CVE-2017-16932

What it actually does

The parser enters unbounded recursion when processing XML parameter entities that reference themselves, exhausting the call stack and terminating the process.

Why it matters to the business

Services that parse untrusted XML can be forced offline with a single request, producing availability loss and potential cascading failures in dependent systems.

How an attack unfolds

An attacker crafts an XML document containing a self-referential parameter entity and submits it to any interface that invokes the vulnerable libxml2 parser; the recursion consumes stack space until the process crashes.

How to fix it

Upgrade libxml2 to a build containing commit 899a5d9f0ed13b8e32449a08a361e0de127dd961 (equivalent to 2.9.5 or newer) in all affected packages and rebuild any statically linked binaries.

How to confirm the fix worked

Confirm the installed libxml2 shared object or header reports a version at or above 2.9.5; recompile and retest applications against the fixed library; attempt to parse the original recursive entity test case and verify it now returns a controlled error instead of crashing.

Typical attack path

1. Identify an endpoint or API that accepts XML input
2. Prepare a minimal XML document with a recursive parameter entity
3. Transmit the document over the network or via file upload
4. Observe process termination and service unavailability

How to detect it

Review application and system logs for sudden crashes or segmentation faults immediately after XML processing; correlate with inbound XML payloads containing parameter entity declarations; monitor process exit codes and stack traces for libxml2 parser functions.

What your security team should do

• Prioritize patching all instances of libxml2 within the next maintenance window
• Inventory software that statically links or vendors libxml2 and schedule rebuilds
• Add the library to automated dependency scanning pipelines to prevent regression