CVE-2023-39615 Denial of service in n/a

Medium 6.5 Published 29 Aug 2023 Updated 14 Oct 2026

Attackers can cause a denial of service in Libxml2 by supplying a crafted XML file, affecting applications using the library.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2023-39615?

CVE-2023-39615 is a medium-severity denial of service vulnerability in Xmlsoft Libxml2, published on 29 Aug 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Xmlsoft Libxml2 v2.11.0 was discovered to contain an out-of-bounds read via the xmlSAX2StartElement() function at /libxml2/SAX2.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted XML file. NOTE: the vendor's position is that the product does not support the legacy SAX1 interface with custom callbacks; there is a crash even without crafted input.

Weakness: CWE-119

Which versions are affected by CVE-2023-39615?

It affects 1 product.

Linux distribution packages (40)

`libxml2` AlmaLinux:8	All versions	`2.9.7-18.el8_9`
`libxml2-devel` AlmaLinux:8	All versions	`2.9.7-18.el8_9`
`python3-libxml2` AlmaLinux:8	All versions	`2.9.7-18.el8_9`
`libxml2` AlmaLinux:9	All versions	`2.9.13-5.el9_3`
`libxml2-devel` AlmaLinux:9	All versions	`2.9.13-5.el9_3`
`python3-libxml2` AlmaLinux:9	All versions	`2.9.13-5.el9_3`
`libxml2-debuginfo` Red Hat:enterprise_linux:8::appstream	All versions	`0:2.9.7-18.el8_9`
`libxml2-debugsource` Red Hat:enterprise_linux:8::appstream	All versions	`0:2.9.7-18.el8_9`
`libxml2-devel` Red Hat:enterprise_linux:8::appstream	All versions	`0:2.9.7-18.el8_9`
`python3-libxml2-debuginfo` Red Hat:enterprise_linux:8::appstream	All versions	`0:2.9.7-18.el8_9`
`libxml2` Red Hat:enterprise_linux:8::baseos	All versions	`0:2.9.7-18.el8_9`
`libxml2-debuginfo` Red Hat:enterprise_linux:8::baseos	All versions	`0:2.9.7-18.el8_9`
`libxml2-debugsource` Red Hat:enterprise_linux:8::baseos	All versions	`0:2.9.7-18.el8_9`
`python3-libxml2` Red Hat:enterprise_linux:8::baseos	All versions	`0:2.9.7-18.el8_9`
`python3-libxml2-debuginfo` Red Hat:enterprise_linux:8::baseos	All versions	`0:2.9.7-18.el8_9`
`libxml2-debuginfo` Red Hat:enterprise_linux:9::appstream	All versions	`0:2.9.13-5.el9_3`
`libxml2-debugsource` Red Hat:enterprise_linux:9::appstream	All versions	`0:2.9.13-5.el9_3`
`libxml2-devel` Red Hat:enterprise_linux:9::appstream	All versions	`0:2.9.13-5.el9_3`
`python3-libxml2-debuginfo` Red Hat:enterprise_linux:9::appstream	All versions	`0:2.9.13-5.el9_3`
`libxml2` Red Hat:enterprise_linux:9::baseos	All versions	`0:2.9.13-5.el9_3`
`libxml2-debuginfo` Red Hat:enterprise_linux:9::baseos	All versions	`0:2.9.13-5.el9_3`
`libxml2-debugsource` Red Hat:enterprise_linux:9::baseos	All versions	`0:2.9.13-5.el9_3`
`python3-libxml2` Red Hat:enterprise_linux:9::baseos	All versions	`0:2.9.13-5.el9_3`
`python3-libxml2-debuginfo` Red Hat:enterprise_linux:9::baseos	All versions	`0:2.9.13-5.el9_3`
`libxml2-debuginfo` Red Hat:rhel_eus:8.8::appstream	All versions	`0:2.9.7-16.el8_8.2`
`libxml2-debugsource` Red Hat:rhel_eus:8.8::appstream	All versions	`0:2.9.7-16.el8_8.2`
`libxml2-devel` Red Hat:rhel_eus:8.8::appstream	All versions	`0:2.9.7-16.el8_8.2`
`python3-libxml2-debuginfo` Red Hat:rhel_eus:8.8::appstream	All versions	`0:2.9.7-16.el8_8.2`
`libxml2` Red Hat:rhel_eus:8.8::baseos	All versions	`0:2.9.7-16.el8_8.2`
`libxml2-debuginfo` Red Hat:rhel_eus:8.8::baseos	All versions	`0:2.9.7-16.el8_8.2`
`libxml2-debugsource` Red Hat:rhel_eus:8.8::baseos	All versions	`0:2.9.7-16.el8_8.2`
`python3-libxml2` Red Hat:rhel_eus:8.8::baseos	All versions	`0:2.9.7-16.el8_8.2`
`python3-libxml2-debuginfo` Red Hat:rhel_eus:8.8::baseos	All versions	`0:2.9.7-16.el8_8.2`
`libxml2` Rocky Linux:8	All versions	`0:2.9.7-18.el8`
`libxml2` Rocky Linux:8	All versions	`0:2.9.7-18.el8_9`
`libxml2` SUSE:Enterprise Storage 7	All versions	`2.9.7-150000.3.60.1`
`python-libxml2-python` SUSE:Enterprise Storage 7	All versions	`2.9.7-150000.3.60.1`
`libxml2` SUSE:Enterprise Storage 7.1	All versions	`2.9.7-150000.3.60.1`
`python-libxml2-python` SUSE:Enterprise Storage 7.1	All versions	`2.9.7-150000.3.60.1`
`libxml2` SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS	All versions	`2.9.7-150000.3.60.1`

Products include Xmlsoft Libxml2.

How do I fix CVE-2023-39615?

Apply the vendor's patch.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2023-39615 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-39615 exists.

All Xmlsoft Libxml2 vulnerabilities

Sources

Also known as ALSA-2023:7747, ALSA-2024:0119, DEBIAN-CVE-2023-39615, ECHO-b629-387c-838e, GHSA-9fj4-8443-vg2m, JLSEC-2025-81 and 10 more.