CVE-2013-0339: libxml2 through 2.9.1 does not properly handle external entities expansion unless an application developer...

Security readout for executives and security teams

This is an XML External Entity issue in libxml2 through 2.9.1. If an application parses attacker-supplied XML without safely handling external entities, it may expose files, trigger internal HTTP requests, or consume resources. The business risk depends on which applications use libxml2 and whether they accept untrusted XML. Exposure is most likely in legacy systems, services, or tools that use libxml2 through 2.9.1 to parse XML from users, partners, uploads, APIs, or message queues. Systems that never parse untrusted XML or that disable external entity expansion are less exposed. Treat as a targeted remediation item, not an emergency solely from the provided evidence. Prioritize internet-facing or partner-facing XML workflows, legacy systems, and software that bundles old libxml2 versions. Ask teams to prove parser hardening, not only package version status. Mitigation focus: Inventory applications and packages using libxml2 through 2.9.1.; Apply relevant vendor libxml2 updates from supported distributions.; Disable external entity expansion for untrusted XML parsing..

Prepared

Jun 14, 2026, 14:50 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.