12 sp52.9.4-46.46.1fixed
Suselibxml2linux enterprise server for sap applications 12 sp52.9.4-46.46.1fixed
Susepython-libxml2linux enterprise server for sap applications 12 sp52.9.4-46.46.1fixed
Opensuselibxml2leap 15.32.9.7-3.37.1fixed
Opensusepython-libxml2-pythonleap 15.32.9.7-3.37.1fixed
Opensuselibxml2leap 15.22.9.7-lp152.10.15.1fixed
Opensusepython-libxml2-pythonleap 15.22.9.7-lp152.10.15.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlibxml2sourcesid2.9.10+dfsg-6.7not yet assignedNot reported[988603]
Debianlibxml2sourceforky2.9.10+dfsg-6.7not yet assignedNot reported[988603]
Debianlibxml2sourcetrixie2.9.10+dfsg-6.7not yet assignedNot reported[988603]
Debianlibxml2sourcebookworm2.9.10+dfsg-6.7not yet assignedNot reported[988603]
Cpelibxml2cpeNot reported2.9.11Not reportedNVD-CVE-2021-3541Not reported
Alpinelibxml2apk3.112.9.12-r0Not reportedALPINE-CVE-2021-3541Not reported
Alpinelibxml2apk3.122.9.12-r0Not reportedALPINE-CVE-2021-3541Not reported
Alpinelibxml2apk3.132.9.11-r0Not reportedALPINE-CVE-2021-3541Not reported
Alpinelibxml2apk3.152.9.11-r0Not reportedALPINE-CVE-2021-3541Not reported
Alpinelibxml2apk3.162.9.11-r0Not reportedALPINE-CVE-2021-3541Not reported
Alpinelibxml2apk3.172.9.11-r0Not reportedALPINE-CVE-2021-3541Not reported
Alpinelibxml2apk3.182.9.11-r0Not reportedALPINE-CVE-2021-3541Not reported
Alpinelibxml2apk3.192.9.11-r0Not reportedALPINE-CVE-2021-3541Not reported
Alpinelibxml2apk3.202.9.11-r0Not reportedALPINE-CVE-2021-3541Not reported
Alpinelibxml2apk3.212.9.11-r0Not reportedALPINE-CVE-2021-3541Not reported
Alpinelibxml2apk3.222.9.11-r0Not reportedALPINE-CVE-2021-3541Not reported
Alpinelibxml2apk3.232.9.11-r0Not reportedALPINE-CVE-2021-3541Not reported
Alpinelibxml2apk3.242.9.11-r0Not reportedALPINE-CVE-2021-3541Not reported
Ubuntulibxml2deb20.042.9.10+dfsg-5ubuntu0.20.04.1Not reportedUBUNTU-CVE-2021-3541Not reported
Suselibxml2rpmlinux enterprise high performance computing 15 sp1-ltss2.9.7-150000.3.57.1Not reportedSUSE-SU-2023:2048-1Not reported
Susepython-libxml2-pythonrpmlinux enterprise high performance computing 15 sp1-ltss2.9.7-150000.3.57.1Not reportedSUSE-SU-2023:2048-1Not reported
Suselibxml2rpmlinux enterprise high performance computing 15 sp2-ltss2.9.7-150000.3.57.1Not reportedSUSE-SU-2023:2048-1Not reported
Susepython-libxml2-pythonrpmlinux enterprise high performance computing 15 sp2-ltss2.9.7-150000.3.57.1Not reportedSUSE-SU-2023:2048-1Not reported
Suselibxml2rpmlinux enterprise high performance computing 15 sp3-espos2.9.7-150000.3.57.1Not reportedSUSE-SU-2023:2048-1Not reported
Susepython-libxml2-pythonrpmlinux enterprise high performance computing 15 sp3-espos2.9.7-150000.3.57.1Not reportedSUSE-SU-2023:2048-1Not reported
Suselibxml2rpmlinux enterprise high performance computing 15 sp3-ltss2.9.7-150000.3.57.1Not reportedSUSE-SU-2023:2048-1Not reported
Susepython-libxml2-pythonrpmlinux enterprise high performance computing 15 sp3-ltss2.9.7-150000.3.57.1Not reportedSUSE-SU-2023:2048-1Not reported
Suselibxml2rpmlinux enterprise real time 15 sp32.9.7-150000.3.57.1Not reportedSUSE-SU-2023:2048-1Not reported
Susepython-libxml2-pythonrpmlinux enterprise real time 15 sp32.9.7-150000.3.57.1Not reportedSUSE-SU-2023:2048-1Not reported
Suselibxml2rpmlinux enterprise server 15 sp1-ltss2.9.7-150000.3.57.1Not reportedSUSE-SU-2023:2048-1Not reported
Susepython-libxml2-pythonrpmlinux enterprise server 15 sp1-ltss2.9.7-150000.3.57.1Not reportedSUSE-SU-2023:2048-1Not reported
Suselibxml2rpmlinux enterprise server 15 sp2-ltss2.9.7-150000.3.57.1Not reportedSUSE-SU-2023:2048-1Not reported
Susepython-libxml2-pythonrpmlinux enterprise server 15 sp2-ltss2.9.7-150000.3.57.1Not reportedSUSE-SU-2023:2048-1Not reported
Suselibxml2rpmlinux enterprise server 15 sp3-ltss2.9.7-150000.3.57.1Not reportedSUSE-SU-2023:2048-1Not reported
Susepython-libxml2-pythonrpmlinux enterprise server 15 sp3-ltss2.9.7-150000.3.57.1Not reportedSUSE-SU-2023:2048-1Not reported
Suselibxml2rpmlinux enterprise server for sap applications 15 sp12.9.7-150000.3.57.1Not reportedSUSE-SU-2023:2048-1Not reported
Susepython-libxml2-pythonrpmlinux enterprise server for sap applications 15 sp12.9.7-150000.3.57.1Not reportedSUSE-SU-2023:2048-1Not reported
Suselibxml2rpmlinux enterprise server for sap applications 15 sp22.9.7-150000.3.57.1Not reportedSUSE-SU-2023:2048-1Not reported
Susepython-libxml2-pythonrpmlinux enterprise server for sap applications 15 sp22.9.7-150000.3.57.1Not reportedSUSE-SU-2023:2048-1Not reported
Suselibxml2rpmlinux enterprise server for sap applications 15 sp32.9.7-150000.3.57.1Not reportedSUSE-SU-2023:2048-1Not reported
Susepython-libxml2-pythonrpmlinux enterprise server for sap applications 15 sp32.9.7-150000.3.57.1Not reportedSUSE-SU-2023:2048-1Not reported
Suselibxml2rpmmanager proxy 4.22.9.7-150000.3.57.1Not reportedSUSE-SU-2023:2048-1Not reported
Susepython-libxml2-pythonrpmmanager proxy 4.22.9.7-150000.3.57.1Not reportedSUSE-SU-2023:2048-1Not reported
Suselibxml2rpmmanager server 4.22.9.7-150000.3.57.1Not reportedSUSE-SU-2023:2048-1Not reported
Susepython-libxml2-pythonrpmmanager server 4.22.9.7-150000.3.57.1Not reportedSUSE-SU-2023:2048-1Not reported
Suselibxml2rpmlinux enterprise micro 5.12.9.7-150000.3.57.1Not reportedSUSE-SU-2023:2048-1Not reported
Suselibxml2rpmlinux enterprise micro 5.22.9.7-150000.3.57.1Not reportedSUSE-SU-2023:2048-1Not reported
Susepython-libxml2-pythonrpmlinux enterprise micro 5.22.9.7-150000.3.57.1Not reportedSUSE-SU-2023:2048-1Not reported
Suselibxml2rpmenterprise storage 72.9.7-150000.3.57.1Not reportedSUSE-SU-2023:2048-1Not reported
Susepython-libxml2-pythonrpmenterprise storage 72.9.7-150000.3.57.1Not reportedSUSE-SU-2023:2048-1Not reported
Suselibxml2rpmenterprise storage 7.12.9.7-150000.3.57.1Not reportedSUSE-SU-2023:2048-1Not reported
Susepython-libxml2-pythonrpmenterprise storage 7.12.9.7-150000.3.57.1Not reportedSUSE-SU-2023:2048-1Not reported
Opensusepython-libxml2-pythonrpmleap 15.42.9.7-150000.3.57.1Not reportedSUSE-SU-2023:2048-1Not reported
Suselibxml2rpmlinux enterprise module for basesystem 15 sp22.9.7-3.37.1Not reportedSUSE-SU-2021:1917-1Not reported
Susepython-libxml2-pythonrpmlinux enterprise module for basesystem 15 sp22.9.7-3.37.1Not reportedSUSE-SU-2021:1917-1Not reported
Suselibxml2rpmlinux enterprise module for basesystem 15 sp32.9.7-3.37.1Not reportedSUSE-SU-2021:1917-1Not reported
Susepython-libxml2-pythonrpmlinux enterprise module for basesystem 15 sp32.9.7-3.37.1Not reportedSUSE-SU-2021:1917-1Not reported
Susepython-libxml2-pythonrpmlinux enterprise module for python 2 15 sp22.9.7-3.37.1Not reportedSUSE-SU-2021:1917-1Not reported
Susepython-libxml2-pythonrpmlinux enterprise module for python 2 15 sp32.9.7-3.37.1Not reportedSUSE-SU-2021:1917-1Not reported
Suselibxml2rpmlinux enterprise micro 5.02.9.7-3.37.1Not reportedSUSE-SU-2021:1917-1Not reported
Suselibxml2rpmlinux enterprise software development kit 12 sp52.9.4-46.46.1Not reportedSUSE-SU-2021:2016-1Not reported
Suselibxml2rpmlinux enterprise server 12 sp52.9.4-46.46.1Not reportedSUSE-SU-2021:2016-1Not reported
Susepython-libxml2rpmlinux enterprise server 12 sp52.9.4-46.46.1Not reportedSUSE-SU-2021:2016-1Not reported
Suselibxml2rpmlinux enterprise server for sap applications 12 sp52.9.4-46.46.1Not reportedSUSE-SU-2021:2016-1Not reported
Susepython-libxml2rpmlinux enterprise server for sap applications 12 sp52.9.4-46.46.1Not reportedSUSE-SU-2021:2016-1Not reported
Opensuselibxml2rpmleap 15.32.9.7-3.37.1Not reportedOPENSUSE-SU-2021:1917-1Not reported
Opensusepython-libxml2-pythonrpmleap 15.32.9.7-3.37.1Not reportedOPENSUSE-SU-2021:1917-1Not reported
Opensuselibxml2rpmleap 15.22.9.7-lp152.10.15.1Not reportedOPENSUSE-SU-2021:0886-1Not reported
Opensusepython-libxml2-pythonrpmleap 15.22.9.7-lp152.10.15.1Not reportedOPENSUSE-SU-2021:0886-1Not reported

[Debian bug #988603]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [libxml2]Unknown
    Details (4)
    • 2.9.14+dfsg-1.3~deb12u6 · amd64 · bookworm

      Fixed · Fixed: 2.9.10+dfsg-6.7

      dsa · libxml2 · debian · bookworm

    • 2.9.14+dfsg-1.3~deb12u6 · arm64 · bookworm

      Fixed · Fixed: 2.9.10+dfsg-6.7

      dsa · libxml2 · debian · bookworm

    • 2.9.14+dfsg-1.3~deb12u4 · amd64 · bookworm-security

      Fixed · Fixed: 2.9.10+dfsg-6.7

      dsa · libxml2 · debian · bookworm

    • 2.9.14+dfsg-1.3~deb12u4 · arm64 · bookworm-security

      Fixed · Fixed: 2.9.10+dfsg-6.7

      dsa · libxml2 · debian · bookworm

  • [libxml2-dev]Unknown

    Source package: [libxml2]

    Details (4)
    • 2.9.14+dfsg-1.3~deb12u6 · amd64 · bookworm

      Fixed · Fixed: 2.9.10+dfsg-6.7

      dsa · libxml2 · debian · bookworm

    • 2.9.14+dfsg-1.3~deb12u6 · arm64 · bookworm

      Fixed · Fixed: 2.9.10+dfsg-6.7

      dsa · libxml2 · debian · bookworm

    • 2.9.14+dfsg-1.3~deb12u4 · amd64 · bookworm-security

      Fixed · Fixed: 2.9.10+dfsg-6.7

      dsa · libxml2 · debian · bookworm

    • 2.9.14+dfsg-1.3~deb12u4 · arm64 · bookworm-security

      Fixed · Fixed: 2.9.10+dfsg-6.7

      dsa · libxml2 · debian · bookworm

  • [libxml2-doc]Unknown

    Source package: [libxml2]

    Details (4)
    • 2.9.14+dfsg-1.3~deb12u6 · all · bookworm

      Fixed · Fixed: 2.9.10+dfsg-6.7

      dsa · libxml2 · debian · bookworm

    • 2.9.14+dfsg-1.3~deb12u6 · all · bookworm

      Fixed · Fixed: 2.9.10+dfsg-6.7

      dsa · libxml2 · debian · bookworm

    • 2.9.14+dfsg-1.3~deb12u4 · all · bookworm-security

      Fixed · Fixed: 2.9.10+dfsg-6.7

      dsa · libxml2 · debian · bookworm

    • 2.9.14+dfsg-1.3~deb12u4 · all · bookworm-security

      Fixed · Fixed: 2.9.10+dfsg-6.7

      dsa · libxml2 · debian · bookworm

  • [libxml2-utils]Unknown

    Source package: [libxml2]

    Details (4)
    • 2.9.14+dfsg-1.3~deb12u6 · amd64 · bookworm

      Fixed · Fixed: 2.9.10+dfsg-6.7

      dsa · libxml2 · debian · bookworm

    • 2.9.14+dfsg-1.3~deb12u6 · arm64 · bookworm

      Fixed · Fixed: 2.9.10+dfsg-6.7

      dsa · libxml2 · debian · bookworm

    • 2.9.14+dfsg-1.3~deb12u4 · amd64 · bookworm-security

      Fixed · Fixed: 2.9.10+dfsg-6.7

      dsa · libxml2 · debian · bookworm

    • 2.9.14+dfsg-1.3~deb12u4 · arm64 · bookworm-security

      Fixed · Fixed: 2.9.10+dfsg-6.7

      dsa · libxml2 · debian · bookworm

  • Source package: [libxml2]

    Details (4)
    • 2.9.14+dfsg-1.3~deb12u6 · amd64 · bookworm

      Fixed · Fixed: 2.9.10+dfsg-6.7

      dsa · libxml2 · debian · bookworm

    • 2.9.14+dfsg-1.3~deb12u6 · arm64 · bookworm

      Fixed · Fixed: 2.9.10+dfsg-6.7

      dsa · libxml2 · debian · bookworm

    • 2.9.14+dfsg-1.3~deb12u4 · amd64 · bookworm-security

      Fixed · Fixed: 2.9.10+dfsg-6.7

      dsa · libxml2 · debian · bookworm

    • 2.9.14+dfsg-1.3~deb12u4 · arm64 · bookworm-security

      Fixed · Fixed: 2.9.10+dfsg-6.7

      dsa · libxml2 · debian · bookworm

Observed:

References