CVE-2017-16932
parser.c in libxml2 before 2.9.5 does not prevent infinite recursion in parameter entities.
CVSS
7.5
High
EPSS
6.5%
p94
KEV
—
Exploit Today
28
0-100
Published: Nov 23, 2017 · Last modified: Oct 14, 2026 · CWE-835
5.9%EPSS · 30 days6.5%
2026-10-042026-10-31
parser.c in libxml2 before 2.9.5 does not prevent infinite recursion in parameter entities.
- xmlsoft.orghttp://xmlsoft.org/news.html
- blog.clamav.nethttps://blog.clamav.net/2018/07/clamav-01001-has-been-released.html
- bugzilla.gnome.orghttps://bugzilla.gnome.org/show_bug.cgi?id=759579
- github.comhttps://github.com/GNOME/libxml2/commit/899a5d9f0ed13b8e32449a08a361e0de127dd961
- gitlab.gnome.orghttps://gitlab.gnome.org/GNOME/libxml2/-/commit/899a5d9f0ed13b8e32449a08a361e0de127dd961
- lists.apache.orghttps://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E
- lists.apache.orghttps://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E
- lists.debian.orghttps://lists.debian.org/debian-lts-announce/2017/11/msg00041.html
- lists.debian.orghttps://lists.debian.org/debian-lts-announce/2022/04/msg00004.html
- usn.ubuntu.comhttps://usn.ubuntu.com/3739-1/
- xmlsoft.orghttp://xmlsoft.org/news.html
- blog.clamav.nethttps://blog.clamav.net/2018/07/clamav-01001-has-been-released.html
- bugzilla.gnome.orghttps://bugzilla.gnome.org/show_bug.cgi?id=759579
- github.comhttps://github.com/GNOME/libxml2/commit/899a5d9f0ed13b8e32449a08a361e0de127dd961
- lists.apache.orghttps://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
- lists.apache.orghttps://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
- lists.debian.orghttps://lists.debian.org/debian-lts-announce/2017/11/msg00041.html
- lists.debian.orghttps://lists.debian.org/debian-lts-announce/2022/04/msg00004.html
- usn.ubuntu.comhttps://usn.ubuntu.com/3739-1/
- cert-portal.siemens.comhttps://cert-portal.siemens.com/productcert/html/ssa-398330.html
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-1202515.5 MED—
——0imagecodecs 2026.3.6 through 2026.10.10 contains an infinite loop vulnerability in ccitt_fax4_decode_size() that allows attackers to hang the calling process by supplying a crafted CCITT Group 4 stream. Attackers can provide an 8-byte G4 stream lacking EOFB to ccittfax4_decode() or the numcodecs Ccittfax4 codec, consuming full CPU until the process is killed.1dCVE-2026-1201947.5 HIG—
——0A flaw was found in json-glib. The JSONPath slice evaluator used by json_path_query() can enter an infinite loop when given a slice expression with a negative step. An application that evaluates attacker-controlled JSONPath expressions can be forced into a hang, leading to a denial of service.5hCVE-2026-622505.5 MED5.8%
——2LibreDWG is a free C library to read and write DWG files. Prior to 0.14.8413, a crafted pre-R13 DWG can make `decode_preR13_entities()` in `src/decode.c` enter a nonterminating loop that allocates a new object each iteration. `decode_preR13` in `src/decode_r11.c` computes `size` from the raw file-controlled `entities_start` and `entities_end` header bounds; the callee clamps `end` to `dat->size` but never recalculates `size`. At `end` of input, `bit_read_RC` and `bit_read_RS` stop advancing `dat->byte`, the overflow guard fails because `end` equals `dat->size`, and the no-advance check compares against `oldpos` saved before the loop instead of the previous iteration. This leaves repeated allocation of `dwg->object` entries until allocation fails or the process is OOM-killed, not merely a constant-memory CPU hang. The defect remains after the clamping and no-progress changes associated with the earlier issue 1131. Applications and tools calling `dwg_read_file()` on untrusted files, including `dwg2dxf`, `dwgread` and `dwg2svg`, can suffer denial of service when a user or automated pipeline opens a malformed file; no attacker credentials are required. This issue is fixed in repository nightly version 0.14.8413.2dCVE-2026-119205—23.2%
——7pypdf is a free and open-source pure-python PDF library. Prior to 6.21.4, pypdf can enter an infinite loop when cloning or duplicating a crafted cyclic DictionaryObject. Clone traversal checked generated destination references rather than the original source references, allowing some source cycles to evade the visited-object check. This issue is fixed in version 6.21.4.3dCVE-2026-119203—23.2%
——7pypdf is a free and open-source pure-python PDF library. Prior to 6.21.4, pypdf can enter an infinite loop while opening a crafted incomplete PDF whose standard cross-reference table reaches the end of the file without a trailer. The trailer search can repeatedly rewind to the same stream position instead of terminating when parsing makes no progress, blocking the processing thread. This issue is fixed in version 6.21.4.3dCVE-2026-1187812.9 LOW1.7%
——1Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used BigInteger.prototype.modInverse(), bnModInverse(), lib/jsbn.js, RSA public exponent e to process the relevant input or security decision. node-forge's bundled jsbn implementation entered an infinite loop when BigInteger.prototype.modInverse() received a negative value or modulus. An attacker who could control the RSA public exponent passed to key generation, or a direct modInverse() operand, could block the Node.js event loop at full CPU. Parsed DER, PEM, JWK, PKCS#12, X.509, and TLS values are unsigned and cannot trigger this issue. This issue is fixed in version 1.4.1.3d