What’s Vulnerable › Vulnerabilities

CVE-2025-49794: Libxml: heap use after free (uaf) leads to denial of service (dos)

Description

A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under certain circumstances when the XML schematron has the <sch:name path="..."/> schema elements. This flaw allows a malicious actor to craft a malicious XML document used as input for libxml, resulting in the program's crash using libxml or other possible undefined behaviors.

Affected products

How to fix

Upgrade to a fixed version: Red Hat cert-manager operator for Red Hat OpenShift 1.16 v1.16.5-1760515757; Red Hat OpenShift Container Platform 4.18 418.94.202510230424-0; Red Hat OpenShift File Integrity Operator - FIO 1 v1.3; Red Hat Enterprise Linux 10 0:2.12.5-7.el10_0; Red Hat Enterprise Linux 7 Extended Lifecycle Support 0:2.9.1-6.el7_9.10; Red Hat Enterprise Linux 8 0:2.9.7-21.el8_10.1; Red Hat Enterprise Linux 8.2 Advanced Update Support 0:2.9.7-9.el8_2.3; Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support 0:2.9.7-9.el8_4.6; Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On 0:2.9.7-9.el8_4.6; Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support 0:2.9.7-13.el8_6.10; Red Hat Enterprise Linux 8.6 Telecommunications Update Service 0:2.9.7-13.el8_6.10; Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions 0:2.9.7-13.el8_6.10. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-49794 or the next vulnerability affects your stack