How many CVEs have a located fix in debian/libxml2?

21 published CVEs have a fix traced to functions in debian/libxml2, touching 9 functions across 12 files.

Which function in debian/libxml2 has been patched by the most CVEs?

xmlGROW in parser.c has been changed by 2 CVE fixes, from 2017 to 2017.

How large is a typical CVE fix in debian/libxml2?

The median fix changes 20 lines. 57% of fixes change 20 lines or fewer, and 57% change a single function.

How is a fix located to a function?

The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

RadicalNotion.AI

Log in Create an account

c

#249 of 500 repositories

debian/libxml2

Name: debian/libxml2: functions patched by CVE fixes
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

Functions and files changed by CVE fixes in this repository.

Latest located fix February 2, 2026

21

CVE fixes located

Published CVEs

9

Functions patched

Distinct function sites

12

Files patched

Distinct source files

2013–2026

Years covered

By CVE publication date

Overview

21 published CVEs have a fix traced to functions in debian/libxml2, the earliest published in 2013. Those fixes changed 9 distinct functions across 12 files, in 84 patch hunks.

Among the 500 repositories tracked here, debian/libxml2 ranks #249 by the number of CVEs with a located fix.

Most patched functions

Functions in debian/libxml2 changed by the most CVE fixes.

Most patched files

Files in debian/libxml2 changed by the most CVE fixes.

1parser.c8 CVEs · 4 functions
2valid.c5 CVEs · 0 functions
3tree.c2 CVEs · 2 functions
4xmlschemas.c2 CVEs · 1 functions
5include/libxml/parser.h2 CVEs · 0 functions
6parserInternals.c2 CVEs · 0 functions
7runtest.c2 CVEs · 0 functions
8schematron.c2 CVEs · 0 functions
9xpath.c1 CVEs · 1 functions
10xpointer.c1 CVEs · 1 functions

Fix size

How much code a CVE fix in debian/libxml2 changes, with backports counted once.

20

Median lines changed

Added plus removed, per CVE

57%

Fixes of 20 lines or fewer

Share of CVE fixes

57%

Fixes in a single function

Share of CVE fixes

Latest CVEs

The most recently published CVEs with a fix located in debian/libxml2, and the functions each fix changed.

Libxml2: memory leak leading to local denial of service in xmllint interactive shell
CVE-2026-1757
Medium · CVSS 6.2
EPSS 0.2%2026-02-02
Libxml: heap use after free (uaf) leads to denial of service (dos)
CVE-2025-49794
Critical · CVSS 9.1
EPSS 0.8%2025-06-16
Libxml: type confusion leads to denial of service (dos)
CVE-2025-49796
Critical · CVSS 9.1
EPSS 1.6%2025-06-16
Libxml2: integer overflow in xmlbuildqname() leads to stack buffer overflow in libxml2
CVE-2025-6021xmlGetParameterEntityFromDtd
High · CVSS 7.5
EPSS 1.4%2025-06-12
CVE-2024-56171
CVE-2024-56171
Critical · CVSS 9.8
EPSS 1.2%2025-02-18
CVE-2025-24928
CVE-2025-24928
High · CVSS 7.8
EPSS 0.4%2025-02-18
CVE-2023-45322
CVE-2023-45322xmlStaticCopyNodeList
Medium · CVSS 6.5
EPSS 1.0%2023-10-06
CVE-2023-39615
CVE-2023-39615xmlDetectSAX2
Medium · CVSS 6.5
EPSS 1.1%2023-08-29
libxml as used in Nokogiri has an infinite loop in a certain end-of-file situation
CVE-2020-7595
High · CVSS 7.5
EPSS 7.8%2020-01-21
CVE-2019-20388
CVE-2019-20388xmlSchemaPreRun
High · CVSS 7.5
EPSS 3.2%2020-01-21
CVE-2017-0663
CVE-2017-0663
High · CVSS 7.8
EPSS 2.3%2017-06-14
Out-of-bounds read in nokogiri
CVE-2017-9050xmlGROW
High · CVSS 7.5
EPSS 4.6%2017-05-18

Get an alert for each new debian/libxml2 CVE, with the patched functions and AI-written analysis.

Monitor libxml2 CVEs

Other repositories

Repositories with a similar number of located CVE fixes.

debian/libvirt21 CVEs ethyca/fides21 CVEs flatpressblog/flatpress21 CVEs francoisjacquet/rosariosis21 CVEs FreshRSS/FreshRSS21 CVEs huggingface/transformers21 CVEs ILIAS-eLearning/ILIAS21 CVEs instantsoft/icms221 CVEs

Browse all repositories

Frequently asked questions

Common questions about CVE fixes in debian/libxml2.

How many CVEs have a located fix in debian/libxml2?: 21 published CVEs have a fix traced to functions in debian/libxml2, touching 9 functions across 12 files.
Which function in debian/libxml2 has been patched by the most CVEs?: xmlGROW in parser.c has been changed by 2 CVE fixes, from 2017 to 2017.
How large is a typical CVE fix in debian/libxml2?: The median fix changes 20 lines. 57% of fixes change 20 lines or fewer, and 57% change a single function.
How is a fix located to a function?: The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

References

Fix locations are computed by RadicalNotion.AI from the upstream patch diff of each CVE. CVE data is sourced from the CVE Program.

Track debian/libxml2 CVEs

Get an alert when a new CVE lands in this repository, with the patched functions and AI-written remediation guidance.

Create an account See pricing