CVE-2014-3660 [Medium] | Denial of Service in Libxml2

parser.c in libxml2 before 2.9.2 does not properly prevent entity expansion even when entity substitution has been disabled, which allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted XML document containing a large number of nested entity references, a variant of the "billion laughs" attack.

#	Date	Old EPSS score	New EPSS score	Delta (New - Old)
1	2026-06-15	3.91%	4.02%	+0.11%
2	2026-05-12	5.04%	3.91%	-1.12%
3	2026-05-11	—	5.04%	—

Date

Old EPSS score

New EPSS score

Delta (New - Old)

2026-06-15

3.91%

4.02%

+0.11%

2026-05-12

5.04%

3.91%

-1.12%

2026-05-11

—

5.04%

—

Base score	Version	Severity	Vector	Exploitability	Impact	Score source
5.0	2.0	MEDIUM	`AV:N/AC:L/Au:N/C:N/I:N/A:P` Click to expand Access vector (AV:N) Can be exploited remotely over network reachability. Access complexity (AC:L) Exploitation conditions are straightforward and predictable. Authentication (AU:N) No authentication is required. Confidentiality impact (C:N) No confidentiality impact. Integrity impact (I:N) No integrity impact. Availability impact (A:P) Partial availability impact.	10.0	2.9	[email protected]

Base score

Version

Severity

Vector

Exploitability

Impact

Score source

5.0

2.0

MEDIUM

AV:N/AC:L/Au:N/C:N/I:N/A:P Click to expand

Access vector (AV:N): Can be exploited remotely over network reachability.
Access complexity (AC:L): Exploitation conditions are straightforward and predictable.
Authentication (AU:N): No authentication is required.
Confidentiality impact (C:N): No confidentiality impact.
Integrity impact (I:N): No integrity impact.
Availability impact (A:P): Partial availability impact.

10.0

2.9

[email protected]

OS Trackers for CVE-2014-3660

vendor	priority	summary	link
`debian`	not yet assigned	CVE-2014-3660 not yet assigned priority: Debian including 1 source packages (libxml2), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 5.	https://security-tracker.debian.org/tracker/CVE-2014-3660
`gentoo`	normal	CVE-2014-3660: 1 GLSA(s) (201412-06), 1 atom(s) (dev-libs/libxml2); latest impact normal.	https://bugs.gentoo.org/buglist.cgi?quicksearch=CVE-2014-3660
`redhat`	medium	—	https://access.redhat.com/security/cve/CVE-2014-3660
`suse`	medium	CVE-2014-3660 severity moderate: SUSE including 352 source package names (amazon/suse-sles-15-sp1-chost-byos-v20210304-hvm-ssd-x86_64, amazon/suse-sles-15-sp1-chost-byos-v20220127-hvm-ssd-x86_64, …), 487 product×package rows across 68 product lines (HPE Helion OpenStack 8, SUSE Liberty Linux 7, … (68 product lines)): Fixed 257, Known Affected 157, Known Not Affected 73.	https://www.suse.com/security/cve/CVE-2014-3660/
`ubuntu`	medium	CVE-2014-3660 medium priority: Ubuntu including 1 source packages (libxml2), 5 status rows across 5 suites (lucid, precise, trusty, upstream, utopic): released 5.	https://ubuntu.com/security/CVE-2014-3660

Affected software / configurations for CVE-2014-3660

Vendor	Product	Version	Raw CPE
xmlsoft	libxml2	<= 2.9.1	cpe:2.3:a:xmlsoft:libxml2::::::::
xmlsoft	libxml2	2.0.0	cpe:2.3:a:xmlsoft:libxml2:2.0.0:::::::*
xmlsoft	libxml2	2.1.0	cpe:2.3:a:xmlsoft:libxml2:2.1.0:::::::*
xmlsoft	libxml2	2.1.1	cpe:2.3:a:xmlsoft:libxml2:2.1.1:::::::*
xmlsoft	libxml2	2.2.0	cpe:2.3:a:xmlsoft:libxml2:2.2.0:::::::*
xmlsoft	libxml2	2.2.0	cpe:2.3:a:xmlsoft:libxml2:2.2.0:beta::::::
xmlsoft	libxml2	2.2.1	cpe:2.3:a:xmlsoft:libxml2:2.2.1:::::::*
xmlsoft	libxml2	2.2.2	cpe:2.3:a:xmlsoft:libxml2:2.2.2:::::::*
xmlsoft	libxml2	2.2.3	cpe:2.3:a:xmlsoft:libxml2:2.2.3:::::::*
xmlsoft	libxml2	2.2.4	cpe:2.3:a:xmlsoft:libxml2:2.2.4:::::::*
xmlsoft	libxml2	2.2.5	cpe:2.3:a:xmlsoft:libxml2:2.2.5:::::::*
xmlsoft	libxml2	2.2.6	cpe:2.3:a:xmlsoft:libxml2:2.2.6:::::::*
xmlsoft	libxml2	2.2.7	cpe:2.3:a:xmlsoft:libxml2:2.2.7:::::::*
xmlsoft	libxml2	2.2.8	cpe:2.3:a:xmlsoft:libxml2:2.2.8:::::::*
xmlsoft	libxml2	2.2.9	cpe:2.3:a:xmlsoft:libxml2:2.2.9:::::::*
xmlsoft	libxml2	2.2.10	cpe:2.3:a:xmlsoft:libxml2:2.2.10:::::::*
xmlsoft	libxml2	2.2.11	cpe:2.3:a:xmlsoft:libxml2:2.2.11:::::::*
xmlsoft	libxml2	2.3.0	cpe:2.3:a:xmlsoft:libxml2:2.3.0:::::::*
xmlsoft	libxml2	2.3.1	cpe:2.3:a:xmlsoft:libxml2:2.3.1:::::::*
xmlsoft	libxml2	2.3.2	cpe:2.3:a:xmlsoft:libxml2:2.3.2:::::::*
xmlsoft	libxml2	2.3.3	cpe:2.3:a:xmlsoft:libxml2:2.3.3:::::::*
xmlsoft	libxml2	2.3.4	cpe:2.3:a:xmlsoft:libxml2:2.3.4:::::::*
xmlsoft	libxml2	2.3.5	cpe:2.3:a:xmlsoft:libxml2:2.3.5:::::::*
xmlsoft	libxml2	2.3.6	cpe:2.3:a:xmlsoft:libxml2:2.3.6:::::::*
xmlsoft	libxml2	2.3.7	cpe:2.3:a:xmlsoft:libxml2:2.3.7:::::::*
xmlsoft	libxml2	2.3.8	cpe:2.3:a:xmlsoft:libxml2:2.3.8:::::::*
xmlsoft	libxml2	2.3.9	cpe:2.3:a:xmlsoft:libxml2:2.3.9:::::::*
xmlsoft	libxml2	2.3.10	cpe:2.3:a:xmlsoft:libxml2:2.3.10:::::::*
xmlsoft	libxml2	2.3.11	cpe:2.3:a:xmlsoft:libxml2:2.3.11:::::::*
xmlsoft	libxml2	2.3.12	cpe:2.3:a:xmlsoft:libxml2:2.3.12:::::::*
xmlsoft	libxml2	2.3.13	cpe:2.3:a:xmlsoft:libxml2:2.3.13:::::::*
xmlsoft	libxml2	2.3.14	cpe:2.3:a:xmlsoft:libxml2:2.3.14:::::::*
xmlsoft	libxml2	2.4.1	cpe:2.3:a:xmlsoft:libxml2:2.4.1:::::::*
xmlsoft	libxml2	2.4.2	cpe:2.3:a:xmlsoft:libxml2:2.4.2:::::::*
xmlsoft	libxml2	2.4.3	cpe:2.3:a:xmlsoft:libxml2:2.4.3:::::::*
xmlsoft	libxml2	2.4.4	cpe:2.3:a:xmlsoft:libxml2:2.4.4:::::::*
xmlsoft	libxml2	2.4.5	cpe:2.3:a:xmlsoft:libxml2:2.4.5:::::::*
xmlsoft	libxml2	2.4.6	cpe:2.3:a:xmlsoft:libxml2:2.4.6:::::::*
xmlsoft	libxml2	2.4.7	cpe:2.3:a:xmlsoft:libxml2:2.4.7:::::::*
xmlsoft	libxml2	2.4.8	cpe:2.3:a:xmlsoft:libxml2:2.4.8:::::::*
xmlsoft	libxml2	2.4.9	cpe:2.3:a:xmlsoft:libxml2:2.4.9:::::::*
xmlsoft	libxml2	2.4.10	cpe:2.3:a:xmlsoft:libxml2:2.4.10:::::::*
xmlsoft	libxml2	2.4.11	cpe:2.3:a:xmlsoft:libxml2:2.4.11:::::::*
xmlsoft	libxml2	2.4.12	cpe:2.3:a:xmlsoft:libxml2:2.4.12:::::::*
xmlsoft	libxml2	2.4.13	cpe:2.3:a:xmlsoft:libxml2:2.4.13:::::::*
xmlsoft	libxml2	2.4.14	cpe:2.3:a:xmlsoft:libxml2:2.4.14:::::::*
xmlsoft	libxml2	2.4.15	cpe:2.3:a:xmlsoft:libxml2:2.4.15:::::::*
xmlsoft	libxml2	2.4.16	cpe:2.3:a:xmlsoft:libxml2:2.4.16:::::::*
xmlsoft	libxml2	2.4.17	cpe:2.3:a:xmlsoft:libxml2:2.4.17:::::::*
xmlsoft	libxml2	2.4.18	cpe:2.3:a:xmlsoft:libxml2:2.4.18:::::::*
xmlsoft	libxml2	2.4.19	cpe:2.3:a:xmlsoft:libxml2:2.4.19:::::::*
xmlsoft	libxml2	2.4.20	cpe:2.3:a:xmlsoft:libxml2:2.4.20:::::::*
xmlsoft	libxml2	2.4.21	cpe:2.3:a:xmlsoft:libxml2:2.4.21:::::::*
xmlsoft	libxml2	2.4.22	cpe:2.3:a:xmlsoft:libxml2:2.4.22:::::::*
xmlsoft	libxml2	2.4.23	cpe:2.3:a:xmlsoft:libxml2:2.4.23:::::::*
xmlsoft	libxml2	2.4.24	cpe:2.3:a:xmlsoft:libxml2:2.4.24:::::::*
xmlsoft	libxml2	2.4.25	cpe:2.3:a:xmlsoft:libxml2:2.4.25:::::::*
xmlsoft	libxml2	2.4.26	cpe:2.3:a:xmlsoft:libxml2:2.4.26:::::::*
xmlsoft	libxml2	2.4.27	cpe:2.3:a:xmlsoft:libxml2:2.4.27:::::::*
xmlsoft	libxml2	2.4.28	cpe:2.3:a:xmlsoft:libxml2:2.4.28:::::::*
xmlsoft	libxml2	2.4.29	cpe:2.3:a:xmlsoft:libxml2:2.4.29:::::::*
xmlsoft	libxml2	2.4.30	cpe:2.3:a:xmlsoft:libxml2:2.4.30:::::::*
xmlsoft	libxml2	2.5.0	cpe:2.3:a:xmlsoft:libxml2:2.5.0:::::::*
xmlsoft	libxml2	2.5.4	cpe:2.3:a:xmlsoft:libxml2:2.5.4:::::::*
xmlsoft	libxml2	2.5.7	cpe:2.3:a:xmlsoft:libxml2:2.5.7:::::::*
xmlsoft	libxml2	2.5.8	cpe:2.3:a:xmlsoft:libxml2:2.5.8:::::::*
xmlsoft	libxml2	2.5.10	cpe:2.3:a:xmlsoft:libxml2:2.5.10:::::::*
xmlsoft	libxml2	2.5.11	cpe:2.3:a:xmlsoft:libxml2:2.5.11:::::::*
xmlsoft	libxml2	2.6.0	cpe:2.3:a:xmlsoft:libxml2:2.6.0:::::::*
xmlsoft	libxml2	2.6.1	cpe:2.3:a:xmlsoft:libxml2:2.6.1:::::::*
xmlsoft	libxml2	2.6.2	cpe:2.3:a:xmlsoft:libxml2:2.6.2:::::::*
xmlsoft	libxml2	2.6.3	cpe:2.3:a:xmlsoft:libxml2:2.6.3:::::::*
xmlsoft	libxml2	2.6.4	cpe:2.3:a:xmlsoft:libxml2:2.6.4:::::::*
xmlsoft	libxml2	2.6.5	cpe:2.3:a:xmlsoft:libxml2:2.6.5:::::::*
xmlsoft	libxml2	2.6.6	cpe:2.3:a:xmlsoft:libxml2:2.6.6:::::::*
xmlsoft	libxml2	2.6.7	cpe:2.3:a:xmlsoft:libxml2:2.6.7:::::::*
xmlsoft	libxml2	2.6.8	cpe:2.3:a:xmlsoft:libxml2:2.6.8:::::::*
xmlsoft	libxml2	2.6.9	cpe:2.3:a:xmlsoft:libxml2:2.6.9:::::::*
xmlsoft	libxml2	2.6.11	cpe:2.3:a:xmlsoft:libxml2:2.6.11:::::::*
xmlsoft	libxml2	2.6.12	cpe:2.3:a:xmlsoft:libxml2:2.6.12:::::::*

References for CVE-2014-3660

URL	Tags
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html
http://lists.apple.com/archives/security-announce/2015/Aug/msg00002.html
http://lists.opensuse.org/opensuse-updates/2014-10/msg00034.html
http://lists.opensuse.org/opensuse-updates/2015-12/msg00120.html
http://rhn.redhat.com/errata/RHSA-2014-1655.html
http://rhn.redhat.com/errata/RHSA-2014-1885.html
http://secunia.com/advisories/59903
http://secunia.com/advisories/61965
http://secunia.com/advisories/61966
http://secunia.com/advisories/61991
http://www.debian.org/security/2014/dsa-3057
http://www.mandriva.com/security/advisories?name=MDVSA-2014:244
http://www.openwall.com/lists/oss-security/2014/10/17/7	Patch
http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html
http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
http://www.securityfocus.com/bid/70644
http://www.ubuntu.com/usn/USN-2389-1	Vendor Advisory
https://bugzilla.redhat.com/attachment.cgi?id=944444&action=diff
https://bugzilla.redhat.com/show_bug.cgi?id=1149084
https://support.apple.com/kb/HT205030	Vendor Advisory
https://support.apple.com/kb/HT205031	Vendor Advisory
https://www.ncsc.nl/actueel/nieuwsberichten/kwetsbaarheid-ontdekt-in-libxml2.html

URL

CVE-2014-3660

Exploit prediction scoring system (EPSS) score for CVE-2014-3660

Common vulnerability scoring system (CVSS) metrics for CVE-2014-3660

Weakness enumeration for CVE-2014-3660

OS Trackers for CVE-2014-3660

NVD evaluator notes for CVE-2014-3660

Affected software / configurations for CVE-2014-3660

References for CVE-2014-3660