CVE-2017-16932
parser.c in libxml2 before 2.9.5 does not prevent infinite recursion in parameter entities.
Published Nov 23, 2017 · updated Oct 14, 2026 · xmlsoft libxml2
parser.c in libxml2 before 2.9.5 does not prevent infinite recursion in parameter entities.
Timeline
Detection, updates, and resolution for this record.
Nov 23, 2017 · NIST NVD
Detected
parser.c in libxml2 before 2.9.5 does not prevent infinite recursion in parameter entities.
Oct 14, 2026 · NIST NVD
Updated
parser.c in libxml2 before 2.9.5 does not prevent infinite recursion in parameter entities.
Oct 14, 2026 · OSV.dev
Fix available
libxml2 fixed in 2.9.10+dfsg-2; libxml2 fixed in 2.9.10+dfsg-2; libxml2 fixed in 2.9.10+dfsg-2
Oct 14, 2026 · OSV.dev
Fix available
libxml2 fixed in 2.9.10+dfsg-2
Oct 14, 2026 · OSV.dev
Updated
parser.c in libxml2 before 2.9.5 does not prevent infinite recursion in parameter entities.
Affected
- Debian:12 libxml20 → 2.9.10+dfsg-2
- Debian:13 libxml20 → 2.9.10+dfsg-2
- Debian:14 libxml20 → 2.9.10+dfsg-2
- cpe xmlsoft/libxml2version unspecified
Sources
- CVE.orgCVE-2017-16932
Official CVE identifier
cve.org - FIRST EPSSCVE-2017-16932
30-day exploitation probability 6.5%
first.org - NIST NVDCVE-2017-16932
parser.c in libxml2 before 2.9.5 does not prevent infinite recursion in parameter entities.
nvd.nist.gov - OSV.devDEBIAN-CVE-2017-16932osv.dev