This page documents selected security vulnerabilities affecting components included in FLAT.
The list is limited to vulnerabilities considered relevant to running FLAT in production. Each entry includes an assessment of the vulnerability and its current remediation status.
| Vulnerability | Component | Version | Status | Commit |
|---|---|---|---|---|
| CVE-2025-6021 | libxml2 | 2.13.9 | fixed | 63cfc29e1 |
| CVE-2025-6170 | libxml2 | 2.13.9 | fixed | 4c4bf923d |
| CVE-2025-7425 | libxml2 | 2.13.9 | fixed | aee85cae1 |
| CVE-2025-8732 | libxml2 | 2.13.9 | not affected¹ | – |
| CVE-2026-0989 | libxml2 | 2.13.9 | not affected² | – |
| CVE-2026-0990 | libxml2 | 2.13.9 | not affected¹ | – |
| CVE-2026-0992 | libxml2 | 2.13.9 | not affected¹ | – |
| CVE-2026-6732 | libxml2 | 2.13.9 | fixed | bdc47bbf1 |
| CVE-2026-11979 | libxml2 | 2.13.9 | not affected¹ | – |
| CVE-2026-86137 | libxml2 | 2.13.9 | not affected³ | – |
| CVE-2026-86138 | libxml2 | 2.13.9 | not affected⁴ | – |
| CVE-2026-86139 | libxml2 | 2.13.9 | fixed | e5110143f |
| CVE-2026-86140 | libxml2 | 2.13.9 | not affected⁵ | – |
| CVE-2026-86141 | libxml2 | 2.13.9 | not affected⁵ | – |
| CVE-2026-86142 | libxml2 | 2.13.9 | fixed | 4cc4db5b5 |
| CVE-2026-86143 | libxml2 | 2.13.9 | fixed | ba58f0b3b |
| CVE-2026-86144 | libxml2 | 2.13.9 | fixed | 949b9545b |
| CVE-2025-7424 | libxslt | 1.1.43 | fixed | 0d8e8159d |
| CVE-2025-7425 | libxslt | 1.1.43 | fixed | aee85cae1 |
| CVE-2025-10911 | libxslt | 1.1.43 | fixed | 4ca8948b8 |
| CVE-2025-11731 | libxslt | 1.1.43 | fixed | b3ada4c65 |
| CVE-2026-18924 | libcurl | 8.5.0 | not affected⁶ | – |
| CVE-2026-19931 | libcurl | 8.5.0 | not affected⁷ | – |
| CVE-2026-82209 | libcurl | 8.5.0 | not affected⁸ | – |
| CVE-2026-80230 | libcurl | 8.5.0 | not affected⁹ | – |
¹ XML catalog code is included, but not executed.
² RelaxNG code is included, but not executed.
³ XSD or DTD validation code is included, but not executed.
⁴ XML string lengths are limited via $FLAT_MAX_PARSE_SIZE environment variable.
⁵ Schematron support is disabled at build time, the code ist not present.
⁶ HTTP/2 server push is not supported, code is not executed.
⁷ Negotiate authentication is not supported, code is not executed.
⁸ Public suffix lists are not supported, code is not executed.
⁹ Pinned public keys are not supported, code is not executed.