CVE-2015-8035: The xz_decomp function in xzlib.c in libxml2 2.9.1 does not properly detect compression errors, which allow...

Security readout for executives and security teams

CVE-2015-8035 is a denial-of-service flaw in libxml2 2.9.1. A specially crafted XML input can make a process hang when xz decompression is enabled. The business risk is service unavailability where applications parse untrusted XML, not data theft or code execution based on the provided sources. Exposure is most likely in applications, services, or operating-system packages using libxml2 with xz support enabled and processing XML from untrusted or semi-trusted sources. Treat as a moderate availability risk. Prioritize remediation where XML parsing is exposed to customers, partners, or automated feeds, especially if service hangs can exhaust workers or disrupt business processes. Mitigation focus: Apply libxml2 updates from the relevant OS or vendor advisory.; Check vendor guidance where exact fixed versions are not listed.; Limit untrusted XML ingestion where feasible..

Prepared

Jun 13, 2026, 21:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.