CVE-2024-40896

The SAX parser in libxml2 generates events for external XML entities even when custom SAX handlers attempt to override entity content by setting the 'checked' flag. This mechanism should block processing of external entities, however a bug in the implementation causes the flag to be ignored. As a result, an attacker can deliver a crafted XML document containing references to external entities that will be processed by the parser despite application security measures.

An attacker can manipulate XML document processing in a way that violates data integrity or causes application unavailability (denial of service). Classic XXE attacks are possible, including reading system files or forcing server-side requests (SSRF), depending on the application context.

Update libxml2 to version 2.11.9, 2.12.9, or 2.13.3 (according to the branch in use). NetApp product users should follow the manufacturer's recommendations available at https://security.netapp.com/advisory/ntap-20250228-0004/. Additionally, it is recommended to verify that applications using libxml2 do not rely solely on custom SAX handlers as the only protection mechanism against XXE.

libxml2 in versions: 2.11.x before 2.11.9, 2.12.x before 2.12.9, and 2.13.x before 2.13.3. Also affects NetApp HCI Compute Node and NetApp SolidFire & HCI Management Node products based on vulnerable library versions.