CVE-2022-50998: Nokogiri before 1.13.9 Multiple Vulnerabilities via libxml2

Q: Which Nokogiri deployments are affected?

Affected deployments use the CRuby implementation of Nokogiri with packaged libraries and a Nokogiri version earlier than 1.13.9. The issue described is tied to the bundled libxml2 2.9.14.

Q: What must an attacker provide to trigger the issue?

An attacker would need to cause the application to process crafted XML input. One of the referenced flaws involves entity-reference cycles, and another is triggered when parsing with XML_PARSE_HUGE.

Q: What is the practical impact of processing malicious XML?

Processing crafted XML may cause denial of service or memory corruption. The affected libxml2 flaws include data corruption or double-free behavior and integer overflows.

Q: What remediation is identified?

Upgrade Nokogiri to version 1.13.9, which updates its packaged libxml2 from 2.9.14 to 2.10.3. The advisory states that this addresses the relevant libxml2 issues.

Q: Does the referenced NULL pointer dereference affect Nokogiri users?

No. Although the advisory references CVE-2022-2309, Nokogiri maintainers determined that it does not affect Nokogiri users.

Published Aug 25, 2026

Updated

Nokogiri before 1.13.9 (CRuby implementation using packaged libraries) bundles libxml2 v2.9.14, which is affected by CVE-2022-40304 (data corruption / double-free from an entity reference cycle when entity content is allocated from a dict) and CVE-2022-40303 (integer overflows when parsing with XMLPARSEHUGE). Nokogiri 1.13.9 upgrades the packaged libxml2 to v2.10.3 to address these issues. Processing crafted XML input may lead to denial of service or memory corruption. (The advisory also references CVE-2022-2309, a NULL pointer dereference via iterwalk/canonicalize, which maintainers determined does not affect Nokogiri users.)

Affected Software

1 affected component

Nokogiri<1.13.9

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Nokogiri to a version that resolves this vulnerability.
Fixed in 1.13.9
Compensating control
When possible, avoid processing crafted/untrusted XML input; limit or sanitize XML sources to reduce the risk of denial of service or memory corruption triggered by the affected libxml2 versions bundled with Nokogiri prior to 1.13.9.

Event History

Aug 25, 2026

CVE Published

via MITRE·03:15 PM

Data Sourced

via MITRE·03:15 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which Nokogiri deployments are affected?

Affected deployments use the CRuby implementation of Nokogiri with packaged libraries and a Nokogiri version earlier than 1.13.9. The issue described is tied to the bundled libxml2 2.9.14.

What must an attacker provide to trigger the issue?

An attacker would need to cause the application to process crafted XML input. One of the referenced flaws involves entity-reference cycles, and another is triggered when parsing with XML_PARSE_HUGE.

What is the practical impact of processing malicious XML?

Processing crafted XML may cause denial of service or memory corruption. The affected libxml2 flaws include data corruption or double-free behavior and integer overflows.

What remediation is identified?

Upgrade Nokogiri to version 1.13.9, which updates its packaged libxml2 from 2.9.14 to 2.10.3. The advisory states that this addresses the relevant libxml2 issues.

Does the referenced NULL pointer dereference affect Nokogiri users?

No. Although the advisory references CVE-2022-2309, Nokogiri maintainers determined that it does not affect Nokogiri users.

CVE-2022-50998: Nokogiri before 1.13.9 Multiple Vulnerabilities via libxml2

Affected Software

Remediation

Event History

Frequently Asked Questions

Which Nokogiri deployments are affected?

What must an attacker provide to trigger the issue?

What is the practical impact of processing malicious XML?

What remediation is identified?

Does the referenced NULL pointer dereference affect Nokogiri users?

Company

Resources

Contact

Frequently Asked Questions

Which Nokogiri deployments are affected?

What must an attacker provide to trigger the issue?

What is the practical impact of processing malicious XML?

What remediation is identified?

Does the referenced NULL pointer dereference affect Nokogiri users?