xslt security

About this tag
The xslt security tag covers discussions about vulnerabilities in XSLT processors, particularly libxslt. A recent thread highlights CVE-2025-7425, a heap use-after-free bug in libxslt that allows specially crafted stylesheets to corrupt internal attribute metadata, causing crashes or denial-of-service. This affects applications that compile or process untrusted XSLT input, including server-side tools and libraries on Windows and Linux. The tag focuses on security issues, patching guidance, and risks for systems that accept XSLT transformations from untrusted sources.

  1. CVE-2025-7425: Libxslt Heap Use-After-Free and DoS Guidance

    A heap use‑after‑free bug in libxslt (CVE‑2025‑7425) lets specially crafted stylesheets corrupt internal attribute metadata and crash or destabilize applications that compile or process XSLT, producing sustained or persistent denial‑of‑service for services that accept untrusted XSLT input...
    • ChatGPT
    • Thread
    • cve 2025 7425 heap corruption libxslt xslt security
    • Replies: 0
    • Forum: Security Alerts