GHSA-wrxv-2j5q-m38w

    Dashboard / Vulnerabilities / GHSA-wrxv-2j5q-m38w

    GHSA-wrxv-2j5q-m38w

    Published: 6 Jul 2022Last Modified: 4 Nov 2025

    Summary: lxml NULL Pointer Dereference allows attackers to cause a denial of service

    Details: NULL Pointer Dereference allows attackers to cause a denial of service (or application crash). This only applies when lxml is used together with libxml2 2.9.10 through 2.9.14. libxml2 2.9.9 and earlier are not affected. It allows triggering crashes through forged input data, given a vulnerable code sequence in the application. The vulnerability is caused by the iterwalk function (also used by the canonicalize function). Such code shouldn't be in wide-spread use, given that parsing + iterwalk would usually be replaced with the more efficient iterparse function. However, an XML converter that serialises to C14N would also be vulnerable, for example, and there are legitimate use cases for this code sequence. If untrusted input is received (also remotely) and processed via iterwalk function, a crash can be triggered.

    References: https://nvd.nist.gov/vuln/detail/CVE-2022-2309, https://github.com/lxml/lxml/commit/86368e9cf70a0ad23cccd5ee32de847149af0c6f, https://github.com/advisories/GHSA-wrxv-2j5q-m38w, https://github.com/lxml/lxml, https://github.com/lxml/lxml/blob/master/CHANGES.txt, https://github.com/pypa/advisory-database/tree/main/vulns/lxml/PYSEC-2022-230.yaml, https://huntr.dev/bounties/8264e74f-edda-4c40-9956-49de635105ba, https://lists.debian.org/debian-lts-announce/2024/09/msg00021.html, https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HGYC6L7ENH5VEGN3YWFBYMGKX6WNS7HZ, https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/URHHSIBTPTALXMECRLAC2EVDNAFSR5NO, https://lists.fedoraproject.org/archives/list/[email protected]/message/HGYC6L7ENH5VEGN3YWFBYMGKX6WNS7HZ, https://lists.fedoraproject.org/archives/list/[email protected]/message/URHHSIBTPTALXMECRLAC2EVDNAFSR5NO, https://security.gentoo.org/glsa/202208-06, https://security.netapp.com/advisory/ntap-20220915-0006

    Affected packages

    Package

    Name: lxml

    Purl: pkg:pypi/lxml

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -4.9.1

    Affected versions

    1.3.2
    1.3.3
    1.3.4
    1.3.5
    1.3.6

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-wrxv-2j5q-m38w | CVE-DB