CVE-2025-6021

High [CVE-2025-43368 +5] January 2026 Java Platform Standard Edition 8u471-b50 Vulnerabilities in NetApp Products

NTAP-20260123-0013Source published Jan 23, 2026Source updated Aug 5, 2026

This bulletin covers 6 CVEs. The products, versions, score and guidance below describe the bulletin; check its source for applicability to this specific CVE.

Multiple NetApp products incorporate the Oracle Java Platform, Standard Edition (Java SE). Java SE version 8u471-b50 is susceptible to vulnerabilities that allow an unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Refer to “Oracle Critical Patch Update Advisory - January 2026” for additional details. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE accessible data, unauthorized read access to a subset of Oracle Java SE accessible data, unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE, unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE or a takeover of Oracle Java SE. NetApp…

Affected products in this advisory

No product details extracted. Check the source bulletin.

Source-reported affected versions

Affected-version details not available in this record.

Source-reported fixed versions

No fixed-version detail extracted. This does not mean no fix exists.

Mitigation guidance

• Refer to “Oracle Critical Patch Update Advisory - January 2026” for additional details.
• Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE accessible data, unauthorized read access to a subset of Oracle Java SE accessible data, unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE, unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE or a takeover of Oracle Java SE.

Workarounds

• <p> If a product requires JRE but does not include it, please update JRE to a fixed version that aligns with the product requirements. <br><br> <a href="https://kb.netapp.com/Advice_and_Troubleshooting/Data_Infrastructure_Management/E-Series_SANtricity_Management_Software/How_to_update_the_Java_Runtime_Environment_(JRE)__Storage_Manager_11.10_or_later" target="_blank">Updating the Java Runtime Environment (JRE) used by SANtricity Storage Manager 11.10 or later </a> <br><br> In Full Support versions of OnCommand Workflow Automation and Active IQ Unified Manager for Linux & Windows the Java software can be upgraded as specified in the product documentation. For assistance with upgrade issues please consult technical support. <br><br> In Full Support versions of OnCommand Insight the Java software can be upgraded. For assistance with the upgrade and access to the updated OnCommand Insight binaries please consult technical support. <br><br> </p>

High [CVE-2025-6021] Libxml2 Vulnerability in NetApp Products

NTAP-20250711-0009Source published Jul 11, 2025Source updated Oct 9, 2026

Multiple NetApp products incorporate libxml2. Libxml2 versions through 2.14.3 are susceptible to a vulnerability which when successfully exploited could lead to Denial of Service (DoS). Successful exploitation of this vulnerability could lead to Denial of Service (DoS). Affected products: NetApp Manageability SDK, NetApp SolidFire & HCI Management Node, NetApp SolidFire & HCI Storage Node (Element Software), ONTAP 9, SnapManager for Hyper-V. NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status. NetApp states there is no workaround available at this time.

Affected products in this advisory

• NetApp Manageability SDK
• NetApp SolidFire & HCI Management Node
• NetApp SolidFire & HCI Storage Node (Element Software)
• ONTAP 9

1 more entries in the full advisory.

Source-reported affected versions

• 2.14.3

Source-reported fixed versions

• NetApp Manageability SDK: 9.8P10
• ONTAP 9: 9.12.1P20
• ONTAP 9: 9.13.1P19
• ONTAP 9: 9.14.1P15

4 more entries in the full advisory.

Mitigation guidance

• Update affected NetApp products to a fixed release: NetApp Manageability SDK: 9.8P10, ONTAP 9: 9.12.1P20, ONTAP 9: 9.13.1P19, ONTAP 9: 9.14.1P15, ONTAP 9: 9.15.1P16, ONTAP 9: 9.16.1P9, ONTAP 9: 9.17.1P2, ONTAP 9: 9.18.1.
• SnapManager for Hyper-V has no planned fix; migrate to a supported release or product and consult NetApp's end-of-support notice.

High [CVE-2025-6021] Libxml2: integer overflow in xmlbuildqname leads to stack buffer overflow in libxml2

CVE-2025-6021Source published Jun 12, 2025Source updated Jun 12, 2025

A flaw was found in libxml2's xmlBuildQName function, where integer overflows in buffer size calculations can lead to a stack-based buffer overflow. This issue can result in memory corruption or a denial of service when processing crafted input. This vulnerability is rated Moderate due to the lack of confidentiality impact and limited integrity concerns, with the main risk being potential denial-of-service from a crash. Exploitation requires crafted XML input and specific application behavior using xmlBuildQName. While it’s a write overflow, modern mitigations make remote code execution unlikely. Red Hat severity: Moderate — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-787. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise…

Affected products in this advisory

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7 Extended Lifecycle Support
• Red Hat Enterprise Linux 8.2 Advanced Update Support
• Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support

22 more entries in the full advisory.

Source-reported affected versions

Affected-version details not available in this record.

Source-reported fixed versions

• libxml2-0:2.12.5-7.el10_0
• libxml2-0:2.9.1-6.el7_9.10
• libxml2-0:2.9.7-21.el8_10.1
• libxml2-0:2.9.7-9.el8_2.3

38 more entries in the full advisory.

Mitigation guidance

• Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Users are strongly advised to apply vendor-supplied patches as soon as they become available to address the underlying integer overflow flaw in the affected code.