VYPR
← All advisories
Moderate severityNVD Advisory· Published May 14, 2021· Updated Aug 3, 2024

CVE-2021-3537

CVE-2021-3537

Description

A vulnerability found in libxml2 in versions before 2.9.11 shows that it did not propagate errors while parsing XML mixed content, causing a NULL dereference. If an untrusted XML document was parsed in recovery mode and post-validated, the flaw could be used to crash the application. The highest threat from this vulnerability is to system availability.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

libxml2 before 2.9.11 fails to propagate errors when parsing mixed XML content in recovery mode, leading to a NULL dereference that can crash the application.

Vulnerability

A vulnerability exists in libxml2 versions prior to 2.9.11 where the parser does not propagate errors while parsing XML mixed content. When an untrusted XML document is parsed in recovery mode and then post-validated, this flaw can trigger a NULL pointer dereference, causing the application to crash [3][1].

Exploitation

An attacker must provide a crafted XML document that triggers the mixed content parsing code path while the parser is in recovery mode. The application must also perform post-validation on the parsed document. No authentication or user interaction beyond delivering the malformed document is required; the exploit is remote and relies on the application processing the malicious input [3].

Impact

Successful exploitation results in a denial of service (DoS) due to application crash from the NULL pointer dereference. The highest threat is to system availability; there is no indication of information disclosure or remote code execution [3].

Mitigation

The flaw is fixed in libxml2 version 2.9.11. Users should update to this or a later version. No workarounds are documented. For projects that bundle libxml2, such as Nokogiri, upgrading to a version that includes the fix (e.g., Nokogiri v1.11.4) addresses the issue [1][3].

References
  1. Nokogiri Changelog - Nokogiri
  2. NVD - CVE-2021-3537

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
nokogiriRubyGems
< 1.11.41.11.4

Affected products

46

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

17

News mentions

0

No linked articles in our index yet.