CVE-2024-40896: Xmlsoft Libxml2 XML external entity (XXE) (CVSS 9.1)

Description

In libxml2 2.11 before 2.11.9, 2.12 before 2.12.9, and 2.13 before 2.13.3, the SAX parser can produce events for external entities even if custom SAX handlers try to override entity content (by setting "checked"). This makes classic XXE attacks possible.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

ScopeUnchanged

ConfidentialityNone

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Affected products

Netapp Solidfire & Hci Management Nodeall versions

Netapp Solidfire & Hci Storage Nodeall versions

Xmlsoft Libxml2≥ 2.11.0 < 2.11.9 · ≥ 2.12.0 < 2.12.9 · ≥ 2.13.0 < 2.13.3

Netapp H300s Firmwareall versions

Netapp H410c Firmwareall versions

Netapp H410s Firmwareall versions

Netapp H500s Firmwareall versions

Netapp H700s Firmwareall versions

Netapp Hci Compute Nodeall versions

Remediation

Fixed in

Xmlsoft Libxml2≥ 2.11.9

References

https://gitlab.gnome.org/GNOME/libxml2/-/commit/1a8932303969907f6572b1b6aac4081c56adb5c6Issue Tracking
https://gitlab.gnome.org/GNOME/libxml2/-/issues/761Issue Tracking
https://security.netapp.com/advisory/ntap-20250228-0004/Third Party Advisory

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2024-40896 being actively exploited?

CVE-2024-40896 is not in the CISA KEV catalog. Its EPSS exploit probability is 1.22%.

How severe is CVE-2024-40896?

CVE-2024-40896 has a CVSS 3.1 base score of 9.1, rated critical. EPSS estimates a 1.22% probability of exploitation.

Which products are affected by CVE-2024-40896?

Affected products include Netapp Solidfire & Hci Management Node, Netapp Solidfire & Hci Storage Node, Xmlsoft Libxml2, Netapp H300s Firmware, Netapp H410c Firmware, and 4 more.

How do I fix CVE-2024-40896?

Upgrade affected software to a fixed version, for example Xmlsoft Libxml2 2.11.9 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2024-40896 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo