CVE-2024-40896
- Source
- https://cve.org/CVERecord?id=CVE-2024-40896
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-40896.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2024-40896
- Downstream
- Related
- Published
- 2024-12-23T17:15:08.400Z
- Modified
- 2026-04-12T09:00:31.135340Z
- Severity
-
- 9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H CVSS Calculator
- Summary
- [none]
- Details
-
In libxml2 2.11 before 2.11.9, 2.12 before 2.12.9, and 2.13 before 2.13.3, the SAX parser can produce events for external entities even if custom SAX handlers try to override entity content (by setting "checked"). This makes classic XXE attacks possible.
- References
Affected packages
Git / gitlab.gnome.org/GNOME/libxml2
Affected ranges
- Type
- GIT
- Repo
- https://gitlab.gnome.org/GNOME/libxml2
- Events
-
IntroducedFixedIntroducedFixedIntroducedFixedFixed
- Database specific
{ "versions": [ { "introduced": "2.11.0" }, { "fixed": "2.11.9" }, { "introduced": "2.12.0" }, { "fixed": "2.12.9" }, { "introduced": "2.13.0" }, { "fixed": "2.13.3" } ] }
Affected versions
v2.*
v2.11.0
v2.11.1
v2.11.2
v2.11.3
v2.11.4
v2.11.5
v2.11.6
v2.11.7
v2.11.8
v2.12.0
v2.12.1
v2.12.2
v2.12.3
v2.12.4
v2.12.5
v2.12.6
v2.12.7
v2.12.8
v2.13.0
v2.13.1
v2.13.2
Database specific
vanir_signatures_modified
"2026-04-12T09:00:31Z"
vanir_signatures
[
{
"id": "CVE-2024-40896-0c2708a2",
"signature_version": "v1",
"digest": {
"function_hash": "82553749786656255912126799861154897360",
"length": 3301.0
},
"source": "https://gitlab.gnome.org/GNOME/libxml2@1a8932303969907f6572b1b6aac4081c56adb5c6",
"deprecated": false,
"target": {
"function": "xmlParseReference",
"file": "parser.c"
},
"signature_type": "Function"
},
{
"id": "CVE-2024-40896-910a3c8a",
"signature_version": "v1",
"digest": {
"line_hashes": [
"226593095160989718580933120468166360739",
"24164626288106891637588310425951675567",
"136306041615198176511953925556784839741"
],
"threshold": 0.9
},
"source": "https://gitlab.gnome.org/GNOME/libxml2@1a8932303969907f6572b1b6aac4081c56adb5c6",
"deprecated": false,
"target": {
"file": "parser.c"
},
"signature_type": "Line"
}
]
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-40896.json"