Skip to content
Heist/ feed
Back to feed
Medium

Security advisory

Type: advisorySources: OSVCVE: CVE-2023-29469

An issue was discovered in libxml2 before 2.10.4. When hashing empty dict strings in a crafted XML document, xmlDictComputeFastKey in dict.c can produce non-deterministic values, leading to various logic and memory errors, such as a double free. This behavior occurs because there is an attempt to use the first byte of an empty string, and any value is possible (not solely the '\0' value).

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2023-29469
Confirmed fixed CVEs
Not specified
Updated in this feed
7 Nov 2026, 21:15 UTC · Revision 1

Source evidence

CVE-2023-29469

core-osv · Original source

Published 24 Apr 2023, 00:00 UTC

An issue was discovered in libxml2 before 2.10.4. When hashing empty dict strings in a crafted XML document, xmlDictComputeFastKey in dict.c can produce non-deterministic values, leading to various logic and memory errors, such as a double free. This behavior occurs because there is an attempt to use the first byte of an empty string, and any value is possible (not solely the '\0' value).

osv:CVE-2023-29469
Complete source record
{
  "id": "22f1da7977e757b4988e902e5fd48a5f31408c218cd622a7287e0ae7d67ffec3",
  "url": "https://osv.dev/vulnerability/CVE-2023-29469",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "CVE-2023-29469",
    "summary": "An issue was discovered in libxml2 before 2.10.4. When hashing empty dict strings in a crafted XML document, xmlDictComputeFastKey in dict.c can produce non-deterministic values, leading to various logic and memory errors, such as a double free. This behavior occurs because there is an attempt to use the first byte of an empty string, and any value is possible (not solely the '\\0' value).",
    "evidence": "osv:CVE-2023-29469",
    "products": [],
    "severity": "medium",
    "structured": {
      "id": "CVE-2023-29469",
      "aliases": [
        "CVE-2023-29469"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/gnome/libxml2",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "223cb03a5d27b1b2393b266a8657443d046139d6"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "2.10.4"
                      }
                    ],
                    "source": "CPE_RANGE"
                  }
                ]
              }
            },
            {
              "repo": "https://gitlab.gnome.org/gnome/libxml2",
              "type": "GIT",
              "events": [
                {
                  "introduced": "4b637079f26d8f5879ed45eb18cd249cad261951"
                },
                {
                  "fixed": "223cb03a5d27b1b2393b266a8657443d046139d6"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "2"
                      },
                      {
                        "fixed": "2.10.4"
                      }
                    ],
                    "source": "DESCRIPTION"
                  },
                  {
                    "cpe": "cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "2.10.4"
                      }
                    ],
                    "source": "CPE_RANGE"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v2.10.3",
            "v2.10.2",
            "v2.10.1",
            "v2.10.0",
            "v2.9.13",
            "v2.9.12",
            "v2.9.11",
            "CVE-2021-3541",
            "v2.9.10",
            "v2.9.10-rc1",
            "v2.9.9",
            "v2.9.9-rc2",
            "v2.9.9-rc1",
            "v2.9.8",
            "v2.9.8-rc1",
            "v2.9.7",
            "v2.9.7-rc1",
            "v2.9.6",
            "v2.9.6-rc1",
            "v2.9.5",
            "v2.9.5-rc2",
            "v2.9.5-rc1",
            "v2.9.4",
            "CVE-2016-3627",
            "CVE-2016-1833",
            "CVE-2016-1835",
            "CVE-2016-1837",
            "CVE-2016-1836",
            "CVE-2016-1839",
            "CVE-2016-1838",
            "CVE-2016-1840",
            "CVE-2016-4449",
            "CVE-2016-4483",
            "CVE-2016-1834",
            "CVE-2016-3705",
            "v2.9.4-rc2",
            "v2.9.4-rc1",
            "CVE-2016-1762",
            "v2.9.3",
            "CVE-2015-8242",
            "CVE-2015-7500",
            "CVE-2015-7499-2",
            "CVE-2015-7499-1",
            "CVE-2015-5312",
            "CVE-2015-7497",
            "CVE-2015-7498",
            "CVE-2015-8035",
            "CVE-2015-7942-2",
            "CVE-2015-7942",
            "CVE-2015-8317",
            "CVE-2015-1819",
            "CVE-2015-7941_2",
            "CVE-2015-7941_1",
            "v2.9.2",
            "CVE-2014-3660",
            "v2.9.2-rc2",
            "v2.9.2-rc1",
            "CVE-2014-0191",
            "v2.9.1",
            "CVE-2013-2877",
            "v2.9.0",
            "v2.9.0-rc2",
            "v2.8.0",
            "v2.8.0-rc2",
            "v2.8.0-rc1",
            "v2.7.8",
            "v2.7.7",
            "v2.7.6",
            "v2.7.5",
            "v2.7.4",
            "LIBXML2.7.3",
            "LIBXML2.7.2",
            "LIBXML2.7.1",
            "LIBXML2.7.0",
            "LIBXML2.6.32",
            "LIBXML2_2_6_28",
            "LIBXML2_2_6_27",
            "LIBXML2_2_6_26",
            "LIBXML2_2_6_24",
            "LIBXML2_2_6_23",
            "LIBXML2_2_6_22",
            "LIBXML2_2_6_21",
            "LIBXML2_2_6_20",
            "LIBXML2_2_6_19",
            "LIBXML2_2_6_18",
            "LIBXML2_2_6_16",
            "LIBXML2_2_6_15",
            "LIBXML2_2_6_14",
            "LIBXML2_2_6_13",
            "LIBXML2_2_6_12",
            "LIBXML2_2_6_11",
            "LIBXML_2_6_10",
            "LIBXML2_2_6_9",
            "LIBXML2_2_6_8",
            "LIBXML2_2_6_7",
            "LIBXML2_2_6_6",
            "LIBXML2_2_6_5",
            "LIBXML2_2_6_4",
            "LIBXML2_2_6_3",
            "LIBXML2_2_6_2",
            "LIBXML2_2_6_1",
            "LIBXML2_6_0",
            "LIBXML2_2_5_x",
            "LIBXML2_2_5_10",
            "LIBXML2_2_5_9",
            "LIBXML2_2_5_8",
            "LIBXML2_2_5_7",
            "LIBXML_2_5_6",
            "LIBXML_2_5_5",
            "LIBXML_2_5_4",
            "LIBXML_2_5_3",
            "LIBXML_2_5_2",
            "LIBXML_2_5_1",
            "LIBXML2_2_5_0",
            "LIBXML_2_4_30",
            "LIBXML_2_4_29",
            "LIBXML_2_4_27",
            "LIBXML_2_4_26",
            "LIBXML_2_4_25",
            "LIBXML_2_4_24",
            "LIBXML_2_4_23",
            "LIBXML_2_4_22",
            "LIBXML2_2_4_21",
            "LIBXML_2_4_20",
            "LIBXML_2_4_18",
            "LIBXML_2_4_13",
            "LIBXML_2_4_16",
            "LIBXML_2_4_14",
            "LIBXML_2_4_12",
            "LIBXML_2_4_11",
            "LIBXML_2_4_7",
            "LIBXML_2_4_6",
            "LIBXML_2_4_4",
            "LIBXML_2_4_3",
            "LIBXML_2_4_2",
            "LIBXML_2_4_0",
            "LIBXML_2_3_14",
            "LIBXML_2_3_13",
            "LIBXML_2_3_12",
            "LIBXML_2_3_11",
            "LIBXML_2_3_10",
            "LIBXML_2_3_9",
            "LIBXML_2_3_8",
            "help",
            "LIBXML_2_3_7",
            "LIBXML_2_3_6",
            "LIBXML_2_3_5",
            "LIBXML_2_3_4",
            "LIBXML_2_3_3",
            "LIBXML_2_3_2",
            "PRE_MUCKUP3",
            "PRE_MUCKUP2",
            "PRE_MUCKUP",
            "LIBXML_2_3_0",
            "LIBXML_2_2_8",
            "LIBXML_2_2_7",
            "LIBXML_2_2_6",
            "LIBXML_2_2_4",
            "GNOME_PRINT_0_24",
            "LIBXML_2_2_3",
            "LIBXML_2_2_1",
            "LIBXML_2_1_1",
            "LIBXML_2_1_0",
            "LIB_XML_1_X",
            "EAZEL-NAUTILUS-MS-AUG07",
            "LIBXML_2_0_0",
            "LIBXML_TEST_2_0_0",
            "LIBXML_1_8_6",
            "LIBXML_1_8_5",
            "LIB_XML_1_8_3",
            "LIB_XML_1_7_3",
            "LIB_XML_1_7_1",
            "LIB_XML_1_7_0",
            "LIB_XML_1_6_2",
            "LIB_XML_1_6_1",
            "LIBXML_1_5_0",
            "LIB_XML_1_4",
            "LIB_XML_1_3",
            "LIB_XML_1_1",
            "FOR_GNOME_0_99_1",
            "LIBXML_0_99",
            "GNUMERIC_FIRST_PUBLIC_RELEASE",
            "GNOME_0_30"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-29469.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:51.586938531Z",
      "provider": "osv",
      "references": [
        "https://cert-portal.siemens.com/productcert/html/ssa-341067.html",
        "https://cert-portal.siemens.com/productcert/html/ssa-398330.html",
        "https://cert-portal.siemens.com/productcert/html/ssa-556635.html",
        "https://cert-portal.siemens.com/productcert/html/ssa-625862.html",
        "https://cert-portal.siemens.com/productcert/html/ssa-769027.html",
        "https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.10.4",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/29xxx/CVE-2023-29469.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2023-29469",
        "https://security.netapp.com/advisory/ntap-20230601-0006/",
        "https://gitlab.gnome.org/GNOME/libxml2/-/issues/510",
        "https://lists.debian.org/debian-lts-announce/2023/04/msg00031.html"
      ],
      "provider_metadata": {
        "cna_assigner": "mitre",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/29xxx/CVE-2023-29469.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2023-29469",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 520426,
  "published_at": "2023-04-24T00:00:00+00:00"
}