CVE-2024-40896

In libxml2 2.11 before 2.11.9, 2.12 before 2.12.9, and 2.13 before 2.13.3, the SAX parser can produce events for external entities even if custom SAX handlers try to override entity content (by setting "checked"). This makes classic XXE attacks possible.

Affected products

Alt Linux, Ubuntu, Libxml2

Xmlsoft libxml2

< 2.11.9, 2.12.9, 2.13.3

Fix

Available

CVSS 3.1

9.1 CRITICAL

EPSS

1.2% (66th percentile)

Weakness

CWE-611

NVD status

Analyzed

Published

2024-12-23

No exploit for CVE-2024-40896 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.