CVE-2025-49795

HIGH7.5EPSS 0.83%

Published: 6/16/2025Modified: 4/16/2026

Also known as:ALPINE-CVE-2025-49795ALSA-2025:10630openSUSE-SU-2025:15321-1SUSE-SU-2025:02260-1SUSE-SU-2025:02314-1SUSE-SU-2025:20564-1SUSE-SU-2025:20607-1

Description

A NULL pointer dereference vulnerability was found in libxml2 when processing XPath XML expressions. This flaw allows an attacker to craft a malicious XML input to libxml2, leading to a denial of service.

Affected packages (2)

Alpine/libxml2from 0, < 2.13.9-r0
Debian/libxml2from 0

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	HIGH7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References (5)

ADVISORYhttps://access.redhat.com/errata/RHSA-2025:10630
ADVISORYhttps://security.alpinelinux.org/vuln/CVE-2025-49795
ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2025-49795
REPORThttps://bugzilla.redhat.com/show_bug.cgi?id=2372379
WEBhttps://access.redhat.com/security/cve/CVE-2025-49795