numbers.c in libxslt before 1.1.43 has a use-after-free because, in nested XPath evaluations, an XPath context node can be modified but never restored. This is related to xsltNumberFormatGetValue, xsltEvalXPathPredicate, xsltEvalXPathStringNs, and xsltComputeSortResultInternal.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Adoptopenjdk | — | Upgrade to the latest version of AdoptOpenJDK | Feb 24, 2026 | Feb 24, 2026 |
| Alma_linux | — | Upgrade libxslt-develUpgrade libxslt | Mar 26, 2025 | Mar 14, 2025 |
| Alpine Linux | — | Upgrade qt5-qtwebengineUpgrade qt6-qtwebengineUpgrade libxslt | Aug 8, 2025 | Mar 14, 2025 |
| Amazon Linux Ami 2 | — | Upgrade libxslt-pythonUpgrade libxslt-debuginfoUpgrade libxslt-develUpgrade libxslt | Apr 17, 2025 | Mar 14, 2025 |
| Amazon_linux | — | Upgrade libxslt | Apr 18, 2025 | Mar 14, 2025 |
| Amazon_linux_2023 | — | Upgrade libxslt-develUpgrade python3-libxslt-debuginfoUpgrade libxslt-debugsourceUpgrade libxslt-debuginfoUpgrade libxsltUpgrade python3-libxslt | Apr 2, 2025 | Mar 14, 2025 |
| Apple Osx Libxslt | — | Upgrade macOS to the latest version | May 20, 2025 | Mar 14, 2025 |
| Azul Zulu | — | Upgrade to Azul Zulu JDK 8 installer 8.87.0.16 (JDK 8u461-b01, quarterly CPU) (LTS stream)Upgrade to Azul Zulu JDK 17 installer 17.59.16 (JDK 17.0.15.0.101+1, quarterly CPU) (LTS stream)Upgrade to Azul Zulu JDK 21 installer 21.43.16 (JDK 21.0.7.0.101+1, quarterly CPU) (LTS stream)Upgrade to Azul Zulu JDK 11 installer 11.81.16 (JDK 11.0.27.0.101+1, quarterly CPU) (LTS stream)Apply Azul Zulu JDK 24 installer 24.32.13 (JDK 24.0.2+11, PSU) (short-term support); migrate to JDK 25 (LTS) | Feb 25, 2026 | Mar 14, 2025 |
| Debian | — | Upgrade libxslt | Mar 25, 2025 | Mar 14, 2025 |
| Dell Powerstore Dsa2025342 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Sep 2, 2025 |
| Dell Powerstore Dsa2026039 | — | Upgrade Dell PowerStoreOS to the latest version | Jan 13, 2026 | Jan 6, 2026 |
| Eclipseadoptium | — | — | Jun 26, 2026 | Mar 14, 2025 |
| Freebsd | — | Upgrade libxslt | May 15, 2025 | May 13, 2025 |
| Huawei Euleros 2_0_sp10 | — | Upgrade libxslt | May 13, 2025 | Mar 14, 2025 |
| Huawei Euleros 2_0_sp11 | — | Upgrade libxslt | Jun 13, 2025 | Mar 14, 2025 |
| Huawei Euleros 2_0_sp12 | — | Upgrade libxslt | Jun 11, 2025 | Mar 14, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade libxslt | Jun 11, 2025 | Mar 14, 2025 |
| Jre Vuln | — | Upgrade to the latest version of Oracle Java | Jul 18, 2025 | Mar 14, 2025 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Aug 22, 2025 |
| Oracle_linux | — | Upgrade libxslt-pythonUpgrade libxslt-develUpgrade libxslt | Mar 26, 2025 | Mar 14, 2025 |
| Redhat Openshift | — | Upgrade rhcos | May 12, 2025 | Mar 14, 2025 |
| Redhat_linux | — | Upgrade libxslt-debugsourceUpgrade libxslt-develUpgrade libxsltUpgrade libxslt-pythonUpgrade libxslt-debuginfoNo solution exists | Mar 25, 2025 | Mar 14, 2025 |
| Rocky_linux | — | Upgrade libxslt-debuginfoUpgrade libxsltUpgrade libxslt-debugsourceUpgrade libxslt-devel | Jul 31, 2025 | Jul 29, 2025 |
| Suse | — | Upgrade libxslt1Upgrade libxslt1-32bitUpgrade libxslt-devel-32bitUpgrade libxslt-develUpgrade libexslt0Upgrade libxslt-toolsUpgrade libxslt-python | Dec 5, 2025 | Mar 26, 2025 |
| Ubuntu | — | Upgrade libxslt1.1Upgrade libxslt1.1 (Ubuntu Pro)Upgrade xsltproc (Ubuntu Pro) | Mar 21, 2025 | Mar 14, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 2, 2025 | Mar 14, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub