CVE catalog

CVE-2025-11731

libxslt: CVE-2025-11731

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.28% · Oct 25, 2026

A flaw was found in the exsltFuncResultComp() function of libxslt, which handles EXSLT <func:result> elements during stylesheet parsing. Due to improper type handling, the function may treat an XML document node as a regular XML element node, resulting in a type confusion. This can cause unexpected memory reads and potential crashes. While difficult to exploit, the flaw could lead to application instability or denial of service.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlibxsltsid1.1.45-0.1fixed
Debianlibxsltforky1.1.45-0.1fixed
Debianlibxslttrixie1.1.35-1.2+deb13u3vulnerable
Debianlibxslttrixie-security1.1.35-1.2+deb13u2vulnerable
Debianlibxsltbookworm1.1.35-1+deb12u4vulnerable
Debianlibxsltbookworm-security1.1.35-1+deb12u3vulnerable
Opensusepython-lxmltumbleweed6.1.1-1.1fixed
Ubuntulibxsltpro1.1.33-0ubuntu1vulnerable
Ubuntulibxsltpro1.1.33-0ubuntu2vulnerable
Ubuntulibxsltpro1.1.33-0ubuntu3vulnerable
Ubuntulibxsltpro1.1.34-1vulnerable
Ubuntulibxsltpro1.1.34-1ubuntu1vulnerable
Ubuntulibxsltpro1.1.34-3vulnerable
Ubuntulibxsltpro1.1.34-4vulnerable
Ubuntulibxsltpro1.1.34-4ubuntu0.20.04.1vulnerable
Ubuntulibxsltpro1.1.34-4ubuntu0.20.04.2vulnerable
Ubuntulibxsltpro1.1.34-4ubuntu0.20.04.3vulnerable
Ubuntulibxsltpro1.1.34-4ubuntu0.20.04.3+esm1vulnerable
Ubuntulibxsltpro1.1.34-4ubuntu0.20.04.3+esm2vulnerable
Ubuntulibxslt22.041.1.34-4vulnerable
Ubuntulibxslt22.041.1.34-4build1vulnerable
Ubuntulibxslt22.041.1.34-4build2vulnerable
Ubuntulibxslt22.041.1.34-4ubuntu0.22.04.1vulnerable
Ubuntulibxslt22.041.1.34-4ubuntu0.22.04.2vulnerable
Ubuntulibxslt22.041.1.34-4ubuntu0.22.04.3vulnerable
Ubuntulibxslt22.041.1.34-4ubuntu0.22.04.4vulnerable
Ubuntulibxslt22.041.1.34-4ubuntu0.22.04.5vulnerable
Ubuntulibxslt24.041.1.35-1vulnerable
Ubuntulibxslt24.041.1.39-0exp1vulnerable
Ubuntulibxslt24.041.1.39-0exp1build1vulnerable
Ubuntulibxslt24.041.1.39-0exp1ubuntu0.24.04.1vulnerable
Ubuntulibxslt24.041.1.39-0exp1ubuntu0.24.04.2vulnerable
Ubuntulibxslt24.041.1.39-0exp1ubuntu0.24.04.3vulnerable
Ubuntulibxslt25.101.1.39-0exp1ubuntu4vulnerable
Ubuntulibxslt25.101.1.43-0exp1vulnerable
Ubuntulibxslt25.101.1.43-0.1vulnerable
Ubuntulibxslt26.041.1.43-0.1vulnerable
Ubuntulibxslt26.041.1.43-0.3fixed
Opensuselibxslttumbleweed1.1.43-4.1fixed
Suselibxsltlinux enterprise high performance computing 15 sp3-ltss1.1.32-150000.3.28.1fixed
Suselibxsltlinux enterprise server 15 sp3-ltss1.1.32-150000.3.28.1fixed
Suselibxsltlinux enterprise server for sap applications 15 sp31.1.32-150000.3.28.1fixed
Suselibxsltlinux enterprise micro 5.11.1.32-150000.3.28.1fixed
Suselibxsltlinux enterprise micro 5.21.1.32-150000.3.28.1fixed
Suselibxsltenterprise storage 7.11.1.32-150000.3.28.1fixed
Opensuselibxslt-pythonleap 15.61.1.32-150000.3.28.1fixed
Suselibxsltlinux enterprise server 12 sp5-ltss1.1.28-17.21.1fixed
Suselibxsltlinux enterprise server ltss extended security 12 sp51.1.28-17.21.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlibxsltsourcesid1.1.43-0.3not yet assignedNot reported[1118078]
Debianlibxsltsourceforky1.1.43-0.3not yet assignedNot reported[1118078]
Debianlibxsltsourcetrixie(unfixed)not yet assignedNot reported[1118078]
Debianlibxsltsourcebookworm(unfixed)not yet assignedNot reported[1118078]
Opensusepython-lxmlrpmtumbleweed6.1.1-1.1Not reportedOPENSUSE-SU-2026:11147-1Not reported
Ubuntulibxsltdeb26.041.1.43-0.3Not reportedUBUNTU-CVE-2025-11731Not reported
Opensuselibxsltrpmtumbleweed1.1.43-4.1Not reportedOPENSUSE-SU-2025:15641-1Not reported
Suselibxsltrpmlinux enterprise high performance computing 15 sp3-ltss1.1.32-150000.3.28.1Not reportedSUSE-SU-2025:3743-1Not reported
Suselibxsltrpmlinux enterprise server 15 sp3-ltss1.1.32-150000.3.28.1Not reportedSUSE-SU-2025:3743-1Not reported
Suselibxsltrpmlinux enterprise server for sap applications 15 sp31.1.32-150000.3.28.1Not reportedSUSE-SU-2025:3743-1Not reported
Suselibxsltrpmlinux enterprise micro 5.11.1.32-150000.3.28.1Not reportedSUSE-SU-2025:3743-1Not reported
Suselibxsltrpmlinux enterprise micro 5.21.1.32-150000.3.28.1Not reportedSUSE-SU-2025:3743-1Not reported
Suselibxsltrpmenterprise storage 7.11.1.32-150000.3.28.1Not reportedSUSE-SU-2025:3743-1Not reported
Opensuselibxslt-pythonrpmleap 15.61.1.32-150000.3.28.1Not reportedSUSE-SU-2025:3743-1Not reported
Suselibxsltrpmlinux enterprise server 12 sp5-ltss1.1.28-17.21.1Not reportedSUSE-SU-2025:3778-1Not reported
Suselibxsltrpmlinux enterprise server ltss extended security 12 sp51.1.28-17.21.1Not reportedSUSE-SU-2025:3778-1Not reported

[Debian bug #1118078]

Notes

[trixie] libxslt: Minor issue [bookworm] libxslt: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libxslt1.1]Affected

    Source package: [libxslt]

    Details (4)

    • 1.1.35-1+deb12u4 · amd64 · bookworm

      Affected

      dsa · libxslt · debian · bookworm; dsa · libxslt · debian · 12

    • 1.1.35-1+deb12u4 · arm64 · bookworm

      Affected

      dsa · libxslt · debian · bookworm; dsa · libxslt · debian · 12

    • 1.1.35-1+deb12u3 · amd64 · bookworm-security

      Affected

      dsa · libxslt · debian · bookworm; dsa · libxslt · debian · 12

    • 1.1.35-1+deb12u3 · arm64 · bookworm-security

      Affected

      dsa · libxslt · debian · bookworm; dsa · libxslt · debian · 12

  • [libxslt1-dev]Affected

    Source package: [libxslt]

    Details (4)

    • 1.1.35-1+deb12u4 · amd64 · bookworm

      Affected

      dsa · libxslt · debian · bookworm; dsa · libxslt · debian · 12

    • 1.1.35-1+deb12u4 · arm64 · bookworm

      Affected

      dsa · libxslt · debian · bookworm; dsa · libxslt · debian · 12

    • 1.1.35-1+deb12u3 · amd64 · bookworm-security

      Affected

      dsa · libxslt · debian · bookworm; dsa · libxslt · debian · 12

    • 1.1.35-1+deb12u3 · arm64 · bookworm-security

      Affected

      dsa · libxslt · debian · bookworm; dsa · libxslt · debian · 12

  • [xsltproc]Affected

    Source package: [libxslt]

    Details (4)

    • 1.1.35-1+deb12u4 · amd64 · bookworm

      Affected

      dsa · libxslt · debian · bookworm; dsa · libxslt · debian · 12

    • 1.1.35-1+deb12u4 · arm64 · bookworm

      Affected

      dsa · libxslt · debian · bookworm; dsa · libxslt · debian · 12

    • 1.1.35-1+deb12u3 · amd64 · bookworm-security

      Affected

      dsa · libxslt · debian · bookworm; dsa · libxslt · debian · 12

    • 1.1.35-1+deb12u3 · arm64 · bookworm-security

      Affected

      dsa · libxslt · debian · bookworm; dsa · libxslt · debian · 12

[Debian 13 (Trixie)]

  • [libxslt1.1]Affected

    Source package: [libxslt]

    Details (4)

    • 1.1.35-1.2+deb13u3 · amd64 · trixie

      Affected

      dsa · libxslt · debian · 13

    • 1.1.35-1.2+deb13u3 · arm64 · trixie

      Affected

      dsa · libxslt · debian · 13

    • 1.1.35-1.2+deb13u2 · amd64 · trixie-security

      Affected

      dsa · libxslt · debian · 13

    • 1.1.35-1.2+deb13u2 · arm64 · trixie-security

      Affected

      dsa · libxslt · debian · 13

  • [libxslt1-dev]Affected

    Source package: [libxslt]

    Details (4)

    • 1.1.35-1.2+deb13u3 · amd64 · trixie

      Affected

      dsa · libxslt · debian · 13

    • 1.1.35-1.2+deb13u3 · arm64 · trixie

      Affected

      dsa · libxslt · debian · 13

    • 1.1.35-1.2+deb13u2 · amd64 · trixie-security

      Affected

      dsa · libxslt · debian · 13

    • 1.1.35-1.2+deb13u2 · arm64 · trixie-security

      Affected

      dsa · libxslt · debian · 13

  • [xsltproc]Affected

    Source package: [libxslt]

    Details (4)

    • 1.1.35-1.2+deb13u3 · amd64 · trixie

      Affected

      dsa · libxslt · debian · 13

    • 1.1.35-1.2+deb13u3 · arm64 · trixie

      Affected

      dsa · libxslt · debian · 13

    • 1.1.35-1.2+deb13u2 · amd64 · trixie-security

      Affected

      dsa · libxslt · debian · 13

    • 1.1.35-1.2+deb13u2 · arm64 · trixie-security

      Affected

      dsa · libxslt · debian · 13

[openSUSE Tumbleweed]

  • [libexslt0]Unknown

    Source package: [libxslt]

    Details (1)

    • 1.1.45-1.4 · x86_64 · tumbleweed

      Unknown · Fixed: 1.1.43-4.1

      Version impact unknown

      dsa · libxslt · opensuse · tumbleweed

  • [libxslt1]Unknown

    Source package: [libxslt]

    Details (1)

    • 1.1.45-1.4 · x86_64 · tumbleweed

      Unknown · Fixed: 1.1.43-4.1

      Version impact unknown

      dsa · libxslt · opensuse · tumbleweed

  • [libxslt1-32bit]Unknown

    Source package: [libxslt]

    Details (1)

    • 1.1.45-1.4 · x86_64 · tumbleweed

      Unknown · Fixed: 1.1.43-4.1

      Version impact unknown

      dsa · libxslt · opensuse · tumbleweed

  • [libxslt-devel]Unknown

    Source package: [libxslt]

    Details (1)

    • 1.1.45-1.4 · x86_64 · tumbleweed

      Unknown · Fixed: 1.1.43-4.1

      Version impact unknown

      dsa · libxslt · opensuse · tumbleweed

  • [libxslt-devel-32bit]Unknown

    Source package: [libxslt]

    Details (1)

    • 1.1.45-1.4 · x86_64 · tumbleweed

      Unknown · Fixed: 1.1.43-4.1

      Version impact unknown

      dsa · libxslt · opensuse · tumbleweed

  • [libxslt-tools]Unknown

    Source package: [libxslt]

    Details (1)

    • 1.1.45-1.4 · x86_64 · tumbleweed

      Unknown · Fixed: 1.1.43-4.1

      Version impact unknown

      dsa · libxslt · opensuse · tumbleweed

  • [python313-lxml]Unknown

    Source package: [python-lxml]

    Details (1)

    • 6.1.1-2.2 · x86_64 · tumbleweed

      Unknown · Fixed: 6.1.1-1.1

      Version impact unknown

      dsa · python-lxml · opensuse · tumbleweed

  • [python313-lxml-devel]Unknown

    Source package: [python-lxml]

    Details (1)

    • 6.1.1-2.2 · x86_64 · tumbleweed

      Unknown · Fixed: 6.1.1-1.1

      Version impact unknown

      dsa · python-lxml · opensuse · tumbleweed

  • [python314-lxml]Unknown

    Source package: [python-lxml]

    Details (1)

    • 6.1.1-2.2 · x86_64 · tumbleweed

      Unknown · Fixed: 6.1.1-1.1

      Version impact unknown

      dsa · python-lxml · opensuse · tumbleweed

  • [python314-lxml-devel]Unknown

    Source package: [python-lxml]

    Details (1)

    • 6.1.1-2.2 · x86_64 · tumbleweed

      Unknown · Fixed: 6.1.1-1.1

      Version impact unknown

      dsa · python-lxml · opensuse · tumbleweed

  • [python-lxml-doc]Unknown

    Source package: [python-lxml]

    Details (1)

    • 6.1.1-2.2 · noarch · tumbleweed

      Unknown · Fixed: 6.1.1-1.1

      Version impact unknown

      dsa · python-lxml · opensuse · tumbleweed

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]