CVE-2021-47996
Nokogiri before 1.11.4 (CRuby implementation only, when the packaged/vendored libxml2 is used)...
This CVE ID has been rejected as a duplicate.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
What each source reports
GitHub Advisories Score usedGHSA-593j-84wv-vpv9
Nokogiri before 1.11.4 (CRuby implementation only, when the packaged/vendored libxml2 is used)...
Nokogiri before 1.11.4 (CRuby implementation only, when the packaged/vendored libxml2 is used) bundles libxml2 2.9.10, which is affected by multiple vulnerabilities addressed in libxml2 2.9.12, including a memory leak in xmlSchemaValidateStream (CVE-2019-20388), a global buffer over-read in xmlEncodeEntitiesInternal (CVE-2020-24977), a heap-based buffer overflow (CVE-2021-3517), and an out-of-bounds read (CVE-2021-3518). Processing crafted XML documents may lead to denial of service, information disclosure, or memory corruption.
- Record
GHSA-593j-84wv-vpv9- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE List No score
This CVE ID has been rejected as a duplicate.
- Record
CVE-2021-47996- Updated
- 2026-11-02
EUVDEUVD-2021-34866
This CVE ID has been rejected as a duplicate.
- Record
EUVD-2021-34866- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-7rrm-v45f-jp64 No score
Nokogiri updates packaged dependency on libxml2 from 2.9.10 to 2.9.12
Summary
Nokogiri v1.11.4 updates the vendored libxml2 from v2.9.10 to v2.9.12 which addresses:
- CVE-2019-20388 (Medium severity)
- CVE-2020-24977 (Medium severity)
- CVE-2021-3517 (Medium severity)
- CVE-2021-3518 (Medium severity)
- CVE-2021-3537 (Low severity)
- CVE-2021-3541 (Low severity)
Note that two additional CVEs were addressed upstream but are not relevant to this release. CVE-2021-3516 via xmllint is not present in Nokogiri, and CVE-2020-7595 has been patched in Nokogiri since v1.10.8 (see #1992).
Please note that this advisory only applies to the CRuby implementation of Nokogiri < 1.11.4, and only if the packaged version of libxml2 is being used. If you've overridden defaults at installation time to use system libraries instead of packaged libraries, you should instead pay attention to your distro's libxml2 release announcements.
Mitigation
Upgrade to Nokogiri >= 1.11.4.
Impact
I've done a brief analysis of the published CVEs that are addressed in this upstream release. The libxml2 maintainers have not released a canonical set of CVEs, and so this list is pieced together from secondary sources and may be incomplete.
All information below is sourced from security.archlinux.org, which appears to have the most up-to-date information as of this analysis.
CVE-2019-20388
- Severity: Medium
- Type: Denial of service
- Description: A memory leak was found in the xmlSchemaValidateStream function of libxml2. Applications that use this library may be vulnerable to memory not being freed leading to a denial of service.
- Fixed: https://gitlab.gnome.org/GNOME/libxml2/commit/7ffcd44d7e6c46704f8af0321d9314cd26e0e18a
Verified that the fix commit first appears in v2.9.11. It seems possible that this issue would be present in programs using Nokogiri < v1.11.4.
CVE-2020-7595
- Severity: Medium
- Type: Denial of service
- Description: xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation.
- Fixed: https://gitlab.gnome.org/GNOME/libxml2/commit/0e1a49c8907645d2e155f0d89d4d9895ac5112b5
This has been patched in Nokogiri since v1.10.8 (see #1992).
CVE-2020-24977
- Severity: Medium
- Type: Information disclosure
- Description: GNOME project libxml2 <= 2.9.10 has a global buffer over-read vulnerability in xmlEncodeEntitiesInternal at libxml2/entities.c.
- Fixed: https://gitlab.gnome.org/GNOME/libxml2/commit/50f06b3efb638efb0abd95dc62dca05ae67882c2
Verified that the fix commit first appears in v2.9.11. It seems possible that this issue would be present in programs using Nokogiri < v1.11.4.
CVE-2021-3516
- Severity: Medium
- Type: Arbitrary code execution (no remote vector)
- Description: A use-after-free security issue was found libxml2 before version 2.9.11 when "xmllint --html --push" is used to process crafted files.
- Issue: https://gitlab.gnome.org/GNOME/libxml2/-/issues/230
- Fixed: https://gitlab.gnome.org/GNOME/libxml2/-/commit/1358d157d0bd83be1dfe356a69213df9fac0b539
Verified that the fix commit first appears in v2.9.11. This vector does not exist within Nokogiri, which does not ship xmllint.
CVE-2021-3517
- Severity: Medium
- Type: Arbitrary code execution
- Description:…
- Record
GHSA-7rrm-v45f-jp64- Updated
- 2026-11-02
NVD No score
Rejected reason: This CVE ID has been rejected as a duplicate.
- Record
CVE-2021-47996- Updated
- 2026-11-02
OSV
Nokogiri before 1.11.4 (CRuby implementation only, when the packaged/vendored libxml2 is used) bundles libxml2 2.9.10, which is affected by multiple vulnerabilities addressed in libxml2 2.9.12, including a memory leak in xmlSchemaValidateStream (CVE-2019-20388), a global buffer over-read in xmlEncodeEntitiesInternal (CVE-2020-24977), a heap-based buffer overflow (CVE-2021-3517), and an out-of-bounds read (CVE-2021-3518). Processing crafted XML documents may lead to denial of service, information disclosure, or memory corruption.
- Record
CVE-2021-47996- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-47996
Nokogiri before 1.11.4 (CRuby implementation only, when the packaged/vendored libxml2 is used) bundles libxml2 2.9.10, which is affected by multiple vulnerabilities addressed in libxml2 2.9.12, including a memory leak in xmlSchemaValidateStream (CVE-2019-20388), a global buffer over-read in xmlEncodeEntitiesInternal (CVE-2020-24977), a heap-based buffer overflow (CVE-2021-3517), and an out-of-bounds read (CVE-2021-3518). Processing crafted XML documents may lead to denial of service, information disclosure, or memory corruption.
- Record
UBUNTU-CVE-2021-47996- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVGHSA-7rrm-v45f-jp64 No score
Nokogiri updates packaged dependency on libxml2 from 2.9.10 to 2.9.12
Summary
Nokogiri v1.11.4 updates the vendored libxml2 from v2.9.10 to v2.9.12 which addresses:
- CVE-2019-20388 (Medium severity)
- CVE-2020-24977 (Medium severity)
- CVE-2021-3517 (Medium severity)
- CVE-2021-3518 (Medium severity)
- CVE-2021-3537 (Low severity)
- CVE-2021-3541 (Low severity)
Note that two additional CVEs were addressed upstream but are not relevant to this release. CVE-2021-3516 via xmllint is not present in Nokogiri, and CVE-2020-7595 has been patched in Nokogiri since v1.10.8 (see #1992).
Please note that this advisory only applies to the CRuby implementation of Nokogiri < 1.11.4, and only if the packaged version of libxml2 is being used. If you've overridden defaults at installation time to use system libraries instead of packaged libraries, you should instead pay attention to your distro's libxml2 release announcements.
Mitigation
Upgrade to Nokogiri >= 1.11.4.
Impact
I've done a brief analysis of the published CVEs that are addressed in this upstream release. The libxml2 maintainers have not released a canonical set of CVEs, and so this list is pieced together from secondary sources and may be incomplete.
All information below is sourced from security.archlinux.org, which appears to have the most up-to-date information as of this analysis.
CVE-2019-20388
- Severity: Medium
- Type: Denial of service
- Description: A memory leak was found in the xmlSchemaValidateStream function of libxml2. Applications that use this library may be vulnerable to memory not being freed leading to a denial of service.
- Fixed: https://gitlab.gnome.org/GNOME/libxml2/commit/7ffcd44d7e6c46704f8af0321d9314cd26e0e18a
Verified that the fix commit first appears in v2.9.11. It seems possible that this issue would be present in programs using Nokogiri < v1.11.4.
CVE-2020-7595
- Severity: Medium
- Type: Denial of service
- Description: xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation.
- Fixed: https://gitlab.gnome.org/GNOME/libxml2/commit/0e1a49c8907645d2e155f0d89d4d9895ac5112b5
This has been patched in Nokogiri since v1.10.8 (see #1992).
CVE-2020-24977
- Severity: Medium
- Type: Information disclosure
- Description: GNOME project libxml2 <= 2.9.10 has a global buffer over-read vulnerability in xmlEncodeEntitiesInternal at libxml2/entities.c.
- Fixed: https://gitlab.gnome.org/GNOME/libxml2/commit/50f06b3efb638efb0abd95dc62dca05ae67882c2
Verified that the fix commit first appears in v2.9.11. It seems possible that this issue would be present in programs using Nokogiri < v1.11.4.
CVE-2021-3516
- Severity: Medium
- Type: Arbitrary code execution (no remote vector)
- Description: A use-after-free security issue was found libxml2 before version 2.9.11 when "xmllint --html --push" is used to process crafted files.
- Issue: https://gitlab.gnome.org/GNOME/libxml2/-/issues/230
- Fixed: https://gitlab.gnome.org/GNOME/libxml2/-/commit/1358d157d0bd83be1dfe356a69213df9fac0b539
Verified that the fix commit first appears in v2.9.11. This vector does not exist within Nokogiri, which does not ship xmllint.
CVE-2021-3517
- Severity: Medium
- Type: Arbitrary code execution
- Description:…
- Record
GHSA-7rrm-v45f-jp64- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
nokogiriRubyGems |
before 1.11.4 | 1.11.4 |
nokogiriRubyGems |
before 1.11.4, plus listed versions 1.0.01.0.11.0.21.0.31.0.4 Show 45 moreShow less1.0.51.0.61.0.71.1.01.1.11.10.01.10.0.rc11.10.11.10.101.10.21.10.31.10.41.10.51.10.61.10.71.10.81.10.91.11.01.11.0.rc11.11.0.rc21.11.0.rc31.11.0.rc41.11.11.11.21.11.31.2.01.2.11.2.21.2.31.3.01.3.11.3.21.3.31.4.01.4.11.4.21.4.2.11.4.31.4.3.11.4.41.4.4.11.4.4.21.4.51.4.61.4.7 |
1.11.4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-47996 has been rejected by its source and should not be treated as a live vulnerability, published May 17, 2021. Fixed in nokogiri 1.11.4.
References
github.com/sparklemotion/nokogiri/security/advisories/GHSA-7rrm-v45f-jp64
nvd.nist.gov/vuln/detail/CVE-2021-47996
Show 20 moreShow less
vulncheck.com/advisories/nokogiri-before-multiple-vulnerabilities-via-libxml2
ubuntu.com/security/CVE-2021-47996
cve.org/CVERecord?id=CVE-2021-47996
Left out here: 78 versions and the rest of 2 source descriptions. The JSON record has them.