| Name | CVE-2025-9714 |
| Description | Uncontrolled recursion in XPath evaluation in libxml2 up to and including version 2.9.14 allows a local attacker to cause a stack overflow via crafted expressions. XPath processing functions `xmlXPathRunEval`, `xmlXPathCtxtCompile`, and `xmlXPathEvalExpr` were resetting recursion depth to zero before making potentially recursive calls. When such functions were called recursively this could allow for uncontrolled recursion and lead to a stack overflow. These functions now preserve recursion depth across recursive calls, allowing recursion depth to be controlled. |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
Vulnerable and fixed packages
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|
| libxml2 (PTS) | bullseye | 2.9.10+dfsg-6.7+deb11u4 | vulnerable |
| bullseye (security) | 2.9.10+dfsg-6.7+deb11u8 | vulnerable |
| bookworm, bookworm (security) | 2.9.14+dfsg-1.3~deb12u4 | vulnerable |
| trixie (security), trixie | 2.12.7+dfsg+really2.9.14-2.1+deb13u1 | vulnerable |
| forky, sid | 2.14.5+dfsg-0.2 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|
| libxml2 | source | (unstable) | 2.14.5+dfsg-0.1 | | | |
Notes
[trixie] - libxml2 <no-dsa> (Minor issue; can be piggy-backed in a future update)
[bookworm] - libxml2 <no-dsa> (Minor issue; can be piggy-backed in a future update)
https://bugzilla.redhat.com/show_bug.cgi?id=2392605
https://gitlab.gnome.org/GNOME/libxslt/-/issues/148
Fixed by: https://gitlab.gnome.org/GNOME/libxml2/-/commit/677a42645ef22b5a50741bad5facf9d8a8bc6d21 (v2.10.0)
Test fixes in libxslt: https://gitlab.gnome.org/GNOME/libxslt/-/commit/b7994c3b7ab83b502f4298ab4abb10fb183f7ed4 (v1.1.36)
libxml2/2.14.5+dfsg-0.1 is actually not the earliest version in unstable
with the fix, but later on the version got reverted to 2.9.14 based one.