Oracle Java SE / JavaFX (libxml2) CVEs

VRT 391,192 CVEs tracked · 15,442 in RASP scope · data as of 16 hours ago

Description contains RASP scope Status Exploitation Severity

Reset

Overview 3 matches · 0 in RASP scope · 0 protected · 0 KEV · 0 public PoC · 1 CISA SSVC · 0 EPSS ≥ 0.5 · 0 disputed

3matches 0in RASP scope0.0% 0protected0.0% 0KEV0.0% 0public PoC0.0% 1CISA SSVC33.3% 0EPSS ≥ 0.50.0% 0disputed0.0%

Critical 0 0.0% High 3 100.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%

Protected by RASP 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% No fix identified 0 0.0% Mitigated by environment configuration 0 0.0% Queued for review 0 0.0% Not applicable 2 66.7% Out of RASP scope 1 33.3% Rejected 0 0.0%

blocked by ARMR today 0 0.0% not blocked 3 100.0% not established 0 0.0% unrecorded 0 0.0%

Exploited in the wild 0 0.0% Working exploit published 0 0.0% Proof of concept only 1 33.3% Forecast only 0 0.0% No public exploit 2 66.7%

split by SeverityStatusProtectionExploit maturity peak 1 / month

Feb 24Apr 24Jun 24Aug 24Oct 24Dec 24Feb 25Apr 25Jun 25

3 matches CSV JSON

CVE	Severity	Published▾	Status	Exploitation	Description
CVE-2025-6021	High	2025-06-12	Out of RASP scope	Proof of concept only	A flaw was found in libxml2's xmlBuildQName function, where integer overflows in buffer size calculations can lead to a stack-based buffer overflow. This issue can result in memory corruption or a denial of service when processing crafted input.
CVE-2025-27113	High	2025-02-18	Not applicable	No public exploit	libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a NULL pointer dereference in xmlPatMatch in pattern.c.
CVE-2024-25062	High	2024-02-04	Not applicable	No public exploit	An issue was discovered in libxml2 before 2.11.7 and 2.12.x before 2.12.5. When using the XML Reader interface with DTD validation and XInclude expansion enabled, processing crafted XML documents can lead to an xmlValidatePopElement use-after-free.

CVE

Severity

Published▾

Status

Exploitation

Description

CVE-2025-6021

High

2025-06-12

Out of RASP scope

Proof of concept only

A flaw was found in libxml2's xmlBuildQName function, where integer overflows in buffer size calculations can lead to a stack-based buffer overflow. This issue can result in memory corruption or a denial of service when processing crafted input.

CVE-2025-27113

High

2025-02-18

Not applicable

No public exploit

libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a NULL pointer dereference in xmlPatMatch in pattern.c.

CVE-2024-25062

High

2024-02-04

Not applicable

No public exploit

An issue was discovered in libxml2 before 2.11.7 and 2.12.x before 2.12.5. When using the XML Reader interface with DTD validation and XInclude expansion enabled, processing crafted XML documents can lead to an xmlValidatePopElement use-after-free.