CVE-2025-6021 Libxml2: integer overflow in xmlbuildqname() leads to stack buffer overflow in libxml2

What is CVE-2025-6021?

CVE-2025-6021 is a high-severity vulnerability in Redhat Enterprise Linux, published on 12 Jun 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A flaw was found in libxml2's xmlBuildQName function, where integer overflows in buffer size calculations can lead to a stack-based buffer overflow. This issue can result in memory corruption or a denial of service when processing crafted input.

Weakness: CWE-787

Which versions are affected by CVE-2025-6021?

3 open source packages ship an affected version, including java, java-min and jre. It affects 20 products.

Products include Redhat Enterprise Linux, Redhat Enterprise Linux Eus, Redhat Enterprise Linux for Arm 64, Redhat Enterprise Linux for Arm 64 Eus, Redhat Enterprise Linux for Ibm Z Systems, Redhat Enterprise Linux for Ibm Z Systems Eus and 14 more.

How do I fix CVE-2025-6021?

Upgrade java to a fixed version for your release line: 1.8.0 or 8.0.481.

Is CVE-2025-6021 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-6021 exists.

Other vulnerabilities in Redhat Enterprise Linux

• CVE-2018-14667 Red Hat JBoss RichFaces Framework Expression Language Injection Exploited Critical 9.8
• CVE-2021-20325 Missing fixes for CVE-2021-40438 and CVE-2021-26691 in the versions of httpd, as shipped in Red Hat Enterprise Linux 8.5.0, causes a securit Critical 9.8
• CVE-2018-25011 Memory corruption in libwebp Critical 9.8
• CVE-2018-25014 Other in libwebp Critical 9.8
• CVE-2014-3585 Supply chain in redhat-upgrade-tool Critical 9.8

All Redhat Enterprise Linux vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ALPINE-CVE-2025-6021, AZL-64101, AZL-64124, BELL-CVE-2025-6021, BIT-java-2025-6021, BIT-java-min-2025-6021 and 18 more.