VYPR
← All advisories
High severityNVD Advisory· Published Jan 21, 2020· Updated Dec 3, 2025

CVE-2020-7595

CVE-2020-7595

Description

xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

libxml2 2.9.10 contains an infinite loop in xmlStringLenDecodeEntities when parsing XML at end-of-file, enabling denial-of-service attacks.

Vulnerability

Overview

CVE-2020-7595 is a denial-of-service vulnerability in libxml2 versions up to 2.9.10. The flaw exists in the xmlStringLenDecodeEntities function within parser.c, where the parser enters an infinite loop when processing a certain end-of-file scenario [1]. This is classified as CWE-835 (Loop with Unreachable Exit Condition) [3].

Exploitation

The vulnerability can be triggered remotely without authentication by supplying a specially crafted XML document. The attack complexity is low, and no user interaction is required [3]. Products that use libxml2 for XML parsing, such as the Ruby library Nokogiri and Siemens SINEMA Remote Connect Server, are affected [2][3].

Impact

Successful exploitation leads to an infinite loop that consumes CPU resources, causing a denial-of-service condition. Under CVSS v3.0, this vulnerability is rated 7.5 (High) with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating no impact on confidentiality or integrity but high availability impact [1][3].

Mitigation

Siemens has addressed the issue in SINEMA Remote Connect Server v3.0 [3]. Users of libxml2 should upgrade to a patched version; distributions and downstream projects (e.g., Nokogiri) have released security updates [2][4]. No workaround is reported.

References
  1. NVD - CVE-2020-7595
  2. GitHub - sparklemotion/nokogiri: Nokogiri (鋸) makes it easy and painless to work with XML and HTML from Ruby.
  3. Siemens SINEMA Remote Connect Server | CISA
  4. ruby-advisory-db/gems/nokogiri/CVE-2020-7595.yml at master · rubysec/ruby-advisory-db

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
nokogiriRubyGems
< 1.10.81.10.8

Affected products

230

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

24

News mentions

0

No linked articles in our index yet.