Vulnerability · Published Jul 9, 2021 · Assigned by redhat
CVE-2021-3541
Medium 6.5
In plain English
A medium-severity security flaw in libxml2. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.1% (higher than 81% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)6.5Medium
Exploit odds (30 days)2.1%top 18.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A flaw was found in libxml2. Exponential entity expansion attack its possible bypassing all existing protection mechanisms and leading to denial of service.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | libxml2-devel | 2.9.7-9.el8_4.2 | ALSA-2021:2569 |
| Alpine:v3.20 | libxml2 | 2.9.11-r0 | ALPINE-CVE-2021-3541 |
| Alpine:v3.21 | libxml2 | 2.9.11-r0 | ALPINE-CVE-2021-3541 |
| Alpine:v3.22 | libxml2 | 2.9.11-r0 | ALPINE-CVE-2021-3541 |
| Alpine:v3.23 | libxml2 | 2.9.11-r0 | ALPINE-CVE-2021-3541 |
| Alpine:v3.24 | libxml2 | 2.9.11-r0 | ALPINE-CVE-2021-3541 |
| Alpine:v3.20 | qt5-qtwebengine | 5.15.3_git20211112-r0 | ALPINE-CVE-2021-3541 |
| Alpine:v3.21 | qt5-qtwebengine | 5.15.3_git20211112-r0 | ALPINE-CVE-2021-3541 |
| Alpine:v3.22 | qt5-qtwebengine | 5.15.3_git20211112-r0 | ALPINE-CVE-2021-3541 |
| Alpine:v3.23 | qt5-qtwebengine | 5.15.3_git20211112-r0 | ALPINE-CVE-2021-3541 |
| Debian:12 | libxml2 | 2.9.10+dfsg-6.7 | DEBIAN-CVE-2021-3541 |
| Debian:13 | libxml2 | 2.9.10+dfsg-6.7 | DEBIAN-CVE-2021-3541 |
| Debian:14 | libxml2 | 2.9.10+dfsg-6.7 | DEBIAN-CVE-2021-3541 |
| Rocky Linux:8 | libxml2 | 0:2.9.7-9.el8_4.2 | RLSA-2021:2569 |