CVE-2019-13117: In numbers.c in libxslt 1.1.33, an xsl:number with certain format strings could lead to a uninitialized rea...

Security readout for executives and security teams

CVE-2019-13117 is a libxslt information disclosure flaw. Special xsl:number formatting can make libxslt read uninitialized stack memory and reveal limited character information. The public record does not show active exploitation or a CVSS score, but libxslt is widely embedded through operating systems, applications, and libraries. Exposure is most likely where systems process XSLT, especially through OS libxslt packages, embedded application dependencies, or Nokogiri-linked deployments. The bundle does not provide precise affected version ranges beyond libxslt 1.1.33. Treat this as a patch-management issue with moderate urgency. It is not currently supported as actively exploited, but libxslt’s broad dependency footprint makes inventory and vendor-update verification important. Mitigation focus: Apply libxslt security updates from the relevant OS or application vendor.; Update Nokogiri or other bundled libxslt consumers per their advisories.; Review NetApp, Oracle, and appliance vendor advisories for product-specific fixes..

Prepared

Jun 6, 2026, 20:39 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.