EUVD-2025-18175

Apply vendor-released patches immediately for internet-facing systems processing untrusted XML. For Red Hat Enterprise Linux, upgrade libxml2 to fixed versions: RHEL 7 to 0:2.9.1-6.el7_9.10, RHEL 8 to 0:2.9.7-21.el8_10.1 (or version-specific patches per support tier), RHEL 9 to 0:2.9.13-10.el9_6, RHEL 10 to 0:2.12.5-7.el10_0. OpenShift Container Platform administrators should apply platform-specific updates via Red Hat Security Advisories RHSA-2025:12237 through RHSA-2025:13325 matching their cluster version. Ubuntu users should install updates from USN-7694-1, Debian users from DLA-4251-1. If patching cannot be completed immediately, implement compensating controls: restrict XML processing endpoints to authenticated users only (reduces attack surface from AV:N to trusted networks), deploy XML input validation and size limits before libxml2 parsing (blocks oversized crafted inputs but adds processing overhead and may break legitimate large documents), enable application-level request throttling to limit DoS impact (does not prevent exploitation but contains blast radius), and monitor for abnormal process crashes in XML-consuming services. Note that input validation is bypass-prone against novel integer overflow vectors and should be considered temporary mitigation only.