CVE-2025-7425

High [CVE-2025-43368 +5] January 2026 Java Platform Standard Edition 8u471-b50 Vulnerabilities in NetApp Products

NTAP-20260123-0013Source published Jan 23, 2026Source updated Aug 5, 2026

This bulletin covers 6 CVEs. The products, versions, score and guidance below describe the bulletin; check its source for applicability to this specific CVE.

Multiple NetApp products incorporate the Oracle Java Platform, Standard Edition (Java SE). Java SE version 8u471-b50 is susceptible to vulnerabilities that allow an unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Refer to “Oracle Critical Patch Update Advisory - January 2026” for additional details. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE accessible data, unauthorized read access to a subset of Oracle Java SE accessible data, unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE, unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE or a takeover of Oracle Java SE. NetApp…

Affected products in this advisory

No product details extracted. Check the source bulletin.

Source-reported affected versions

Affected-version details not available in this record.

Source-reported fixed versions

No fixed-version detail extracted. This does not mean no fix exists.

Mitigation guidance

• Refer to “Oracle Critical Patch Update Advisory - January 2026” for additional details.
• Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE accessible data, unauthorized read access to a subset of Oracle Java SE accessible data, unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE, unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE or a takeover of Oracle Java SE.

Workarounds

• <p> If a product requires JRE but does not include it, please update JRE to a fixed version that aligns with the product requirements. <br><br> <a href="https://kb.netapp.com/Advice_and_Troubleshooting/Data_Infrastructure_Management/E-Series_SANtricity_Management_Software/How_to_update_the_Java_Runtime_Environment_(JRE)__Storage_Manager_11.10_or_later" target="_blank">Updating the Java Runtime Environment (JRE) used by SANtricity Storage Manager 11.10 or later </a> <br><br> In Full Support versions of OnCommand Workflow Automation and Active IQ Unified Manager for Linux & Windows the Java software can be upgraded as specified in the product documentation. For assistance with upgrade issues please consult technical support. <br><br> In Full Support versions of OnCommand Insight the Java software can be upgraded. For assistance with the upgrade and access to the updated OnCommand Insight binaries please consult technical support. <br><br> </p>

High [CVE-2025-7425] Libxslt Vulnerability in NetApp Products

NTAP-20260116-0014Source published Jan 16, 2026Source updated Jul 15, 2026

Multiple NetApp products incorporate libxslt. Libxslt versions through 1.1.43 are susceptible to a vulnerability which when successfully exploited could lead to addition or modification of data or Denial of Service (DoS). Affected products: ONTAP tools for VMware vSphere 10. NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status. NetApp states there is no workaround available at this time.

Affected products in this advisory

• ONTAP tools for VMware vSphere 10

Source-reported affected versions

• 1.1.43

Source-reported fixed versions

• ONTAP tools for VMware vSphere 10: 10.5P2

Mitigation guidance

• Update affected NetApp products to a fixed release: ONTAP tools for VMware vSphere 10: 10.5P2.

High [CVE-2025-7425] heap use-after-free in libxslt caused by atype corruption in xmlattrptr

CVE-2025-7425Source published Jul 10, 2025Source updated Jul 10, 2025

A flaw was found in libxslt where the attribute type, atype, flags are modified in a way that corrupts internal memory management. When XSLT functions, such as the key() process, result in tree fragments, this corruption prevents the proper cleanup of ID attributes. As a result, the system may access freed memory, causing crashes or enabling attackers to trigger heap corruption. This heap-use-after-free vulnerability in libxslt is rated Important because it can lead to memory corruption and application crashes. The flaw arises when internal attribute metadata (atype) is modified by libxslt's xsltSetSourceNodeFlags() function during processing of result tree fragments. If the flag corruption prevents proper removal of ID references, later memory cleanup routines may operate on…

Affected products in this advisory

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7 Extended Lifecycle Support
• Red Hat Enterprise Linux 8.2 Advanced Update Support
• Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support

30 more entries in the full advisory.

Source-reported affected versions

Affected-version details not available in this record.

Source-reported fixed versions

• libxml2-0:2.12.5-8.el10_0
• libxslt-0:1.1.39-8.el10_0
• libxml2-0:2.9.1-6.el7_9.12
• libxml2-0:2.9.7-21.el8_10.2

46 more entries in the full advisory.

Mitigation guidance

• Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.