{
  "threat_severity" : "Moderate",
  "public_date" : "2025-09-02T00:00:00Z",
  "bugzilla" : {
    "description" : "libxslt: libxml2: Inifinite recursion at exsltDynMapFunction function in libexslt/dynamic.c",
    "id" : "2392605",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2392605"
  },
  "cvss3" : {
    "cvss3_base_score" : "6.2",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-606",
  "details" : [ "Uncontrolled recursion in XPath evaluation in libxml2 up to and including version 2.9.14 allows a local attacker to cause a stack overflow via crafted expressions. XPath processing functions `xmlXPathRunEval`, `xmlXPathCtxtCompile`, and `xmlXPathEvalExpr` were resetting recursion depth to zero before making potentially recursive calls. When such functions were called recursively this could allow for uncontrolled recursion and lead to a stack overflow. These functions now preserve recursion depth across recursive calls, allowing recursion depth to be controlled.", "A flaw was found in libxstl/libxml2. The 'exsltDynMapFunction' function in libexslt/dynamic.c does not contain a recursion depth check, which may cause an infinite loop via a specially crafted XSLT document while handling 'dyn:map()', leading to stack exhaustion and a local denial of service." ],
  "statement" : "No evidence was found for arbitrary memory corruption through this flaw, limiting its impact to Availability only, and reducing its severity to Moderate.",
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2025-12-01T00:00:00Z",
    "advisory" : "RHSA-2025:22376",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "libxml2-0:2.9.13-14.el9_7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2025-12-01T00:00:00Z",
    "advisory" : "RHSA-2025:22376",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9",
    "package" : "libxml2-0:2.9.13-14.el9_7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions",
    "release_date" : "2025-11-26T00:00:00Z",
    "advisory" : "RHSA-2025:22177",
    "cpe" : "cpe:/a:redhat:rhel_e4s:9.0",
    "package" : "libxml2-0:2.9.13-1.el9_0.8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
    "release_date" : "2025-11-26T00:00:00Z",
    "advisory" : "RHSA-2025:22162",
    "cpe" : "cpe:/a:redhat:rhel_e4s:9.2",
    "package" : "libxml2-0:2.9.13-3.el9_2.10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.4 Extended Update Support",
    "release_date" : "2025-11-26T00:00:00Z",
    "advisory" : "RHSA-2025:22163",
    "cpe" : "cpe:/a:redhat:rhel_eus:9.4",
    "package" : "libxml2-0:2.9.13-13.el9_4"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.6 Extended Update Support",
    "release_date" : "2025-12-01T00:00:00Z",
    "advisory" : "RHSA-2025:22377",
    "cpe" : "cpe:/a:redhat:rhel_eus:9.6",
    "package" : "libxml2-0:2.9.13-12.el9_6.1"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4.13",
    "release_date" : "2026-01-22T00:00:00Z",
    "advisory" : "RHSA-2026:0677",
    "cpe" : "cpe:/a:redhat:openshift:4.13::el9",
    "package" : "rhcos-413.92.202601130113-0"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4.14",
    "release_date" : "2026-01-30T00:00:00Z",
    "advisory" : "RHSA-2026:0996",
    "cpe" : "cpe:/a:redhat:openshift:4.14::el9",
    "package" : "rhcos-414.92.202601191325-0"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4.15",
    "release_date" : "2026-02-05T00:00:00Z",
    "advisory" : "RHSA-2026:1541",
    "cpe" : "cpe:/a:redhat:openshift:4.15::el9",
    "package" : "rhcos-415.92.202601271320-0"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4.16",
    "release_date" : "2026-01-30T00:00:00Z",
    "advisory" : "RHSA-2026:0985",
    "cpe" : "cpe:/a:redhat:openshift:4.16::el9",
    "package" : "rhcos-416.94.202601160124-0"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4.17",
    "release_date" : "2026-01-22T00:00:00Z",
    "advisory" : "RHSA-2026:0702",
    "cpe" : "cpe:/a:redhat:openshift:4.17::el9",
    "package" : "rhcos-417.94.202601120213-0"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4.18",
    "release_date" : "2026-02-03T00:00:00Z",
    "advisory" : "RHSA-2026:0980",
    "cpe" : "cpe:/a:redhat:openshift:4.18::el9",
    "package" : "rhcos-418.94.202601202224-0"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4.19",
    "release_date" : "2026-02-04T00:00:00Z",
    "advisory" : "RHSA-2026:1539",
    "cpe" : "cpe:/a:redhat:openshift:4.19::el9",
    "package" : "rhcos-4.19.9.6.202601260820-0"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4.20",
    "release_date" : "2026-01-27T00:00:00Z",
    "advisory" : "RHSA-2026:0978",
    "cpe" : "cpe:/a:redhat:openshift:4.20::el9",
    "package" : "rhcos-4.20.9.6.202601211057-0"
  }, {
    "product_name" : "Red Hat AI Inference Server 3.2",
    "release_date" : "2025-12-15T00:00:00Z",
    "advisory" : "RHSA-2025:23202",
    "cpe" : "cpe:/a:redhat:ai_inference_server:3.2::el9",
    "package" : "rhaiis/model-opt-cuda-rhel9:sha256:f083e52ef4198ab8123c49eb044c4374ec996f65633d224bb8152ef0c3f30e7d"
  }, {
    "product_name" : "Red Hat AI Inference Server 3.2",
    "release_date" : "2025-12-15T00:00:00Z",
    "advisory" : "RHSA-2025:23204",
    "cpe" : "cpe:/a:redhat:ai_inference_server:3.2::el9",
    "package" : "rhaiis/vllm-cuda-rhel9:sha256:7b04c0154c486aa7dd103ddeaf6bea7b9851859c33a4b979a85261a44a7b77f2"
  }, {
    "product_name" : "Red Hat AI Inference Server 3.2",
    "release_date" : "2025-12-15T00:00:00Z",
    "advisory" : "RHSA-2025:23205",
    "cpe" : "cpe:/a:redhat:ai_inference_server:3.2::el9",
    "package" : "rhaiis/vllm-rocm-rhel9:sha256:e3b3efcdd86f60b90664a249d45918b2ac5f45bae5eed5399e310d63e878b287"
  }, {
    "product_name" : "Red Hat AI Inference Server 3.2",
    "release_date" : "2025-12-15T00:00:00Z",
    "advisory" : "RHSA-2025:23209",
    "cpe" : "cpe:/a:redhat:ai_inference_server:3.2::el9",
    "package" : "rhaiis/vllm-tpu-rhel9:sha256:64796b48c68d31973a08e22c9530c39b1bc3ba9f376bbefa57643ef0fc857534"
  }, {
    "product_name" : "Red Hat AI Inference Server 3.2",
    "release_date" : "2025-12-17T00:00:00Z",
    "advisory" : "RHSA-2025:23449",
    "cpe" : "cpe:/a:redhat:ai_inference_server:3.2::el9",
    "package" : "rhaiis/vllm-rocm-rhel9:sha256:c5efe40fa2a6e98d7d3d6676befff0dbbd87b2887769bb7e5856c5b0b0ada125"
  }, {
    "product_name" : "Red Hat AI Inference Server 3.2",
    "release_date" : "2026-02-27T00:00:00Z",
    "advisory" : "RHSA-2026:3461",
    "cpe" : "cpe:/a:redhat:ai_inference_server:3.2::el9",
    "package" : "rhaiis/vllm-cuda-rhel9:sha256:dcb9d1cd005c40b6db6f893e56419e383b9dcc0d38315605cb1457e2af5354f7"
  }, {
    "product_name" : "Red Hat AI Inference Server 3.2",
    "release_date" : "2026-02-27T00:00:00Z",
    "advisory" : "RHSA-2026:3462",
    "cpe" : "cpe:/a:redhat:ai_inference_server:3.2::el9",
    "package" : "rhaiis/vllm-rocm-rhel9:sha256:53007894763e03f609c35c727cb738db3c2130b19fa0e1069c24240e0870fb7a"
  }, {
    "product_name" : "Red Hat Ceph Storage 7",
    "release_date" : "2025-12-16T00:00:00Z",
    "advisory" : "RHSA-2025:23234",
    "cpe" : "cpe:/a:redhat:ceph_storage:7::el9",
    "package" : "rhceph/rhceph-7-rhel9:sha256:7ba9953f452becf20f89c2782fb5bf408bc96219ace5764943b78e07963cabf0"
  }, {
    "product_name" : "Red Hat Ceph Storage 8",
    "release_date" : "2025-12-16T00:00:00Z",
    "advisory" : "RHSA-2025:23227",
    "cpe" : "cpe:/a:redhat:ceph_storage:8::el9",
    "package" : "rhceph/rhceph-8-rhel9:sha256:6e64e0e65a871117cff35f0eba405b311ac1d6ec3ccc2621d61d3811a873e0b4"
  }, {
    "product_name" : "Red Hat Ceph Storage 8",
    "release_date" : "2026-02-02T00:00:00Z",
    "advisory" : "RHSA-2026:1652",
    "cpe" : "cpe:/a:redhat:ceph_storage:8::el9",
    "package" : "rhceph/rhceph-8-rhel9:sha256:09aaeba975aa74bdf95d63e5619c0cabb1cd9e1410aa34e7f8ecf24a5e291d1a"
  }, {
    "product_name" : "Red Hat Discovery 2",
    "release_date" : "2026-01-08T00:00:00Z",
    "advisory" : "RHSA-2026:0414",
    "cpe" : "cpe:/a:redhat:discovery:2::el9",
    "package" : "discovery/discovery-server-rhel9:sha256:75723049a444b5136e2d40920e2852f0840fecf60832a8bbb06e488fc9bba543"
  }, {
    "product_name" : "Red Hat Discovery 2",
    "release_date" : "2026-01-08T00:00:00Z",
    "advisory" : "RHSA-2026:0414",
    "cpe" : "cpe:/a:redhat:discovery:2::el9",
    "package" : "discovery/discovery-ui-rhel9:sha256:899bd7f941512d54af8ab369ca03028a7d27d05887ccce24bc12c7ccd3e4dbee"
  }, {
    "product_name" : "Red Hat Insights proxy 1.5",
    "release_date" : "2025-12-08T00:00:00Z",
    "advisory" : "RHSA-2025:22868",
    "cpe" : "cpe:/a:redhat:insights_proxy:1.5::el9",
    "package" : "insights-proxy/insights-proxy-container-rhel9:sha256:1d72e553fe5a7696e600dc8fd2fe9050ba1992fa190bea622134ca7bfce7bb0d"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "fix_state" : "Not affected",
    "package_name" : "libxml2",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Out of support scope",
    "package_name" : "libxml2",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Affected",
    "package_name" : "libxml2",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Affected",
    "package_name" : "libxml2",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat JBoss Core Services",
    "fix_state" : "Not affected",
    "package_name" : "libxml2",
    "cpe" : "cpe:/a:redhat:jboss_core_services:1"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2025-9714\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-9714\nhttps://gitlab.gnome.org/GNOME/libxml2/-/commit/677a42645ef22b5a50741bad5facf9d8a8bc6d21\nhttps://gitlab.gnome.org/GNOME/libxslt/-/issues/148" ],
  "name" : "CVE-2025-9714",
  "mitigation" : {
    "value" : "The impact of this flaw may be reduced by setting strict resource limits to the stack size of processes at the operational system level. This can be achieved either through the 'ulimit' shell built-in or the 'limits.conf' file.",
    "lang" : "en:us"
  },
  "csaw" : false
}