PT-2026-38016 · Bitnami · Java-Min

Published 2026-05-06 · Updated 2026-05-06

OSV

An issue was discovered in libxml2 before 2.11.7 and 2.12.x before 2.12.5. When using the XML Reader interface with DTD validation and XInclude expansion enabled, processing crafted XML documents can lead to an xmlValidatePopElement use-after-free.

Related Identifiers

BIT-JAVA-MIN-2024-25062

Affected Products

Java-Min

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-25062 · Security Note
• https://osv.dev/vulnerability/BIT-java-min-2024-25062 · Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2025/02/msg00028.html · Note
• https://security.netapp.com/advisory/ntap-20241018-0009 · Note
• https://gitlab.gnome.org/GNOME/libxml2/-/tags · Note
• https://openjdk.org/groups/vulnerability/advisories/2024-10-15 · Note
• https://oracle.com/security-alerts/cpuoct2024.html · Note
• https://gitlab.gnome.org/GNOME/libxml2/-/issues/604 · Note