What’s Vulnerable › Vulnerabilities

CVE-2021-3518: Nokogiri Implements libxml2 version vulnerable to use-after-free

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 21.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-05-18 · updated 2026-10-14
• Weakness: CWE-416

Description

There's a flaw in libxml2 in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by an application linked with libxml2 could trigger a use-after-free. The greatest impact from this flaw is to confidentiality, integrity, and availability.

Affected products

• Debian Linux: 9.0
• Fedoraproject Fedora: 33, 34
• Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows: all versions
• Clustered Data ONTAP: all versions
• NetApp Clustered Data Ontap Antivirus Connector: all versions
• NetApp Hci H410C Firmware: all versions
• NetApp Manageability Software Development Kit: all versions
• NetApp ONTAP Select Deploy administration utility: all versions
• NetApp Snapdrive: all versions
• Oracle Communications Cloud Native Core Network Function Cloud Native Environment: 1.10.0
• Oracle Corporation Enterprise Manager Base Platform: 13.4.0.0, 13.5.0.0
• Oracle Corporation Enterprise Manager Ops Center: 12.4.0.0
• Oracle Corporation MySQL Workbench: through 8.0.26
• Oracle Corporation PeopleSoft Enterprise PT PeopleTools: 8.58
• Oracle Real User Experience Insight: 13.4.1.0, 13.5.1.0
• Red Hat Enterprise Linux: 8.0
• RedHat Jboss Core Services: all versions
• xmlsoft libxml2: before 2.9.11 — fixed in 2.9.11
• Rubygems Nokogiri: before 1.11.4; 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5 (+122) — fixed in 1.11.4

How to fix

Upgrade to a fixed version: xmlsoft libxml2 2.9.11; Rubygems Nokogiri 1.11.4. Check the vendor advisory for mitigations.

References

• http://seclists.org/fulldisclosure/2021/Jul/54
• http://seclists.org/fulldisclosure/2021/Jul/55
• http://seclists.org/fulldisclosure/2021/Jul/58
• http://seclists.org/fulldisclosure/2021/Jul/59
• https://bugzilla.redhat.com/show_bug.cgi?id=1954242
• https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
• https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
• https://lists.debian.org/debian-lts-announce/2021/05/msg00008.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BZOMV5J4PMZAORVT64BKLV6YIZAFDGX6/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QVM4UJ3376I6ZVOYMHBNX4GY3NIV52WV/
• https://security.gentoo.org/glsa/202107-05
• https://security.netapp.com/advisory/ntap-20210625-0002/

Get alerted when CVE-2021-3518 or the next vulnerability affects your stack