CVE•Published 2021-05-19•Modified 2026-10-14•1 article on news•6 live references•NVD data
CVE-2021-3517Xmlsoft · Libxml2
Vulnerability data via NVD (ingested)
CVSS v3.1
8.6
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
EPSS percentile
97
Exploit Prediction Scoring System · top 3% of all CVEs
Weaknesses (CWE)
Description
There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be processed by an application linked with the affected functionality of libxml2 could trigger an out-of-bounds read. The most likely impact of this flaw is to application availability, with some potential impact to confidentiality and integrity if an attacker is able to use memory information to further exploit the application.
Timeline
Published 2021-05-19
Modified 2026-10-14
External references
Search for exposed instances
Shodan + Censys queries derived from NVD's CPE data. The vuln tag catches assets Shodan has explicitly linked to this CVE; the product / banner fingerprints find exposed instances even when the vuln tag was never applied (which is common).
Shodan · vuln tag3 hosts
vuln:CVE-2021-3517Hosts Shodan has explicitly fingerprinted as vulnerable.
Shodan · product
product:"Xmlsoft Libxml2"All exposed Xmlsoft Libxml2 instances — cross-reference with the CVE's affected-version range.
Shodan · banner/body mention
http.html:"Libxml2"HTTP body or banner mentions "Libxml2" — catches deploys Shodan didn't identify as a product.
More intel sources (5)
Shodan report
vuln:CVE-2021-3517Country / ASN / product breakdown for the vuln query.
Censys
vulnerabilities.cve_id: CVE-2021-3517Censys host search filtered to this CVE id.
grep.app
CVE-2021-3517Public source-code mentions — fast PoC discovery.
GitHub code
CVE-2021-3517GitHub code search for direct mentions.
Google dork
"CVE-2021-3517" exploit -site:nvd.nist.govWrite-ups and news, NVD excluded.
Known PoCs on GitHub (5)
CVE-2021-35175 repos
anthonykirby/lora-packetTypeScript
LoRa radio packet decoder
hiifong/starListPython
Export your star's repository list
awiseguy88/openclaw-advanced-skills-libraryunknown
OpenClaw Skills Library 2,510 Production-Ready Skills for AI Agent Automation Give your OpenClaw agent the complete puzzle. Modular, observable, and safe automation workflows for…
ewwhardik/nirdepJavaScript
Delete your dependencies. A scope-aware JavaScript codemod and standard-library runtime that replace the most-installed npm packages. Zero dependencies proven at build time.
RP-Digital-Innovations/context-snipeRust
Deterministic dependency + CVE context for AI coding tools, over the Model Context Protocol. A ~0.85 MB pure-Rust MCP server.