Out-of-Bounds

Overview nokogiri is a gem for parsing HTML, XML, SAX, and Reader. Affected versions of this package are vulnerable to Out-of-Bounds through the processing of crafted XML documents in the xmlSchemaValidateStream or xmlEncodeEntitiesInternal functions. An attacker can cause denial of service,...

Out-of-Bounds

Overview nokogiri is a gem for parsing HTML, XML, SAX, and Reader. Affected versions of this package are vulnerable to Out-of-Bounds via the buffer handling process in the packaged libxml2 component. An attacker can cause out-of-bounds memory writes by submitting specially crafted multi-gigabyte...

Use After Free

Overview nokogiri is a gem for parsing HTML, XML, SAX, and Reader. Affected versions of this package are vulnerable to Use After Free in the processing of XML documents with untrusted XSL stylesheets or when parsing untrusted documents with specific parse options enabled. An attacker can cause...

NULL Pointer Dereference

Overview nokogiri is a gem for parsing HTML, XML, SAX, and Reader. Affected versions of this package are vulnerable to NULL Pointer Dereference via the XML Schema processing in the packaged libxml2 library. An attacker can cause a segmentation fault and disrupt service by supplying a crafted or...

Out-of-bounds Write

Overview nokogiri is a gem for parsing HTML, XML, SAX, and Reader. Affected versions of this package are vulnerable to Out-of-bounds Write via the processing of DTD validation errors with long QName prefixes and during validation against untrusted XML Schemas. An attacker can execute arbitrary co...

Out-of-bounds Read

Amendment This was deemed not a vulnerability. Overview nokogiri is a gem for parsing HTML, XML, SAX, and Reader. Affected versions of this package are vulnerable to Out-of-bounds Read via the xmlSchemaIDCFillNodeTables function. An attacker can cause a denial of service by submitting specially...

UBUNTU-CVE-2026-79772

Nokogiri versions before 1.19.1 fail to check the return value from xmlC14NExecute in the canonicalize method, returning an empty string on failure instead of raising an exception. Attackers can exploit this to bypass signature validation in downstream SAML libraries by providing invalid...

CVE-2026-79772

Nokogiri versions before 1.19.1 fail to check the return value from xmlC14NExecute in the canonicalize method, returning an empty string on failure instead of raising an exception. Attackers can exploit this to bypass signature validation in downstream SAML libraries by providing invalid...

CVE-2025-71346

Rejected reason: This CVE ID has been rejected as a duplicate...

CVE-2022-51000

Rejected reason: This CVE ID has been rejected as a duplicate...

CVE-2023-54354

Rejected reason: This CVE ID has been rejected as a duplicate...

CVE-2021-47996

Nokogiri before 1.11.4 CRuby implementation only, when the packaged/vendored libxml2 is used bundles libxml2 2.9.10, which is affected by multiple vulnerabilities addressed in libxml2 2.9.12, including a memory leak in xmlSchemaValidateStream CVE-2019-20388, a global buffer over-read in...

CVE-2021-47996

Rejected reason: This CVE ID has been rejected as a duplicate...

CVE-2023-54354

Nokogiri before 1.14.3 CRuby implementation only, when using the packaged libxml2 bundles libxml2 v2.10.3, which is vulnerable to NULL pointer dereferences in XML Schema processing xmlSchemaFixupComplexType, CVE-2023-28484, and xmlSchemaCheckCOSSTDerivedOK. An attacker who supplies a...

CVE-2025-71407

Nokogiri before 1.18.3 contains a stack buffer overflow vulnerability in libxml2 when reporting DTD validation errors with long QName prefixes, and a use-after-free vulnerability during validation against untrusted XML Schemas. Attackers can trigger these vulnerabilities by providing malicious DT...

CVE-2021-47996

Nokogiri before 1.11.4 CRuby implementation only, when the packaged/vendored libxml2 is used bundles libxml2 2.9.10, which is affected by multiple vulnerabilities addressed in libxml2 2.9.12, including a memory leak in xmlSchemaValidateStream CVE-2019-20388, a global buffer over-read in...

CVE-2022-50998

Nokogiri before 1.13.9 CRuby implementation using packaged libraries bundles libxml2 v2.9.14, which is affected by CVE-2022-40304 data corruption / double-free from an entity reference cycle when entity content is allocated from a dict and CVE-2022-40303 integer overflows when parsing with...

UBUNTU-CVE-2022-50999

Nokogiri versions before 1.13.5 contain an integer overflow vulnerability in packaged libxml2 buffer handling functions that allows attackers to cause out-of-bounds memory writes. Attackers can exploit this by crafting multi-gigabyte XML files to trigger buffer overflows resulting in information...

UBUNTU-CVE-2022-50998

Nokogiri before 1.13.9 CRuby implementation using packaged libraries bundles libxml2 v2.9.14, which is affected by CVE-2022-40304 data corruption / double-free from an entity reference cycle when entity content is allocated from a dict and CVE-2022-40303 integer overflows when parsing with...

UBUNTU-CVE-2023-54354

Nokogiri before 1.14.3 CRuby implementation only, when using the packaged libxml2 bundles libxml2 v2.10.3, which is vulnerable to NULL pointer dereferences in XML Schema processing xmlSchemaFixupComplexType, CVE-2023-28484, and xmlSchemaCheckCOSSTDerivedOK. An attacker who supplies a...