CVE-2024-40896: Netapp h300s Firmware

Critical severity, CVSS 9.1. EPSS: 1.2% chance of exploitation in the next 30 days.

In libxml2 2.11 before 2.11.9, 2.12 before 2.12.9, and 2.13 before 2.13.3, the SAX parser can produce events for external entities even if custom SAX handlers try to override entity content (by setting "checked"). This makes classic XXE attacks possible.

Affected products

• Netapp h300s Firmware: affected versions not specified
• Netapp h410c Firmware: affected versions not specified
• Netapp h410s Firmware: affected versions not specified
• Netapp h500s Firmware: affected versions not specified
• Netapp h700s Firmware: affected versions not specified
• Netapp Hci Compute Node: affected versions not specified
• Netapp Solidfire & Hci Management Node: affected versions not specified
• Netapp Solidfire & Hci Storage Node: affected versions not specified
• Xmlsoft LIBXML2: from 2.11.0, before 2.11.9 (fixed in 2.11.9); from 2.12.0, before 2.12.9 (fixed in 2.12.9); from 2.13.0, before 2.13.3 (fixed in 2.13.3)

Published 2024-12-23. Last modified 2026-06-17.