CVE-2022-50999
HighCVSS 8.6Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
Nokogiri versions before 1.13.5 contain an integer overflow vulnerability in packaged libxml2 buffer handling functions that allows attackers to cause out-of-bounds memory writes. Attackers can exploit this by crafting multi-gigabyte XML files to trigger buffer overflows resulting in information disclosure, data modification, or denial of service.
Risk Assessment
An attacker can cause memory corruption, potentially leading to leakage of sensitive data, data modification, or application crashes.
Recommendation
Upgrade Nokogiri to version 1.13.5 or later to fix the integer overflow.
Other vulnerabilities in Nokogiri
See all- GHSA-5prr-v3j2-97mhMedium
A vulnerability in the Nokogiri library affects the `Nokogiri::XML::NodeSet#[]` method (and its alias `#slice`). The index check against the node set's bounds used a 32-bit-truncated copy of the index, allowing a large negative index to pass the check and then be used at full width, reading outside the node set's storage.
- GHSA-5v8h-3h3q-446pLow
A vulnerability in the Nokogiri library allows calling `Document#encoding=` with an invalid encoding (e.g., a non-string or a string containing a null byte), which frees the document's current encoding string without replacing it. The document is left referencing freed memory, leading to a use-after-free condition on the next call.
- GHSA-8678-w3jw-xfc2Low
The vulnerability in the Nokogiri library for JRuby causes the NONET option to be incorrectly enforced when parsing XML schemas. This allows an attacker to load external network resources, potentially leading to data leakage or SSRF attacks.
- GHSA-9cv2-cfxc-v4v2Low
Nokogiri has a bug in methods called on allocated-but-uninitialized native wrapper classes inheriting from `Nokogiri::XML::Node`. This causes a NULL pointer dereference that could crash the process.
- GHSA-p67v-3w7g-wjg7Low
The vulnerability in the Nokogiri library causes `Nokogiri::XML::XPathContext` to not keep its source document alive for garbage collection. If an XPathContext outlives its document and the document is collected, evaluating an XPath expression could read invalid memory and potentially segfault.
- GHSA-phwj-rprq-35ppLow
Nokogiri's CRuby native extension could leave a Ruby wrapper pointing to freed memory when replacing the value of an XML attribute. If Ruby code had already accessed an attribute child node, `Nokogiri::XML::Attr#value=` could free the underlying native child node while the wrapper remains.
- GHSA-wjv4-x9w8-wm3hLow
A vulnerability in the Nokogiri library allows a DTD node to be set as the document root, leading to a heap use-after-free during garbage collection or finalization. This results in an invalid memory read or potentially a segfault.
- GHSA-wfpw-mmfh-qq69Low
The vulnerability in the Nokogiri library affects the `Nokogiri::XML::Node#do_xinclude` method, which during XInclude processing removes `<xi:include>` nodes along with their children (e.g., `<xi:fallback>`) and declared namespaces. If an application previously accessed these nodes, unexpected behavior may occur.
- GHSA-g9g8-vgvw-g3vfUnknown
The vulnerability in the Nokogiri library affects the protected copy helper used by Node#dup and #clone methods. It unwrapped the source argument as an xmlNode without a type check, causing an out-of-bounds read on xmlNs structure and process crash when a non-Node object (e.g. Namespace) was supplied. Version 1.19.4 adds a type check and raises TypeError.
- CVE-2025-71407Critical
Nokogiri before 1.18.3 contains a stack buffer overflow vulnerability in libxml2 when reporting DTD validation errors with long QName prefixes, and a use-after-free vulnerability during validation against untrusted XML Schemas. Attackers can trigger these vulnerabilities by providing malicious DTD content or untrusted XSD files to cause denial of service or potential code execution.
Original NVD description (English source)
Nokogiri versions before 1.13.5 contain an integer overflow vulnerability in packaged libxml2 buffer handling functions that allows attackers to cause out-of-bounds memory writes. Attackers can exploit this by crafting multi-gigabyte XML files to trigger buffer overflows resulting in information disclosure, data modification, or denial of service.