Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2021-3518

28
FAUCET Score

CVE-2021-3518 is a high-severity use-after-free vulnerability in libxml2 versions prior to 2.9.11, affecting products from vendors like Debian, Fedora, NetApp, Oracle, Red Hat, and xmlsoft. An unauthenticated attacker can exploit this flaw by submitting a specially crafted file, leading to complete compromise of confidentiality, integrity, and availability. The vulnerability has a CVSS score of 8.8 (High) due to its network attack vector and low attack complexity, requiring user interaction. While there is no known active exploitation, public exploit code, or Metasploit/Nuclei modules, the vulnerability has garnered significant community discussion and media coverage.

Impacted Technologies

VendorProductVersion(s)CPE
< 2.9.11CPE matchmatch criteria
cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:*
9.0CPE matchmatch criteria
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
Range not provided by sourceCPE matchmatch criteria
cpe:2.3:a:redhat:jboss_core_services:-:*:*:*:*:*:*:*
8.0CPE matchmatch criteria
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
33CPE matchmatch criteria
cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

8.8HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
Exploitability Score
2.8
Impact Score
5.9
CvssVersion
3.1

Exploit Intelligence

EPSS Score
3.65%
Probability of exploitation in next 30 days
EPSS Percentile
88.4%
Percentile rank of EPSS score among Peer Group
As of 2026-07-25
Model: v2026.06.15
This CVE's current EPSS score of 0.0365 is in the 87th percentile among its peer group of 14,848 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.1 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (45)

elasticpatch availablevia llm_extracted
Fixed in: ['8.1.13', '8.2.10', '9.0.4', '9.0.2209.3']
microsoftpatch availablevia msrc
Product: 19055-16820Fixed in: 2.9.12-1
microsoftpatch availablevia msrc
Product: cm1 libxml2 2.9.12-1 on CBL Mariner 1.0Fixed in: 2.9.12-1
oraclepatch availablevia nvd_reference
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services for RHEL 8Fixed in: jbcs-httpd24-httpd-0:2.4.37-80.el8jbcs
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services for RHEL 8Fixed in: jbcs-httpd24-mod_cluster-native-0:1.3.16-10.Final_redhat_2.el8jbcs
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services for RHEL 8Fixed in: jbcs-httpd24-mod_http2-0:1.15.7-22.el8jbcs
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services for RHEL 8Fixed in: jbcs-httpd24-mod_jk-0:1.2.48-29.redhat_1.el8jbcs
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services for RHEL 8Fixed in: jbcs-httpd24-mod_md-1:2.0.8-41.el8jbcs
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services for RHEL 8Fixed in: jbcs-httpd24-mod_security-0:2.9.2-68.GA.el8jbcs
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services for RHEL 8Fixed in: jbcs-httpd24-nghttp2-0:1.39.2-41.el8jbcs
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services for RHEL 8Fixed in: jbcs-httpd24-openssl-1:1.1.1g-11.el8jbcs
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services for RHEL 8Fixed in: jbcs-httpd24-openssl-chil-0:1.0.0-11.el8jbcs
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services for RHEL 8Fixed in: jbcs-httpd24-openssl-pkcs11-0:0.4.10-26.el8jbcs
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services on RHEL 7Fixed in: jbcs-httpd24-apr-util-0:1.6.1-91.jbcs.el7
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services on RHEL 7Fixed in: jbcs-httpd24-curl-0:7.78.0-3.jbcs.el7
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services on RHEL 7Fixed in: jbcs-httpd24-httpd-0:2.4.37-80.jbcs.el7
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services on RHEL 7Fixed in: jbcs-httpd24-mod_cluster-native-0:1.3.16-10.Final_redhat_2.jbcs.el7
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services on RHEL 7Fixed in: jbcs-httpd24-mod_http2-0:1.15.7-22.jbcs.el7
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services on RHEL 7Fixed in: jbcs-httpd24-mod_jk-0:1.2.48-29.redhat_1.jbcs.el7
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services on RHEL 7Fixed in: jbcs-httpd24-mod_md-1:2.0.8-41.jbcs.el7
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services on RHEL 7Fixed in: jbcs-httpd24-mod_security-0:2.9.2-68.GA.jbcs.el7
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services on RHEL 7Fixed in: jbcs-httpd24-nghttp2-0:1.39.2-41.jbcs.el7
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services on RHEL 7Fixed in: jbcs-httpd24-openssl-1:1.1.1g-11.jbcs.el7
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services on RHEL 7Fixed in: jbcs-httpd24-openssl-chil-0:1.0.0-11.jbcs.el7
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services on RHEL 7Fixed in: jbcs-httpd24-openssl-pkcs11-0:0.4.10-26.jbcs.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: libxml2-0:2.9.7-9.el8_4.2
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Migration Toolkit for Containers 1.4Fixed in: rhmtc/openshift-migration-controller-rhel8:v1.4.6-4
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Migration Toolkit for Containers 1.4Fixed in: rhmtc/openshift-migration-log-reader-rhel8:v1.4.6-4
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Migration Toolkit for Containers 1.4Fixed in: rhmtc/openshift-migration-must-gather-rhel8:v1.4.6-4
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Migration Toolkit for Containers 1.4Fixed in: rhmtc/openshift-migration-operator-bundle:v1.4.6-5
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Migration Toolkit for Containers 1.4Fixed in: rhmtc/openshift-migration-registry-rhel8:v1.4.6-4
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Migration Toolkit for Containers 1.4Fixed in: rhmtc/openshift-migration-rsync-transfer-rhel8:v1.4.6-4
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Migration Toolkit for Containers 1.4Fixed in: rhmtc/openshift-migration-ui-rhel8:v1.4.6-4
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Migration Toolkit for Containers 1.4Fixed in: rhmtc/openshift-migration-velero-plugin-for-aws-rhel8:v1.4.6-4
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Migration Toolkit for Containers 1.4Fixed in: rhmtc/openshift-migration-velero-plugin-for-gcp-rhel8:v1.4.6-3
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Migration Toolkit for Containers 1.4Fixed in: rhmtc/openshift-migration-velero-plugin-for-microsoft-azure-rhel8:v1.4.6-4
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Migration Toolkit for Containers 1.4Fixed in: rhmtc/openshift-migration-velero-rhel8:v1.4.6-5
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Migration Toolkit for Containers 1.4Fixed in: rhmtc/openshift-velero-plugin-rhel8:v1.4.6-4
View patch
redhatpatch availablevia redhat_api
Product: Text-Only JBCSFixed in: libxml2
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Migration Toolkit for Containers 1.4Fixed in: rhmtc/openshift-migration-velero-restic-restore-helper-rhel8:v1.4.6-5
View patch
redhatpatch availablevia nvd_reference
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services for RHEL 8Fixed in: jbcs-httpd24-apr-util-0:1.6.1-91.el8jbcs
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services for RHEL 8Fixed in: jbcs-httpd24-curl-0:7.78.0-3.el8jbcs
View patch
rubygemspatch availablevia ghsa
Product: nokogiriFixed in: 1.11.4

Vendor Advisories (4)

elasticllm-elastic-1862d04bb8fb6af4HIGH

February Third Party Package Updates in Splunk Enterprise

Feb 14, 2023
rubygemsGHSA-v4f8-2847-rwm7high

Nokogiri Implements libxml2 version vulnerable to use-after-free

May 24, 2022
microsoft2021-May/CVE-2021-3518Important

There's a flaw in libxml2 in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by an application linked with libxml2 could trigger a use-after-free. The greatest impact from this flaw is to confidentiality integrity and availability.

May 11, 2021
redhatCVE-2021-3518Moderate

libxml2: Use-after-free in xmlXIncludeDoProcess() in xinclude.c

Apr 22, 2021

References

bugzilla.redhat.com / show_bug.cgi
Issue TrackingPatchThird Party Advisory
seclists.org / fulldisclosure/2021/Jul/54
Mailing ListThird Party Advisory
seclists.org / fulldisclosure/2021/Jul/55
Mailing ListThird Party Advisory
seclists.org / fulldisclosure/2021/Jul/58
Mailing ListThird Party Advisory
seclists.org / fulldisclosure/2021/Jul/59
Mailing ListThird Party Advisory
lists.apache.org / thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
lists.apache.org / thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
lists.debian.org / debian-lts-announce/2021/05/msg00008.html
Mailing ListThird Party Advisory
lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/BZOMV5J4PMZAORVT64BKLV6YIZAFDGX6
lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/QVM4UJ3376I6ZVOYMHBNX4GY3NIV52WV
security.gentoo.org / glsa/202107-05
Third Party Advisory
security.netapp.com / advisory/ntap-20210625-0002
Third Party Advisory
support.apple.com / kb/HT212601
Third Party Advisory
support.apple.com / kb/HT212602
Third Party Advisory
support.apple.com / kb/HT212604
Third Party Advisory
support.apple.com / kb/HT212605
Third Party Advisory
oracle.com / security-alerts/cpuapr2022.html
PatchThird Party Advisory
oracle.com / security-alerts/cpujul2022.html
Not Applicable
oracle.com / security-alerts/cpuoct2021.html
PatchThird Party Advisory