CVE-2021-3537: Debian Linux
Medium severity, CVSS 5.9. EPSS: 3.5% chance of exploitation in the next 30 days.
A vulnerability found in libxml2 in versions before 2.9.11 shows that it did not propagate errors while parsing XML mixed content, causing a NULL dereference. If an untrusted XML document was parsed in recovery mode and post-validated, the flaw could be used to crash the application. The highest threat from this vulnerability is to system availability.
Affected products
- Debian Debian Linux: version 9.0 only
- Fedoraproject Fedora: version 33 only; version 34 only
- Netapp Active Iq Unified Manager: affected versions not specified
- Netapp Clustered Data Ontap: affected versions not specified
- Netapp Clustered Data Ontap Antivirus Connector: affected versions not specified
- Netapp Hci h410c Firmware: affected versions not specified
- Netapp Manageability Software Development Kit: affected versions not specified
- Netapp Ontap Select Deploy Administration Utility: affected versions not specified
- Netapp Snapdrive: affected versions not specified
- Oracle Communications Cloud Native Core Network Function Cloud Native Environment: version 1.10.0 only
- Oracle Enterprise Manager Base Platform: version 13.4.0.0 only; version 13.5.0.0 only
- Oracle Enterprise Manager Ops Center: version 12.4.0.0 only
- Oracle MySQL Workbench: up to and including 8.0.26
- Oracle Openjdk: version 8 only
- Oracle PeopleSoft Enterprise PeopleTools: version 8.58 only
- Oracle Real User Experience Insight: version 13.4.1.0 only; version 13.5.1.0 only
- Red Hat Enterprise Linux: version 6.0 only; version 7.0 only; version 8.0 only
- Red Hat JBoss Core Services: affected versions not specified
- Xmlsoft LIBXML2: before 2.9.11 (fixed in 2.9.11)
Published 2021-05-14. Last modified 2026-06-17.