CVE-2025-6170

LowCVSS 2.5/10Last modified Nov 6, 2026

Description

A flaw was found in the interactive shell of the xmllint command-line tool, used for parsing XML files. When a user inputs an overly long command, the program does not check the input size properly, which can cause it to crash. This issue might allow attackers to run harmful code in rare configurations without modern protections.

Metrics

CVSS 3.1 2.5/10CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-121

Affected software

VendorProductVersions
——< 2.14.5
Red HatRed Hat Enterprise Linux 10—
Red HatRed Hat Enterprise Linux 10.0 Extended Update Support—
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support—
Red HatRed Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On—
Red HatRed Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support—
Red HatRed Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On—
Red HatRed Hat Enterprise Linux 8.8 Telecommunications Update Service—
Red HatRed Hat Enterprise Linux 8.8 Update Services for SAP Solutions—
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat Enterprise Linux 9.2 Update Services for SAP Solutions—
Red HatRed Hat Enterprise Linux 9.4 Update Services for SAP Solutions—
Red HatRed Hat Enterprise Linux 9.6 Extended Update Support—
Red HatCert Manager support for Red Hat OpenShift release 1.17—
Red HatCert Manager support for Red Hat OpenShift release 1.17—
Red HatCert Manager support for Red Hat OpenShift release 1.17—
Red HatCert Manager support for Red Hat OpenShift release 1.17—
Red HatCert Manager support for Red Hat OpenShift release 1.17—
Red HatCert Manager support for Red Hat OpenShift release 1.18—
Red HatCert Manager support for Red Hat OpenShift release 1.18—
Red HatCert Manager support for Red Hat OpenShift release 1.18—
Red HatCert Manager support for Red Hat OpenShift release 1.18—
Red HatCert Manager support for Red Hat OpenShift release 1.18—
Red HatCert Manager support for Red Hat OpenShift release 1.20—
Red HatCert Manager support for Red Hat OpenShift release 1.20—
Red HatCert Manager support for Red Hat OpenShift release 1.20—
Red HatCert Manager support for Red Hat OpenShift release 1.20—
Red HatCert Manager support for Red Hat OpenShift release 1.20—
Red HatCert Manager support for Red Hat OpenShift release 1.20—
Red HatCert Manager support for Red Hat OpenShift release 1.20—
Red HatCert Manager support for Red Hat OpenShift release 1.20—
Red HatRed Hat AI Inference Server 3.2—
Red HatRed Hat AI Inference Server 3.2—
Red HatRed Hat AI Inference Server 3.2—
Red HatRed Hat AI Inference Server 3.5—
Red HatRed Hat AI Inference Server 3.5—
Red HatRed Hat AI Inference Server 3.5—
Red HatRed Hat AI Inference Server 3.5—
Red HatRed Hat AI Inference Server 3.5—
Red HatRed Hat AI Inference Server 3.5—
Red HatRed Hat Discovery 2—
Red HatRed Hat Discovery 2—
Red HatRed Hat Enterprise Linux AI 3.5—
Red HatRed Hat Enterprise Linux AI 3.5—
Red HatRed Hat Enterprise Linux AI 3.5—
Red HatRed Hat Enterprise Linux AI 3.5—
Red HatRed Hat Enterprise Linux AI 3.5—

References

Timeline

Published
Jun 16, 2025
Last modified
Nov 6, 2026
NVD status
Modified

Related CVEs from 2025

CVE-2025-61714.3GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.2 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2 thCVE-2025-617134.4A Cleartext Storage of Sensitive Information in Memory vulnerability [CWE-316] in Fortinet FortiPAM 1.6.0, FortiPAM 1.5 all versions, FortiPCVE-2025-61729.8Permission vulnerability in the mobile application (com.afmobi.boomplayer) may lead to the risk of unauthorized operation.CVE-2025-617237.5The processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input. This affects programs which pCVE-2025-617245.3The Reader.ReadResponse function constructs a response string through repeated string concatenation of lines. When the number of lines in a CVE-2025-617257.5The ParseAddress function constructs domain-literal address components through repeated string concatenation. When parsing large domain-liteCVE-2025-617267.5The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs isCVE-2025-617276.5An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. For example a CVE-2025-617286.5archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened. This can lead toCVE-2025-617297.5Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out. FurthermCVE-2025-61737.2A vulnerability classified as critical was found in Webkul QloApps 1.6.1. Affected by this vulnerability is an unknown functionality of the CVE-2025-617305.3During the TLS 1.3 handshake if multiple messages are sent in records that span encryption level boundaries (for instance the Client Hello a
CVE-2025-6170: Low severity, CVSS 2.5 | Vulnix