diff --git a/pkgs/applications/networking/remote/citrix-workspace/generic.nix b/pkgs/applications/networking/remote/citrix-workspace/generic.nix
index f0210e97a8ab..bbfd19e15745 100644
--- a/pkgs/applications/networking/remote/citrix-workspace/generic.nix
+++ b/pkgs/applications/networking/remote/citrix-workspace/generic.nix
@@ -90,13 +90,18 @@ let
     '';
   };
 
-  libxml2' = libxml2.overrideAttrs rec {
+  libxml2' = libxml2.overrideAttrs (oldAttrs: rec {
     version = "2.13.8";
     src = fetchurl {
       url = "mirror://gnome/sources/libxml2/${lib.versions.majorMinor version}/libxml2-${version}.tar.xz";
       hash = "sha256-J3KUyzMRmrcbK8gfL0Rem8lDW4k60VuyzSsOhZoO6Eo=";
     };
-  };
+    meta = oldAttrs.meta // {
+      knownVulnerabilities = oldAttrs.meta.knownVulnerabilities or [ ] ++ [
+        "CVE-2025-6021"
+      ];
+    };
+  });
 
 in
 
diff --git a/pkgs/by-name/ci/ciscoPacketTracer7/package.nix b/pkgs/by-name/ci/ciscoPacketTracer7/package.nix
index 01a9e7d6ee09..bbdead8e26a8 100644
--- a/pkgs/by-name/ci/ciscoPacketTracer7/package.nix
+++ b/pkgs/by-name/ci/ciscoPacketTracer7/package.nix
@@ -50,13 +50,18 @@ let
     ];
   };
 
-  libxml2' = libxml2.overrideAttrs rec {
+  libxml2' = libxml2.overrideAttrs (oldAttrs: rec {
     version = "2.13.8";
     src = fetchurl {
       url = "mirror://gnome/sources/libxml2/${lib.versions.majorMinor version}/libxml2-${version}.tar.xz";
       hash = "sha256-J3KUyzMRmrcbK8gfL0Rem8lDW4k60VuyzSsOhZoO6Eo=";
     };
-  };
+    meta = oldAttrs.meta // {
+      knownVulnerabilities = oldAttrs.meta.knownVulnerabilities or [ ] ++ [
+        "CVE-2025-6021"
+      ];
+    };
+  });
 
   fhs = buildFHSEnv {
     pname = "packettracer7";
diff --git a/pkgs/by-name/ci/ciscoPacketTracer8/package.nix b/pkgs/by-name/ci/ciscoPacketTracer8/package.nix
index 10472dc0f356..6032f5407ed5 100644
--- a/pkgs/by-name/ci/ciscoPacketTracer8/package.nix
+++ b/pkgs/by-name/ci/ciscoPacketTracer8/package.nix
@@ -41,13 +41,18 @@ let
     "8.2.2" = "CiscoPacketTracer822_amd64_signed.deb";
   };
 
-  libxml2' = libxml2.overrideAttrs rec {
+  libxml2' = libxml2.overrideAttrs (oldAttrs: rec {
     version = "2.13.8";
     src = fetchurl {
       url = "mirror://gnome/sources/libxml2/${lib.versions.majorMinor version}/libxml2-${version}.tar.xz";
       hash = "sha256-J3KUyzMRmrcbK8gfL0Rem8lDW4k60VuyzSsOhZoO6Eo=";
     };
-  };
+    meta = oldAttrs.meta // {
+      knownVulnerabilities = oldAttrs.meta.knownVulnerabilities or [ ] ++ [
+        "CVE-2025-6021"
+      ];
+    };
+  });
 
   unwrapped = stdenvNoCC.mkDerivation {
     name = "ciscoPacketTracer8-unwrapped";