What’s Vulnerable › Vulnerabilities

CVE-2021-3541

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-07-09 · updated 2026-10-14
• Weakness: CWE-776

Description

A flaw was found in libxml2. Exponential entity expansion attack its possible bypassing all existing protection mechanisms and leading to denial of service.

Affected products

• Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows: all versions
• NetApp Cloud Backup: all versions
• Clustered Data ONTAP: all versions
• NetApp Clustered Data Ontap Antivirus Connector: all versions
• NetApp H300E Firmware: all versions
• NetApp H300S Firmware: all versions
• NetApp H410C Firmware: all versions
• NetApp H410S Firmware: all versions
• NetApp H500E Firmware: all versions
• NetApp H500S Firmware: all versions
• NetApp H700E Firmware: all versions
• NetApp H700S Firmware: all versions
• NetApp Manageability Software Development Kit: all versions
• NetApp ONTAP Select Deploy administration utility: all versions
• NetApp Smi-S Provider: all versions
• NetApp Snapdrive: all versions
• Oracle Corporation Oracle ZFS Storage Appliance Kit: 8.8
• RedHat Jboss Core Services: all versions
• xmlsoft libxml2: before 2.9.11 — fixed in 2.9.11

How to fix

Upgrade to a fixed version: xmlsoft libxml2 2.9.11. Check the vendor advisory for mitigations.

References

• https://bugzilla.redhat.com/show_bug.cgi?id=1950515
• https://security.netapp.com/advisory/ntap-20210805-0007/
• https://www.oracle.com/security-alerts/cpujan2022.html
• https://bugzilla.redhat.com/show_bug.cgi?id=1950515
• https://security.netapp.com/advisory/ntap-20210805-0007/
• https://www.oracle.com/security-alerts/cpujan2022.html
• https://cert-portal.siemens.com/productcert/html/ssa-398330.html

Get alerted when CVE-2021-3541 or the next vulnerability affects your stack