← Database

CVE-2024-40896

CRITICAL CVSS: 9.1 Published: 2024-12-23 Modified: 2026-06-17

Description

In libxml2 2.11 before 2.11.9, 2.12 before 2.12.9, and 2.13 before 2.13.3, the SAX parser can produce events for external entities even if custom SAX handlers try to override entity content (by setting "checked"). This makes classic XXE attacks possible.

Affected Platforms

Netapp H410SNetapp Solidfire \& Hci Storage NodeNetapp H410CNetapp H300S FirmwareNetapp Hci Compute NodeXmlsoft Libxml2Netapp H300SNetapp H410S FirmwareNetapp H700S FirmwareNetapp H410C Firmware

Weakness Type

CWE-611

References