DEBIAN-CVE-2025-9714
- Source
- https://security-tracker.debian.org/tracker/CVE-2025-9714
- Import Source
- https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2025-9714.json
- JSON Data
- https://api.osv.dev/v1/vulns/DEBIAN-CVE-2025-9714
- Upstream
- Downstream
- Published
- 2025-09-10T19:15:42Z
- Modified
- 2026-09-01T20:05:59Z
- Severity
-
- 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- [none]
- Details
-
Uncontrolled recursion in XPath evaluation in libxml2 up to and including version 2.9.14 allows a local attacker to cause a stack overflow via crafted expressions. XPath processing functions
xmlXPathRunEval,xmlXPathCtxtCompile, andxmlXPathEvalExprwere resetting recursion depth to zero before making potentially recursive calls. When such functions were called recursively this could allow for uncontrolled recursion and lead to a stack overflow. These functions now preserve recursion depth across recursive calls, allowing recursion depth to be controlled. - References
Affected packages
Debian:12 / libxml2
Package
- Name
- libxml2
- Purl
- pkg:deb/debian/libxml2?arch=source&distro=bookworm
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed2.9.14+dfsg-1.3~deb12u5
Debian:13 / libxml2
Package
- Name
- libxml2
- Purl
- pkg:deb/debian/libxml2?arch=source&distro=trixie
Debian:14 / libxml2
Package
- Name
- libxml2
- Purl
- pkg:deb/debian/libxml2?arch=source&distro=forky
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed2.14.5+dfsg-0.1