CVE-2009-2414 Denial of service in n/a
Attackers can crash applications using libxml2 by sending XML with deeply nested DTD element declarations, causing stack exhaustion.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2009-2414?
CVE-2009-2414 is a medium-severity denial of service vulnerability in Xmlsoft Libxml2, published on 11 Aug 2009. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Stack consumption vulnerability in libxml2 2.5.10, 2.6.16, 2.6.26, 2.6.27, and 2.6.32, and libxml 1.8.17, allows context-dependent attackers to cause a denial of service (application crash) via a large depth of element declarations in a DTD, related to a function recursion, as demonstrated by the Codenomicon XML fuzzing framework.
Weakness: CWE-119
Which versions are affected by CVE-2009-2414?
It affects 2 products.
Products include Xmlsoft Libxml, Xmlsoft Libxml2.
How do I fix CVE-2009-2414?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2009-2414 being exploited?
There is no known exploitation of CVE-2009-2414 in the wild and no public exploit code.
Other vulnerabilities in Xmlsoft Libxml2
Sources
Also known as DEBIAN-CVE-2009-2414, GHSA-pxj8-hpwc-88mp.