VYPR
← All advisories
High severityNVD Advisory· Published May 19, 2021· Updated Dec 2, 2025

CVE-2021-3517

CVE-2021-3517

Description

There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be processed by an application linked with the affected functionality of libxml2 could trigger an out-of-bounds read. The most likely impact of this flaw is to application availability, with some potential impact to confidentiality and integrity if an attacker is able to use memory information to further exploit the application.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

An out-of-bounds read vulnerability in libxml2 before 2.9.11 can cause denial of service and potential information disclosure via crafted XML input.

Vulnerability

A flaw exists in the xml entity encoding functionality of libxml2 in versions before 2.9.11. Specifically, xmlEncodeEntitiesInternal in entities.c does not properly handle truncated UTF-8 input, leading to an out-of-bounds read [1][4].

Exploitation

An attacker can supply a crafted XML file to an application that uses the affected libxml2 functionality. No authentication is required; the attack can be remote if the application processes untrusted XML. The vulnerability is triggered during entity encoding of the malicious input [1][4].

Impact

Successful exploitation results in an out-of-bounds read, which can cause a denial of service (application crash). Additionally, the read may expose sensitive memory contents, potentially impacting confidentiality and integrity, though the primary impact is on availability [1].

Mitigation

The issue is fixed in libxml2 version 2.9.11, released on 2021-05-13 [4]. Users should update to this version or later. For Red Hat Enterprise Linux 6 and 7, this flaw is out of support scope [4]. Nokogiri users should update to a version that includes the patched libxml2 [2][3].

References
  1. NVD - CVE-2021-3517
  2. GitHub - sparklemotion/nokogiri: Nokogiri (鋸) makes it easy and painless to work with XML and HTML from Ruby.
  3. Investigate libxml2 vulnerabilities patched in USN-4991-1
  4. Heap-based buffer overflow in xmlEncodeEntitiesInternal() in entities.c

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
nokogiriRubyGems
< 1.11.41.11.4

Affected products

46

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

24

News mentions

0

No linked articles in our index yet.