High severity8.8NVD Advisory· Published May 18, 2021· Updated Jun 17, 2026

CVE-2021-3518

Description

There's a flaw in libxml2 in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by an application linked with libxml2 could trigger a use-after-free. The greatest impact from this flaw is to confidentiality, integrity, and availability.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
nokogiriRubyGems	< 1.11.4	1.11.4

Affected products

NetApp/Active Iq Unified Manager
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*
NetApp/Clustered Data Ontap
cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:*
NetApp/Clustered Data Ontap Antivirus Connector
cpe:2.3:a:netapp:clustered_data_ontap_antivirus_connector:-:*:*:*:*:*:*:*
NetApp/Manageability Software Development Kit
cpe:2.3:a:netapp:manageability_software_development_kit:-:*:*:*:*:*:*:*
NetApp/Ontap Select Deploy Administration Utility
cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*
NetApp/Snapdrive
cpe:2.3:a:netapp:snapdrive:-:*:*:*:*:windows:*:*
Oracle Corporation/Communications Cloud Native Core Network Function Cloud Native Environment
cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:1.10.0:*:*:*:*:*:*:*
Oracle Corporation/Enterprise Manager Base Platform2 versions
cpe:2.3:a:oracle:enterprise_manager_base_platform:13.4.0.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:oracle:enterprise_manager_base_platform:13.4.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:enterprise_manager_base_platform:13.5.0.0:*:*:*:*:*:*:*
Oracle Corporation/Enterprise Manager Ops Center
cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0.0:*:*:*:*:*:*:*
Oracle Corporation/Mysql Workbench
cpe:2.3:a:oracle:mysql_workbench:*:*:*:*:*:*:*:*
Range: <=8.0.26
Oracle Corporation/Peoplesoft Enterprise Peopletools
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*
Oracle Corporation/Real User Experience Insight2 versions
cpe:2.3:a:oracle:real_user_experience_insight:13.4.1.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:oracle:real_user_experience_insight:13.4.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:real_user_experience_insight:13.5.1.0:*:*:*:*:*:*:*
Red Hat/Jboss Core Services
cpe:2.3:a:redhat:jboss_core_services:-:*:*:*:*:*:*:*
Xmlsoft/Libxml2
cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:*
Range: <2.9.11
Debian/linux
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
Fedoraproject/Fedora2 versions
cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
NetApp/Hci H410c Firmware
cpe:2.3:o:netapp:hci_h410c_firmware:-:*:*:*:*:*:*:*
Red Hat/Enterprise Linux Server
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
libxml2/libxml2description
ghsa-coords45 versions
pkg:gem/nokogiri pkg:rpm/almalinux/libxml2-devel pkg:rpm/opensuse/libxml2&distro=openSUSE%20Leap%2015.2 pkg:rpm/opensuse/libxml2&distro=openSUSE%20Tumbleweed pkg:rpm/opensuse/python-libxml2-python&distro=openSUSE%20Leap%2015.2 pkg:rpm/opensuse/ruby3.2-rubygem-nokogiri&distro=openSUSE%20Tumbleweed pkg:rpm/opensuse/rubygem-nokogiri&distro=openSUSE%20Tumbleweed pkg:rpm/suse/libxml2&distro=HPE%20Helion%20OpenStack%208 pkg:rpm/suse/libxml2&distro=SUSE%20Linux%20Enterprise%20Micro%205.0 pkg:rpm/suse/libxml2&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP2 pkg:rpm/suse/libxml2&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP3 pkg:rpm/suse/libxml2&distro=SUSE%20Linux%20Enterprise%20Point%20of%20Sale%2011%20SP3 pkg:rpm/suse/libxml2&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4-LTSS pkg:rpm/suse/libxml2&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-BCL pkg:rpm/suse/libxml2&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3-BCL pkg:rpm/suse/libxml2&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3-LTSS pkg:rpm/suse/libxml2&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP4-LTSS pkg:rpm/suse/libxml2&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5 pkg:rpm/suse/libxml2&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP3 pkg:rpm/suse/libxml2&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP4 pkg:rpm/suse/libxml2&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP5 pkg:rpm/suse/libxml2&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP5 pkg:rpm/suse/libxml2&distro=SUSE%20OpenStack%20Cloud%208 pkg:rpm/suse/libxml2&distro=SUSE%20OpenStack%20Cloud%209 pkg:rpm/suse/libxml2&distro=SUSE%20OpenStack%20Cloud%20Crowbar%208 pkg:rpm/suse/libxml2&distro=SUSE%20OpenStack%20Cloud%20Crowbar%209 pkg:rpm/suse/libxml2-python&distro=SUSE%20Linux%20Enterprise%20Point%20of%20Sale%2011%20SP3 pkg:rpm/suse/libxml2-python&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4-LTSS pkg:rpm/suse/python-libxml2&distro=HPE%20Helion%20OpenStack%208 pkg:rpm/suse/python-libxml2&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-BCL pkg:rpm/suse/python-libxml2&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3-BCL pkg:rpm/suse/python-libxml2&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3-LTSS pkg:rpm/suse/python-libxml2&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP4-LTSS pkg:rpm/suse/python-libxml2&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5 pkg:rpm/suse/python-libxml2&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP3 pkg:rpm/suse/python-libxml2&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP4 pkg:rpm/suse/python-libxml2&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP5 pkg:rpm/suse/python-libxml2&distro=SUSE%20OpenStack%20Cloud%208 pkg:rpm/suse/python-libxml2&distro=SUSE%20OpenStack%20Cloud%209 pkg:rpm/suse/python-libxml2&distro=SUSE%20OpenStack%20Cloud%20Crowbar%208 pkg:rpm/suse/python-libxml2&distro=SUSE%20OpenStack%20Cloud%20Crowbar%209 pkg:rpm/suse/python-libxml2-python&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP2 pkg:rpm/suse/python-libxml2-python&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP3 pkg:rpm/suse/python-libxml2-python&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Python%202%2015%20SP2 pkg:rpm/suse/python-libxml2-python&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Python%202%2015%20SP3
< 1.11.4+ 44 more
- (no CPE)range: < 1.11.4
- (no CPE)range: < 2.9.7-9.el8_4.2
- (no CPE)range: < 2.9.7-lp152.10.9.1
- (no CPE)range: < 2.9.12-1.2
- (no CPE)range: < 2.9.7-lp152.10.9.1
- (no CPE)range: < 1.13.9-1.7
- (no CPE)range: < 1.13.3-1.1
- (no CPE)range: < 2.9.4-46.43.1
- (no CPE)range: < 2.9.7-3.31.1
- (no CPE)range: < 2.9.7-3.31.1
- (no CPE)range: < 2.9.7-3.31.1
- (no CPE)range: < 2.7.6-0.77.36.1
- (no CPE)range: < 2.7.6-0.77.36.1
- (no CPE)range: < 2.9.4-46.43.1
- (no CPE)range: < 2.9.4-46.43.1
- (no CPE)range: < 2.9.4-46.43.1
- (no CPE)range: < 2.9.4-46.43.1
- (no CPE)range: < 2.9.4-46.40.1
- (no CPE)range: < 2.9.4-46.43.1
- (no CPE)range: < 2.9.4-46.43.1
- (no CPE)range: < 2.9.4-46.40.1
- (no CPE)range: < 2.9.4-46.40.1
- (no CPE)range: < 2.9.4-46.43.1
- (no CPE)range: < 2.9.4-46.43.1
- (no CPE)range: < 2.9.4-46.43.1
- (no CPE)range: < 2.9.4-46.43.1
- (no CPE)range: < 2.7.6-0.77.36.1
- (no CPE)range: < 2.7.6-0.77.36.1
- (no CPE)range: < 2.9.4-46.43.1
- (no CPE)range: < 2.9.4-46.43.1
- (no CPE)range: < 2.9.4-46.43.1
- (no CPE)range: < 2.9.4-46.43.1
- (no CPE)range: < 2.9.4-46.43.1
- (no CPE)range: < 2.9.4-46.40.1
- (no CPE)range: < 2.9.4-46.43.1
- (no CPE)range: < 2.9.4-46.43.1
- (no CPE)range: < 2.9.4-46.40.1
- (no CPE)range: < 2.9.4-46.43.1
- (no CPE)range: < 2.9.4-46.43.1
- (no CPE)range: < 2.9.4-46.43.1
- (no CPE)range: < 2.9.4-46.43.1
- (no CPE)range: < 2.9.7-3.31.1
- (no CPE)range: < 2.9.7-3.31.1
- (no CPE)range: < 2.9.7-3.31.1
- (no CPE)range: < 2.9.7-3.31.1

Patches

Vulnerability mechanics

References

bugzilla.redhat.com/show_bug.cginvdIssue TrackingPatchThird Party AdvisoryWEB
www.oracle.com/security-alerts/cpuapr2022.htmlnvdPatchThird Party AdvisoryWEB
www.oracle.com/security-alerts/cpuoct2021.htmlnvdPatchThird Party AdvisoryWEB
seclists.org/fulldisclosure/2021/Jul/54nvdMailing ListThird Party AdvisoryWEB
seclists.org/fulldisclosure/2021/Jul/55nvdMailing ListThird Party AdvisoryWEB
seclists.org/fulldisclosure/2021/Jul/58nvdMailing ListThird Party AdvisoryWEB
seclists.org/fulldisclosure/2021/Jul/59nvdMailing ListThird Party AdvisoryWEB
github.com/advisories/GHSA-v4f8-2847-rwm7ghsaADVISORY
lists.debian.org/debian-lts-announce/2021/05/msg00008.htmlnvdMailing ListThird Party AdvisoryWEB
nvd.nist.gov/vuln/detail/CVE-2021-3518ghsaADVISORY
security.gentoo.org/glsa/202107-05nvdThird Party AdvisoryWEB
security.netapp.com/advisory/ntap-20210625-0002/nvdThird Party Advisory
support.apple.com/kb/HT212601nvdThird Party AdvisoryWEB
support.apple.com/kb/HT212602nvdThird Party AdvisoryWEB
support.apple.com/kb/HT212604nvdThird Party AdvisoryWEB
support.apple.com/kb/HT212605nvdThird Party AdvisoryWEB
github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2021-3518.ymlghsaWEB
github.com/sparklemotion/nokogiri/blob/2edbbef95f1dc12c1ddc5ebda71b9159026245fe/CHANGELOG.mdghsaWEB
lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3EghsaWEB
lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3EghsaWEB
lists.fedoraproject.org/archives/list/[email protected]/message/BZOMV5J4PMZAORVT64BKLV6YIZAFDGX6ghsaWEB
lists.fedoraproject.org/archives/list/[email protected]/message/QVM4UJ3376I6ZVOYMHBNX4GY3NIV52WVghsaWEB
nokogiri.org/CHANGELOG.htmlghsaWEB
security.netapp.com/advisory/ntap-20210625-0002ghsaWEB
www.oracle.com/security-alerts/cpujul2022.htmlnvdNot ApplicableWEB
lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3Envd
lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3Envd
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BZOMV5J4PMZAORVT64BKLV6YIZAFDGX6/nvd
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QVM4UJ3376I6ZVOYMHBNX4GY3NIV52WV/nvd

News mentions

No linked articles in our index yet.

cvss	0.572
epss	0.003
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000