Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:rpm/redhat/libxml2@2.9.7-7?arch=el8
purl pkg:rpm/redhat/libxml2@2.9.7-7?arch=el8
Next non-vulnerable version None.
Latest non-vulnerable version None.
Risk 4.0
Vulnerabilities affecting this package (2)
Vulnerability Summary Fixed by
VCID-8pzj-mq5r-rqcq
Aliases:
CVE-2018-9251
Loop with Unreachable Exit Condition ('Infinite Loop') The xz_decomp function in xzlib.c in libxml2, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-8035. There are no reported fixed by versions.
VCID-bejh-22y7-kuh6
Aliases:
CVE-2018-14404
GHSA-6qvp-r6r3-9p7h
NULL Pointer Dereference A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 when parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR case. Applications processing untrusted XSL format inputs with the use of the libxml2 library may be vulnerable to a denial of service attack due to a crash of the application. There are no reported fixed by versions.
Vulnerabilities fixed by this package (0)
Vulnerability Summary Aliases
This package is not known to fix vulnerabilities.

Date Actor Action Vulnerability Source VulnerableCode Version
2026-04-01T14:25:33.508432+00:00 RedHat Importer Affected by VCID-8pzj-mq5r-rqcq https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-9251.json 38.0.0
2026-04-01T14:23:55.086562+00:00 RedHat Importer Affected by VCID-bejh-22y7-kuh6 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-14404.json 38.0.0