CVE catalog

CVE-2022-2309

libxml2 affected and fixed versions

[CVE catalog]

NULL Pointer Dereference allows attackers to cause a denial of service (or application crash). This only applies when lxml is used together with libxml2 2.9.10 through 2.9.14. libxml2 2.9.9 and earlier are not affected. It allows triggering crashes through forged input data, given a vulnerable code sequence in the application. The vulnerability is caused by the iterwalk function (also used by the canonicalize function). Such code shouldn't be in wide-spread use, given that parsing + iterwalk would usually be replaced with the more efficient iterparse function. However, an XML converter that serialises to C14N would also be vulnerable, for example, and there are legitimate use cases for this code sequence. If untrusted input is received (also remotely) and processed via iterwalk function, a crash can be triggered.

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
2.45% · Oct 27, 2026

Projects and upstream resources

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / releasePackageVersionStatusSource
Debiantrixie-securitylibxml22.12.7+dfsg+really2.9.14-2.1+deb13u1Fixed[CVE-2022-2309]
Debiantrixielibxml22.12.7+dfsg+really2.9.14-2.1+deb13u3Fixed[CVE-2022-2309]
Debiantrixielibxml22.9.14+dfsg-1.3FixedDistribution-reported fixed boundary[CVE-2022-2309]
Debiantrixielxml4.9.1-1FixedDistribution-reported fixed boundary[CVE-2022-2309]
Debiantrixielxml5.4.0-1Fixed[CVE-2022-2309]
Debiansidlibxml22.15.4+dfsg-1Fixed[CVE-2022-2309]
Debiansidlibxml22.9.14+dfsg-1.3FixedDistribution-reported fixed boundary[CVE-2022-2309]
Debiansidlxml4.9.1-1FixedDistribution-reported fixed boundary[CVE-2022-2309]
Debiansidlxml6.1.3-1.1Fixed[CVE-2022-2309]
Debianforkylibxml22.15.4+dfsg-1Fixed[CVE-2022-2309]
Debianforkylibxml22.9.14+dfsg-1.3FixedDistribution-reported fixed boundary[CVE-2022-2309]
Debianforkylxml4.9.1-1FixedDistribution-reported fixed boundary[CVE-2022-2309]

Showing 12 fix observations. All 85 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence
Distribution / releasePackageVersionStatusSource
UnknownRelease not reportedlibxml22.9.14+dfsg-1.3~deb12u1UnknownSource applicability is not establishedProvider not reported
Debianbookwormlibxml22.9.14+dfsg-1.3~deb12u1FixedDistribution-reported fixed boundary[CVE-2022-2309]
Debianbookwormlibxml22.9.14+dfsg-1.3~deb12u6Fixed[CVE-2022-2309]
Debianbookwormlxml4.9.1-1FixedDistribution-reported fixed boundary[CVE-2022-2309]
Debianbookwormlxml4.9.2-1Fixed[CVE-2022-2309]
Debianbookworm-securitylibxml22.9.14+dfsg-1.3~deb12u4Fixed[CVE-2022-2309]
Debianbookworm-securitylxml4.9.2-1+deb12u1Fixed[CVE-2022-2309]
Debianforkylibxml22.15.4+dfsg-1Fixed[CVE-2022-2309]
Debianforkylibxml22.9.14+dfsg-1.3FixedDistribution-reported fixed boundary[CVE-2022-2309]
Debianforkylxml4.9.1-1FixedDistribution-reported fixed boundary[CVE-2022-2309]
Debianforkylxml6.1.3-1Fixed[CVE-2022-2309]
Debiansidlibxml22.15.4+dfsg-1Fixed[CVE-2022-2309]
Debiansidlibxml22.9.14+dfsg-1.3FixedDistribution-reported fixed boundary[CVE-2022-2309]
Debiansidlxml4.9.1-1FixedDistribution-reported fixed boundary[CVE-2022-2309]
Debiansidlxml6.1.3-1.1Fixed[CVE-2022-2309]
Debiantrixielibxml22.12.7+dfsg+really2.9.14-2.1+deb13u3Fixed[CVE-2022-2309]
Debiantrixielibxml22.9.14+dfsg-1.3FixedDistribution-reported fixed boundary[CVE-2022-2309]
Debiantrixielxml4.9.1-1FixedDistribution-reported fixed boundary[CVE-2022-2309]
Debiantrixielxml5.4.0-1Fixed[CVE-2022-2309]
Debiantrixie-securitylibxml22.12.7+dfsg+really2.9.14-2.1+deb13u1Fixed[CVE-2022-2309]
Opensuseleap 15.3python-lxml4.7.1-150200.3.10.1UnknownSource applicability is not established[SUSE-SU-2022:2908-1]
Opensuseleap 15.4python-lxml4.7.1-150200.3.10.1UnknownSource applicability is not established[SUSE-SU-2022:2908-1]
Opensusetumbleweedlibxml22.10.1-1.1UnknownSource applicability is not established[OPENSUSE-SU-2024:12290-1]
Suseenterprise storage 7python-lxml4.7.1-150200.3.10.1UnknownSource applicability is not established[SUSE-SU-2022:2908-1]
Suselinux enterprise high performance computing 15 sp2-espospython-lxml4.7.1-150200.3.10.1UnknownSource applicability is not established[SUSE-SU-2022:2908-1]
Suselinux enterprise high performance computing 15 sp2-ltsspython-lxml4.7.1-150200.3.10.1UnknownSource applicability is not established[SUSE-SU-2022:2908-1]
Suselinux enterprise module for basesystem 15 sp3python-lxml4.7.1-150200.3.10.1UnknownSource applicability is not established[SUSE-SU-2022:2908-1]
Suselinux enterprise module for basesystem 15 sp4python-lxml4.7.1-150200.3.10.1UnknownSource applicability is not established[SUSE-SU-2022:2908-1]
Suselinux enterprise module for public cloud 15python-lxml4.7.1-150100.6.6.1UnknownSource applicability is not established[SUSE-SU-2022:2878-1]
Suselinux enterprise module for python 2 15 sp3python-lxml4.7.1-150200.3.10.1UnknownSource applicability is not established[SUSE-SU-2022:2908-1]
Suselinux enterprise server 15 sp2-bclpython-lxml4.7.1-150200.3.10.1UnknownSource applicability is not established[SUSE-SU-2022:2908-1]
Suselinux enterprise server 15 sp2-ltsspython-lxml4.7.1-150200.3.10.1UnknownSource applicability is not established[SUSE-SU-2022:2908-1]
Suselinux enterprise server for sap applications 15 sp2python-lxml4.7.1-150200.3.10.1UnknownSource applicability is not established[SUSE-SU-2022:2908-1]
Susemanager proxy 4.1python-lxml4.7.1-150200.3.10.1UnknownSource applicability is not established[SUSE-SU-2022:2908-1]
Susemanager retail branch server 4.1python-lxml4.7.1-150200.3.10.1UnknownSource applicability is not established[SUSE-SU-2022:2908-1]
Susemanager server 4.1python-lxml4.7.1-150200.3.10.1UnknownSource applicability is not established[SUSE-SU-2022:2908-1]
Ubuntu18.04libxml22.9.4+dfsg1-4ubuntu1UnknownSource applicability is not established[USN-5760-1]
Ubuntu18.04libxml22.9.4+dfsg1-5.1ubuntu1UnknownSource applicability is not established[USN-5760-1]
Ubuntu18.04libxml22.9.4+dfsg1-5.2ubuntu1UnknownSource applicability is not established[USN-5760-1]
Ubuntu18.04libxml22.9.4+dfsg1-5ubuntu1UnknownSource applicability is not established[USN-5760-1]
Ubuntu18.04libxml22.9.4+dfsg1-5ubuntu2UnknownSource applicability is not established[USN-5760-1]
Ubuntu18.04libxml22.9.4+dfsg1-6.1ubuntu1UnknownSource applicability is not established[USN-5760-1]
Ubuntu18.04libxml22.9.4+dfsg1-6.1ubuntu1.2UnknownSource applicability is not established[USN-5760-1]
Ubuntu18.04libxml22.9.4+dfsg1-6.1ubuntu1.3UnknownSource applicability is not established[USN-5760-1]
Ubuntu18.04libxml22.9.4+dfsg1-6.1ubuntu1.4UnknownSource applicability is not established[USN-5760-1]
Ubuntu18.04libxml22.9.4+dfsg1-6.1ubuntu1.5UnknownSource applicability is not established[USN-5760-1]
Ubuntu18.04libxml22.9.4+dfsg1-6.1ubuntu1.6UnknownSource applicability is not established[USN-5760-1]
Ubuntu18.04libxml22.9.4+dfsg1-6.1ubuntu1.7UnknownSource applicability is not established[USN-5760-1]
Ubuntu18.04libxml22.9.4+dfsg1-6.1ubuntu1.8UnknownSource applicability is not established[USN-5760-1]
Ubuntu20.04libxml22.9.10+dfsg-1ubuntu3UnknownSource applicability is not established[UBUNTU-CVE-2022-2309][USN-5760-1]
Ubuntu20.04libxml22.9.10+dfsg-4build1UnknownSource applicability is not established[UBUNTU-CVE-2022-2309][USN-5760-1]
Ubuntu20.04libxml22.9.10+dfsg-5UnknownSource applicability is not established[UBUNTU-CVE-2022-2309][USN-5760-1]
Ubuntu20.04libxml22.9.10+dfsg-5ubuntu0.20.04.1UnknownSource applicability is not established[UBUNTU-CVE-2022-2309][USN-5760-1]
Ubuntu20.04libxml22.9.10+dfsg-5ubuntu0.20.04.2UnknownSource applicability is not established[UBUNTU-CVE-2022-2309][USN-5760-1]
Ubuntu20.04libxml22.9.10+dfsg-5ubuntu0.20.04.3UnknownSource applicability is not established[UBUNTU-CVE-2022-2309][USN-5760-1]
Ubuntu20.04libxml22.9.10+dfsg-5ubuntu0.20.04.4UnknownSource applicability is not established[UBUNTU-CVE-2022-2309][USN-5760-1]
Ubuntu20.04libxml22.9.10+dfsg-5ubuntu0.20.04.5UnknownSource applicability is not established[UBUNTU-CVE-2022-2309][USN-5760-1]
Ubuntu20.04libxml22.9.4+dfsg1-7ubuntu3UnknownSource applicability is not established[UBUNTU-CVE-2022-2309][USN-5760-1]
Ubuntu20.04libxml22.9.4+dfsg1-7ubuntu5UnknownSource applicability is not established[UBUNTU-CVE-2022-2309][USN-5760-1]
Ubuntu20.04libxml22.9.4+dfsg1-8ubuntu1UnknownSource applicability is not established[UBUNTU-CVE-2022-2309][USN-5760-1]
Ubuntu20.04libxml22.9.4+dfsg1-8ubuntu2UnknownSource applicability is not established[UBUNTU-CVE-2022-2309][USN-5760-1]
Ubuntu20.04libxml22.9.4+dfsg1-8ubuntu3UnknownSource applicability is not established[UBUNTU-CVE-2022-2309][USN-5760-1]
Ubuntu22.04libxml22.9.12+dfsg-4UnknownSource applicability is not established[UBUNTU-CVE-2022-2309][USN-5760-1]
Ubuntu22.04libxml22.9.12+dfsg-5UnknownSource applicability is not established[UBUNTU-CVE-2022-2309][USN-5760-1]
Ubuntu22.04libxml22.9.12+dfsg-6UnknownSource applicability is not established[UBUNTU-CVE-2022-2309][USN-5760-1]
Ubuntu22.04libxml22.9.13+dfsg-1UnknownSource applicability is not established[UBUNTU-CVE-2022-2309][USN-5760-1]
Ubuntu22.04libxml22.9.13+dfsg-1build1UnknownSource applicability is not established[UBUNTU-CVE-2022-2309][USN-5760-1]
Ubuntu22.04libxml22.9.13+dfsg-1ubuntu0.1UnknownSource applicability is not established[UBUNTU-CVE-2022-2309][USN-5760-1]
Ubuntu22.04libxml22.9.13+dfsg-1ubuntu0.2UnknownSource applicability is not established[UBUNTU-CVE-2022-2309][USN-5760-1]
Ubuntu22.04lxml4.6.3+dfsg-0.1UnknownSource applicability is not established[UBUNTU-CVE-2022-2309]
Ubuntu22.04lxml4.6.4-1UnknownSource applicability is not established[UBUNTU-CVE-2022-2309]
Ubuntu22.04lxml4.6.4-1ubuntu1UnknownSource applicability is not established[UBUNTU-CVE-2022-2309]
Ubuntu22.04lxml4.7.1-1UnknownSource applicability is not established[UBUNTU-CVE-2022-2309]
Ubuntu22.04lxml4.8.0-1UnknownSource applicability is not established[UBUNTU-CVE-2022-2309]
Ubuntu22.04lxml4.8.0-1build1UnknownSource applicability is not established[UBUNTU-CVE-2022-2309]
Ubuntu22.04lxml4.8.0-1ubuntu0.1UnknownSource applicability is not established[UBUNTU-CVE-2022-2309]
Ubuntuprolxml4.4.1-1UnknownSource applicability is not established[UBUNTU-CVE-2022-2309]
Ubuntuprolxml4.4.1-1build1UnknownSource applicability is not established[UBUNTU-CVE-2022-2309]
Ubuntuprolxml4.4.2-1UnknownSource applicability is not established[UBUNTU-CVE-2022-2309]
Ubuntuprolxml4.5.0-1UnknownSource applicability is not established[UBUNTU-CVE-2022-2309]
Ubuntuprolxml4.5.0-1ubuntu0.1UnknownSource applicability is not established[UBUNTU-CVE-2022-2309]
Ubuntuprolxml4.5.0-1ubuntu0.2UnknownSource applicability is not established[UBUNTU-CVE-2022-2309]
Ubuntuprolxml4.5.0-1ubuntu0.3UnknownSource applicability is not established[UBUNTU-CVE-2022-2309]
Ubuntuprolxml4.5.0-1ubuntu0.5UnknownSource applicability is not established[UBUNTU-CVE-2022-2309]
Ubuntuprolxml4.5.0-1ubuntu0.5+esm1UnknownSource applicability is not established[UBUNTU-CVE-2022-2309]
Original provider fields
{
  "package_releases": [
    {
      "name": "lxml",
      "status": "fixed",
      "release": "sid",
      "version": "6.1.3-1.1"
    },
    {
      "name": "lxml",
      "status": "fixed",
      "release": "forky",
      "version": "6.1.3-1"
    },
    {
      "name": "lxml",
      "status": "fixed",
      "release": "trixie",
      "version": "5.4.0-1"
    },
    {
      "name": "lxml",
      "status": "fixed",
      "release": "bookworm",
      "version": "4.9.2-1"
    },
    {
      "name": "lxml",
      "status": "fixed",
      "release": "bookworm-security",
      "version": "4.9.2-1+deb12u1"
    },
    {
      "name": "libxml2",
      "status": "fixed",
      "release": "sid",
      "version": "2.15.4+dfsg-1"
    },
    {
      "name": "libxml2",
      "status": "fixed",
      "release": "forky",
      "version": "2.15.4+dfsg-1"
    },
    {
      "name": "libxml2",
      "status": "fixed",
      "release": "trixie",
      "version": "2.12.7+dfsg+really2.9.14-2.1+deb13u3"
    },
    {
      "name": "libxml2",
      "status": "fixed",
      "release": "trixie-security",
      "version": "2.12.7+dfsg+really2.9.14-2.1+deb13u1"
    },
    {
      "name": "libxml2",
      "status": "fixed",
      "release": "bookworm",
      "version": "2.9.14+dfsg-1.3~deb12u6"
    },
    {
      "name": "libxml2",
      "status": "fixed",
      "release": "bookworm-security",
      "version": "2.9.14+dfsg-1.3~deb12u4"
    }
  ],
  "fixed_versions": [
    {
      "bug": 1014766,
      "name": "lxml",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": "4.9.1-1"
    },
    {
      "bug": 1014766,
      "name": "lxml",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": "4.9.1-1"
    },
    {
      "bug": 1014766,
      "name": "lxml",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": "4.9.1-1"
    },
    {
      "bug": 1014766,
      "name": "lxml",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": "4.9.1-1"
    },
    {
      "bug": 1039991,
      "name": "libxml2",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": "2.9.14+dfsg-1.3"
    },
    {
      "bug": 1039991,
      "name": "libxml2",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": "2.9.14+dfsg-1.3"
    },
    {
      "bug": 1039991,
      "name": "libxml2",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": "2.9.14+dfsg-1.3"
    },
    {
      "bug": 1039991,
      "name": "libxml2",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": "2.9.14+dfsg-1.3~deb12u1"
    }
  ],
  "distribution_packages": [
    {
      "name": "libxml2",
      "fixed_version": "2.9.14+dfsg-1.3~deb12u1",
      "applicability_unknown": true
    },
    {
      "name": "lxml",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "pro",
      "versions": [
        "4.4.1-1",
        "4.4.1-1build1",
        "4.4.2-1",
        "4.5.0-1",
        "4.5.0-1ubuntu0.1",
        "4.5.0-1ubuntu0.2",
        "4.5.0-1ubuntu0.3",
        "4.5.0-1ubuntu0.5",
        "4.5.0-1ubuntu0.5+esm1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2022-2309",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2022-2309",
      "provider_updated_at": "2026-10-08T12:50:14.335895552Z",
      "applicability_unknown": true
    },
    {
      "name": "libxml2",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.9.10+dfsg-5ubuntu0.20.04.5"
            }
          ]
        }
      ],
      "release": "20.04",
      "versions": [
        "2.9.4+dfsg1-7ubuntu3",
        "2.9.4+dfsg1-7ubuntu5",
        "2.9.4+dfsg1-8ubuntu1",
        "2.9.4+dfsg1-8ubuntu2",
        "2.9.4+dfsg1-8ubuntu3",
        "2.9.10+dfsg-1ubuntu3",
        "2.9.10+dfsg-4build1",
        "2.9.10+dfsg-5",
        "2.9.10+dfsg-5ubuntu0.20.04.1",
        "2.9.10+dfsg-5ubuntu0.20.04.2",
        "2.9.10+dfsg-5ubuntu0.20.04.3",
        "2.9.10+dfsg-5ubuntu0.20.04.4"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2022-2309",
      "fixed_version": "2.9.10+dfsg-5ubuntu0.20.04.5",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2022-2309",
      "provider_updated_at": "2026-10-08T12:50:14.335895552Z",
      "applicability_unknown": true
    },
    {
      "name": "libxml2",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.9.13+dfsg-1ubuntu0.2"
            }
          ]
        }
      ],
      "release": "22.04",
      "versions": [
        "2.9.12+dfsg-4",
        "2.9.12+dfsg-5",
        "2.9.12+dfsg-6",
        "2.9.13+dfsg-1",
        "2.9.13+dfsg-1build1",
        "2.9.13+dfsg-1ubuntu0.1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2022-2309",
      "fixed_version": "2.9.13+dfsg-1ubuntu0.2",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2022-2309",
      "provider_updated_at": "2026-10-08T12:50:14.335895552Z",
      "applicability_unknown": true
    },
    {
      "name": "lxml",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "22.04",
      "versions": [
        "4.6.3+dfsg-0.1",
        "4.6.4-1",
        "4.6.4-1ubuntu1",
        "4.7.1-1",
        "4.8.0-1",
        "4.8.0-1build1",
        "4.8.0-1ubuntu0.1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2022-2309",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2022-2309",
      "provider_updated_at": "2026-10-08T12:50:14.335895552Z",
      "applicability_unknown": true
    },
    {
      "name": "libxml2",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.9.4+dfsg1-6.1ubuntu1.8"
            }
          ]
        }
      ],
      "release": "18.04",
      "versions": [
        "2.9.4+dfsg1-4ubuntu1",
        "2.9.4+dfsg1-5ubuntu1",
        "2.9.4+dfsg1-5ubuntu2",
        "2.9.4+dfsg1-5.1ubuntu1",
        "2.9.4+dfsg1-5.2ubuntu1",
        "2.9.4+dfsg1-6.1ubuntu1",
        "2.9.4+dfsg1-6.1ubuntu1.2",
        "2.9.4+dfsg1-6.1ubuntu1.3",
        "2.9.4+dfsg1-6.1ubuntu1.4",
        "2.9.4+dfsg1-6.1ubuntu1.5",
        "2.9.4+dfsg1-6.1ubuntu1.6",
        "2.9.4+dfsg1-6.1ubuntu1.7"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/USN-5760-1",
      "fixed_version": "2.9.4+dfsg1-6.1ubuntu1.8",
      "provider_source": "pypi",
      "provider_record_id": "USN-5760-1",
      "provider_updated_at": "2026-04-27T16:32:22.438675926Z",
      "applicability_unknown": true
    },
    {
      "name": "libxml2",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.9.10+dfsg-5ubuntu0.20.04.5"
            }
          ]
        }
      ],
      "release": "20.04",
      "versions": [
        "2.9.4+dfsg1-7ubuntu3",
        "2.9.4+dfsg1-7ubuntu5",
        "2.9.4+dfsg1-8ubuntu1",
        "2.9.4+dfsg1-8ubuntu2",
        "2.9.4+dfsg1-8ubuntu3",
        "2.9.10+dfsg-1ubuntu3",
        "2.9.10+dfsg-4build1",
        "2.9.10+dfsg-5",
        "2.9.10+dfsg-5ubuntu0.20.04.1",
        "2.9.10+dfsg-5ubuntu0.20.04.2",
        "2.9.10+dfsg-5ubuntu0.20.04.3",
        "2.9.10+dfsg-5ubuntu0.20.04.4"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/USN-5760-1",
      "fixed_version": "2.9.10+dfsg-5ubuntu0.20.04.5",
      "provider_source": "pypi",
      "provider_record_id": "USN-5760-1",
      "provider_updated_at": "2026-04-27T16:32:22.438675926Z",
      "applicability_unknown": true
    },
    {
      "name": "libxml2",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.9.13+dfsg-1ubuntu0.2"
            }
          ]
        }
      ],
      "release": "22.04",
      "versions": [
        "2.9.12+dfsg-4",
        "2.9.12+dfsg-5",
        "2.9.12+dfsg-6",
        "2.9.13+dfsg-1",
        "2.9.13+dfsg-1build1",
        "2.9.13+dfsg-1ubuntu0.1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/USN-5760-1",
      "fixed_version": "2.9.13+dfsg-1ubuntu0.2",
      "provider_source": "pypi",
      "provider_record_id": "USN-5760-1",
      "provider_updated_at": "2026-04-27T16:32:22.438675926Z",
      "applicability_unknown": true
    },
    {
      "name": "libxml2",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.10.1-1.1"
            }
          ]
        }
      ],
      "release": "tumbleweed",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/openSUSE-SU-2024:12290-1",
      "fixed_version": "2.10.1-1.1",
      "provider_source": "pypi",
      "provider_record_id": "OPENSUSE-SU-2024:12290-1",
      "provider_updated_at": "2026-02-04T03:14:29.989567Z",
      "applicability_unknown": true
    },
    {
      "name": "python-lxml",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.7.1-150200.3.10.1"
            }
          ]
        }
      ],
      "release": "linux enterprise module for basesystem 15 sp3",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2022:2908-1",
      "fixed_version": "4.7.1-150200.3.10.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2022:2908-1",
      "provider_updated_at": "2026-02-04T03:06:08.152964Z",
      "applicability_unknown": true
    },
    {
      "name": "python-lxml",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.7.1-150200.3.10.1"
            }
          ]
        }
      ],
      "release": "linux enterprise module for basesystem 15 sp4",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2022:2908-1",
      "fixed_version": "4.7.1-150200.3.10.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2022:2908-1",
      "provider_updated_at": "2026-02-04T03:06:08.152964Z",
      "applicability_unknown": true
    },
    {
      "name": "python-lxml",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.7.1-150200.3.10.1"
            }
          ]
        }
      ],
      "release": "linux enterprise module for python 2 15 sp3",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2022:2908-1",
      "fixed_version": "4.7.1-150200.3.10.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2022:2908-1",
      "provider_updated_at": "2026-02-04T03:06:08.152964Z",
      "applicability_unknown": true
    },
    {
      "name": "python-lxml",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.7.1-150200.3.10.1"
            }
          ]
        }
      ],
      "release": "linux enterprise high performance computing 15 sp2-espos",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2022:2908-1",
      "fixed_version": "4.7.1-150200.3.10.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2022:2908-1",
      "provider_updated_at": "2026-02-04T03:06:08.152964Z",
      "applicability_unknown": true
    },
    {
      "name": "python-lxml",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.7.1-150200.3.10.1"
            }
          ]
        }
      ],
      "release": "linux enterprise high performance computing 15 sp2-ltss",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2022:2908-1",
      "fixed_version": "4.7.1-150200.3.10.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2022:2908-1",
      "provider_updated_at": "2026-02-04T03:06:08.152964Z",
      "applicability_unknown": true
    },
    {
      "name": "python-lxml",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.7.1-150200.3.10.1"
            }
          ]
        }
      ],
      "release": "linux enterprise server 15 sp2-bcl",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2022:2908-1",
      "fixed_version": "4.7.1-150200.3.10.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2022:2908-1",
      "provider_updated_at": "2026-02-04T03:06:08.152964Z",
      "applicability_unknown": true
    },
    {
      "name": "python-lxml",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.7.1-150200.3.10.1"
            }
          ]
        }
      ],
      "release": "linux enterprise server 15 sp2-ltss",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2022:2908-1",
      "fixed_version": "4.7.1-150200.3.10.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2022:2908-1",
      "provider_updated_at": "2026-02-04T03:06:08.152964Z",
      "applicability_unknown": true
    },
    {
      "name": "python-lxml",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.7.1-150200.3.10.1"
            }
          ]
        }
      ],
      "release": "linux enterprise server for sap applications 15 sp2",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2022:2908-1",
      "fixed_version": "4.7.1-150200.3.10.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2022:2908-1",
      "provider_updated_at": "2026-02-04T03:06:08.152964Z",
      "applicability_unknown": true
    },
    {
      "name": "python-lxml",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.7.1-150200.3.10.1"
            }
          ]
        }
      ],
      "release": "manager proxy 4.1",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2022:2908-1",
      "fixed_version": "4.7.1-150200.3.10.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2022:2908-1",
      "provider_updated_at": "2026-02-04T03:06:08.152964Z",
      "applicability_unknown": true
    },
    {
      "name": "python-lxml",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.7.1-150200.3.10.1"
            }
          ]
        }
      ],
      "release": "manager retail branch server 4.1",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2022:2908-1",
      "fixed_version": "4.7.1-150200.3.10.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2022:2908-1",
      "provider_updated_at": "2026-02-04T03:06:08.152964Z",
      "applicability_unknown": true
    },
    {
      "name": "python-lxml",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.7.1-150200.3.10.1"
            }
          ]
        }
      ],
      "release": "manager server 4.1",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2022:2908-1",
      "fixed_version": "4.7.1-150200.3.10.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2022:2908-1",
      "provider_updated_at": "2026-02-04T03:06:08.152964Z",
      "applicability_unknown": true
    },
    {
      "name": "python-lxml",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.7.1-150200.3.10.1"
            }
          ]
        }
      ],
      "release": "enterprise storage 7",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2022:2908-1",
      "fixed_version": "4.7.1-150200.3.10.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2022:2908-1",
      "provider_updated_at": "2026-02-04T03:06:08.152964Z",
      "applicability_unknown": true
    },
    {
      "name": "python-lxml",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.7.1-150200.3.10.1"
            }
          ]
        }
      ],
      "release": "leap 15.3",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2022:2908-1",
      "fixed_version": "4.7.1-150200.3.10.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2022:2908-1",
      "provider_updated_at": "2026-02-04T03:06:08.152964Z",
      "applicability_unknown": true
    },
    {
      "name": "python-lxml",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.7.1-150200.3.10.1"
            }
          ]
        }
      ],
      "release": "leap 15.4",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2022:2908-1",
      "fixed_version": "4.7.1-150200.3.10.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2022:2908-1",
      "provider_updated_at": "2026-02-04T03:06:08.152964Z",
      "applicability_unknown": true
    },
    {
      "name": "python-lxml",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.7.1-150100.6.6.1"
            }
          ]
        }
      ],
      "release": "linux enterprise module for public cloud 15",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2022:2878-1",
      "fixed_version": "4.7.1-150100.6.6.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2022:2878-1",
      "provider_updated_at": "2026-02-04T03:00:25.007663Z",
      "applicability_unknown": true
    }
  ]
}

[Debian bug #1014766][Debian bug #1039991]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [libxml2]Unknown
    Details (4)

    • 2.9.14+dfsg-1.3~deb12u6 · amd64 · bookworm

      Fixed · Fixed: 2.9.14+dfsg-1.3~deb12u1

      dsa · libxml2 · debian · bookworm

    • 2.9.14+dfsg-1.3~deb12u6 · arm64 · bookworm

      Fixed · Fixed: 2.9.14+dfsg-1.3~deb12u1

      dsa · libxml2 · debian · bookworm

    • 2.9.14+dfsg-1.3~deb12u4 · amd64 · bookworm-security

      Fixed · Fixed: 2.9.14+dfsg-1.3~deb12u1

      dsa · libxml2 · debian · bookworm

    • 2.9.14+dfsg-1.3~deb12u4 · arm64 · bookworm-security

      Fixed · Fixed: 2.9.14+dfsg-1.3~deb12u1

      dsa · libxml2 · debian · bookworm

  • [libxml2-dev]Unknown

    Source package: [libxml2]

    Details (4)

    • 2.9.14+dfsg-1.3~deb12u6 · amd64 · bookworm

      Fixed · Fixed: 2.9.14+dfsg-1.3~deb12u1

      dsa · libxml2 · debian · bookworm

    • 2.9.14+dfsg-1.3~deb12u6 · arm64 · bookworm

      Fixed · Fixed: 2.9.14+dfsg-1.3~deb12u1

      dsa · libxml2 · debian · bookworm

    • 2.9.14+dfsg-1.3~deb12u4 · amd64 · bookworm-security

      Fixed · Fixed: 2.9.14+dfsg-1.3~deb12u1

      dsa · libxml2 · debian · bookworm

    • 2.9.14+dfsg-1.3~deb12u4 · arm64 · bookworm-security

      Fixed · Fixed: 2.9.14+dfsg-1.3~deb12u1

      dsa · libxml2 · debian · bookworm

  • [libxml2-doc]Unknown

    Source package: [libxml2]

    Details (4)

    • 2.9.14+dfsg-1.3~deb12u6 · all · bookworm

      Fixed · Fixed: 2.9.14+dfsg-1.3~deb12u1

      dsa · libxml2 · debian · bookworm

    • 2.9.14+dfsg-1.3~deb12u6 · all · bookworm

      Fixed · Fixed: 2.9.14+dfsg-1.3~deb12u1

      dsa · libxml2 · debian · bookworm

    • 2.9.14+dfsg-1.3~deb12u4 · all · bookworm-security

      Fixed · Fixed: 2.9.14+dfsg-1.3~deb12u1

      dsa · libxml2 · debian · bookworm

    • 2.9.14+dfsg-1.3~deb12u4 · all · bookworm-security

      Fixed · Fixed: 2.9.14+dfsg-1.3~deb12u1

      dsa · libxml2 · debian · bookworm

  • [libxml2-utils]Unknown

    Source package: [libxml2]

    Details (4)

    • 2.9.14+dfsg-1.3~deb12u6 · amd64 · bookworm

      Fixed · Fixed: 2.9.14+dfsg-1.3~deb12u1

      dsa · libxml2 · debian · bookworm

    • 2.9.14+dfsg-1.3~deb12u6 · arm64 · bookworm

      Fixed · Fixed: 2.9.14+dfsg-1.3~deb12u1

      dsa · libxml2 · debian · bookworm

    • 2.9.14+dfsg-1.3~deb12u4 · amd64 · bookworm-security

      Fixed · Fixed: 2.9.14+dfsg-1.3~deb12u1

      dsa · libxml2 · debian · bookworm

    • 2.9.14+dfsg-1.3~deb12u4 · arm64 · bookworm-security

      Fixed · Fixed: 2.9.14+dfsg-1.3~deb12u1

      dsa · libxml2 · debian · bookworm

  • [python3-libxml2]Unknown

    Source package: [libxml2]

    Details (4)

    • 2.9.14+dfsg-1.3~deb12u6 · amd64 · bookworm

      Fixed · Fixed: 2.9.14+dfsg-1.3~deb12u1

      dsa · libxml2 · debian · bookworm

    • 2.9.14+dfsg-1.3~deb12u6 · arm64 · bookworm

      Fixed · Fixed: 2.9.14+dfsg-1.3~deb12u1

      dsa · libxml2 · debian · bookworm

    • 2.9.14+dfsg-1.3~deb12u4 · amd64 · bookworm-security

      Fixed · Fixed: 2.9.14+dfsg-1.3~deb12u1

      dsa · libxml2 · debian · bookworm

    • 2.9.14+dfsg-1.3~deb12u4 · arm64 · bookworm-security

      Fixed · Fixed: 2.9.14+dfsg-1.3~deb12u1

      dsa · libxml2 · debian · bookworm

  • [python3-lxml]Unknown

    Source package: [lxml]

    Details (2)

    • 4.9.2-1+b1 · amd64 · bookworm

      Fixed · Fixed: 4.9.1-1

      dsa · lxml · debian · bookworm

    • 4.9.2-1+b1 · arm64 · bookworm

      Fixed · Fixed: 4.9.1-1

      dsa · lxml · debian · bookworm

  • [python-lxml-doc]Unknown

    Source package: [lxml]

    Details (2)

    • 4.9.2-1 · all · bookworm

      Fixed · Fixed: 4.9.1-1

      dsa · lxml · debian · bookworm

    • 4.9.2-1 · all · bookworm

      Fixed · Fixed: 4.9.1-1

      dsa · lxml · debian · bookworm

[openSUSE Tumbleweed]

  • [libxml2-16]Unknown

    Source package: [libxml2]

    Details (1)

    • 2.15.3-2.2 · x86_64 · tumbleweed

      Unknown · Fixed: 2.10.1-1.1

      Version impact unknown

      dsa · libxml2 · opensuse · tumbleweed

  • [libxml2-16-32bit]Unknown

    Source package: [libxml2]

    Details (1)

    • 2.15.3-2.2 · x86_64 · tumbleweed

      Unknown · Fixed: 2.10.1-1.1

      Version impact unknown

      dsa · libxml2 · opensuse · tumbleweed

  • [libxml2-devel]Unknown

    Source package: [libxml2]

    Details (1)

    • 2.15.3-2.2 · x86_64 · tumbleweed

      Unknown · Fixed: 2.10.1-1.1

      Version impact unknown

      dsa · libxml2 · opensuse · tumbleweed

  • [libxml2-devel-32bit]Unknown

    Source package: [libxml2]

    Details (1)

    • 2.15.3-2.2 · x86_64 · tumbleweed

      Unknown · Fixed: 2.10.1-1.1

      Version impact unknown

      dsa · libxml2 · opensuse · tumbleweed

  • [libxml2-tools]Unknown

    Source package: [libxml2]

    Details (1)

    • 2.15.3-2.2 · x86_64 · tumbleweed

      Unknown · Fixed: 2.10.1-1.1

      Version impact unknown

      dsa · libxml2 · opensuse · tumbleweed

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]