PT-2025-25307 · Red Hat+13 · Red Hat Openshift Container Platform+15
Ahmed Lekssays
·
Published
2025-06-12
·
Updated
2026-05-08
·
CVE-2025-6021
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
libxml2 (affected versions not specified)
Red Hat Enterprise Linux versions 6 through 10
Red Hat JBoss Core Services (affected versions not specified)
Red Hat OpenShift Container Platform 4 (affected versions not specified)
Description
A flaw was found in libxml2's xmlBuildQName function, where integer overflows in buffer size calculations can lead to a stack-based buffer overflow. This issue can result in memory corruption or a denial of service when processing crafted input.
Recommendations
For libxml2, consider disabling the
xmlBuildQName function until a patch is available.
For Red Hat Enterprise Linux versions 6 through 10, update to a version that includes the fix for this issue.
For Red Hat JBoss Core Services, restrict access to the vulnerable xmlBuildQName function to minimize the risk of exploitation.
For Red Hat OpenShift Container Platform 4, avoid using the xmlBuildQName function in affected API endpoints until the issue is resolved.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
DoS
Integer Overflow
Memory Corruption
Stack Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Debian
Ibm Aix
Java Platform
Linuxmint
Red Hat
Red Hat Jboss Core Services
Red Hat Openshift Container Platform
Red Os
Rocky Linux
Suse
Ubuntu
Libxml2