Every CVE Search/ Get API key

CVE-2022-23476

Unchecked return value from xmlTextReaderExpand in Nokogiri

7.5 HighFix available

Nokogiri is an open source XML and HTML library for the Ruby programming language. Nokogiri 1.13.8 and 1.13.9 fail to check the return value from xmlTextReaderExpand in the method Nokogiri::XML::Reader#attribute_hash. This can lead to a null pointer exception when invalid markup is being parsed. For applications using XML::Reader to parse untrusted inputs, this may potentially be a vector for a denial of service attack. Users are advised to upgrade to Nokogiri >= 1.13.10. Users may be able to search their code for calls to either XML::Reader#attributes or XML::Reader#attribute_hash to determine if they are affected.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

1.82%Up 0.9 points since Dec 8, 2022
90%50%10%1%

What each source reports

CVE List Score used 7.5

Unchecked return value from xmlTextReaderExpand in Nokogiri

Nokogiri is an open source XML and HTML library for the Ruby programming language. Nokogiri 1.13.8 and 1.13.9 fail to check the return value from xmlTextReaderExpand in the method Nokogiri::XML::Reader#attribute_hash. This can lead to a null pointer exception when invalid markup is being parsed. For applications using XML::Reader to parse untrusted inputs, this may potentially be a vector for a denial of service attack. Users are advised to upgrade to Nokogiri >= 1.13.10. Users may be able to search their code for calls to either XML::Reader#attributes or XML::Reader#attribute_hash to determine if they are affected.

Record
CVE-2022-23476
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-252, CWE-476
Updated
2026-11-02
EUVDEUVD-2022-7725 7.5

Nokogiri is an open source XML and HTML library for the Ruby programming language. Nokogiri 1.13.8 and 1.13.9 fail to check the return value from xmlTextReaderExpand in the method Nokogiri::XML::Reader#attribute_hash. This can lead to a null pointer exception when invalid markup is being parsed. For applications using XML::Reader to parse untrusted inputs, this may potentially be a vector for a denial of service attack. Users are advised to upgrade to Nokogiri >= 1.13.10. Users may be able to search their code for calls to either XML::Reader#attributes or XML::Reader#attribute_hash to determine if they are affected.

Record
EUVD-2022-7725
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-qv4q-mr5r-qprj 7.5

Unchecked return value from xmlTextReaderExpand

Summary

Nokogiri 1.13.8, 1.13.9 fails to check the return value from xmlTextReaderExpand in the method Nokogiri::XML::Reader#attribute_hash. This can lead to a null pointer exception when invalid markup is being parsed.

For applications using XML::Reader to parse untrusted inputs, this may potentially be a vector for a denial of service attack.

Mitigation

Upgrade to Nokogiri >= 1.13.10.

Users may be able to search their code for calls to either XML::Reader#attributes or XML::Reader#attribute_hash to determine if they are affected.

Severity

The Nokogiri maintainers have evaluated this as High Severity 7.5 (CVSS3.1).

References

Credit

This vulnerability was responsibly reported by @davidwilemski.

Record
GHSA-qv4q-mr5r-qprj
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-252, CWE-476
Updated
2026-11-02
NVD 7.5

Nokogiri is an open source XML and HTML library for the Ruby programming language. Nokogiri 1.13.8 and 1.13.9 fail to check the return value from xmlTextReaderExpand in the method Nokogiri::XML::Reader#attribute_hash. This can lead to a null pointer exception when invalid markup is being parsed. For applications using XML::Reader to parse untrusted inputs, this may potentially be a vector for a denial of service attack. Users are advised to upgrade to Nokogiri >= 1.13.10. Users may be able to search their code for calls to either XML::Reader#attributes or XML::Reader#attribute_hash to determine if they are affected.

Record
CVE-2022-23476
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-252, CWE-476
Updated
2026-11-02
OSVALPINE-CVE-2022-23476 7.5

Nokogiri is an open source XML and HTML library for the Ruby programming language. Nokogiri 1.13.8 and 1.13.9 fail to check the return value from xmlTextReaderExpand in the method Nokogiri::XML::Reader#attribute_hash. This can lead to a null pointer exception when invalid markup is being parsed. For applications using XML::Reader to parse untrusted inputs, this may potentially be a vector for a denial of service attack. Users are advised to upgrade to Nokogiri >= 1.13.10. Users may be able to search their code for calls to either XML::Reader#attributes or XML::Reader#attribute_hash to determine if they are affected.

Record
ALPINE-CVE-2022-23476
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-03
OSVBELL-CVE-2022-23476 7.5

CVE-2022-23476 does not affect BellSoft software

Record
BELL-CVE-2022-23476
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 8 moreShow less
OSV 7.5

Unchecked return value from xmlTextReaderExpand in Nokogiri

Nokogiri is an open source XML and HTML library for the Ruby programming language. Nokogiri 1.13.8 and 1.13.9 fail to check the return value from xmlTextReaderExpand in the method Nokogiri::XML::Reader#attribute_hash. This can lead to a null pointer exception when invalid markup is being parsed. For applications using XML::Reader to parse untrusted inputs, this may potentially be a vector for a denial of service attack. Users are advised to upgrade to Nokogiri >= 1.13.10. Users may be able to search their code for calls to either XML::Reader#attributes or XML::Reader#attribute_hash to determine if they are affected.

Record
CVE-2022-23476
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-252, CWE-476
Updated
2026-11-02
OSVDEBIAN-CVE-2022-23476 7.5

Nokogiri is an open source XML and HTML library for the Ruby programming language. Nokogiri 1.13.8 and 1.13.9 fail to check the return value from xmlTextReaderExpand in the method Nokogiri::XML::Reader#attribute_hash. This can lead to a null pointer exception when invalid markup is being parsed. For applications using XML::Reader to parse untrusted inputs, this may potentially be a vector for a denial of service attack. Users are advised to upgrade to Nokogiri >= 1.13.10. Users may be able to search their code for calls to either XML::Reader#attributes or XML::Reader#attribute_hash to determine if they are affected.

Record
DEBIAN-CVE-2022-23476
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-03
OSVGHSA-qv4q-mr5r-qprj 7.5

Unchecked return value from xmlTextReaderExpand

Summary

Nokogiri 1.13.8, 1.13.9 fails to check the return value from xmlTextReaderExpand in the method Nokogiri::XML::Reader#attribute_hash. This can lead to a null pointer exception when invalid markup is being parsed.

For applications using XML::Reader to parse untrusted inputs, this may potentially be a vector for a denial of service attack.

Mitigation

Upgrade to Nokogiri >= 1.13.10.

Users may be able to search their code for calls to either XML::Reader#attributes or XML::Reader#attribute_hash to determine if they are affected.

Severity

The Nokogiri maintainers have evaluated this as High Severity 7.5 (CVSS3.1).

References

Credit

This vulnerability was responsibly reported by @davidwilemski.

Record
GHSA-qv4q-mr5r-qprj
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-252, CWE-476
Updated
2026-11-02
OSVUBUNTU-CVE-2022-23476 7.5

Nokogiri is an open source XML and HTML library for the Ruby programming language. Nokogiri 1.13.8 and 1.13.9 fail to check the return value from xmlTextReaderExpand in the method Nokogiri::XML::Reader#attribute_hash. This can lead to a null pointer exception when invalid markup is being parsed. For applications using XML::Reader to parse untrusted inputs, this may potentially be a vector for a denial of service attack. Users are advised to upgrade to Nokogiri >= 1.13.10. Users may be able to search their code for calls to either XML::Reader#attributes or XML::Reader#attribute_hash to determine if they are affected.

Record
UBUNTU-CVE-2022-23476
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVopenSUSE-SU-2024:13440-1 No score

ruby3.2-rubygem-nokogiri-1.15.4-1.1 on GA media

These are all security issues fixed in the ruby3.2-rubygem-nokogiri-1.15.4-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:13440-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:14174-1 No score

ruby3.3-rubygem-nokogiri-1.15.5-1.5 on GA media

These are all security issues fixed in the ruby3.3-rubygem-nokogiri-1.15.5-1.5 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:14174-1
Updated
2026-11-02
OSVopenSUSE-SU-2025:14697-1 No score

ruby3.4-rubygem-nokogiri-1.18.2-1.1 on GA media

These are all security issues fixed in the ruby3.4-rubygem-nokogiri-1.18.2-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:14697-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:10356-1 No score

ruby4.0-rubygem-nokogiri-1.18.9-1.4 on GA media

These are all security issues fixed in the ruby4.0-rubygem-nokogiri-1.18.9-1.4 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10356-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
nokogiri
RubyGems
 1.13.8 up to 1.13.10
1.13.10
ruby-nokogiri
Alpine:v3.16
 before 1.13.10-r0
1.13.10-r0
ruby-nokogiri
Alpine:v3.17
 before 1.13.10-r0
1.13.10-r0
ruby-nokogiri
Alpine:v3.18
 before 1.13.10-r0
1.13.10-r0
ruby-nokogiri
Alpine:v3.19
 before 1.13.10-r0
1.13.10-r0
ruby-nokogiri
Alpine:v3.20
 before 1.13.10-r0
1.13.10-r0
ruby-nokogiri
Alpine:v3.21
 before 1.13.10-r0
1.13.10-r0
ruby-nokogiri
Alpine:v3.22
 before 1.13.10-r0
1.13.10-r0
ruby-nokogiri
Alpine:v3.23
 before 1.13.10-r0
1.13.10-r0
ruby-nokogiri
Alpine:v3.24
 before 1.13.10-r0
1.13.10-r0
Show 8 moreShow less
Affected packages
PackageAffectedFixed
ruby-nokogiri
Debian:12
 before 1.13.10+dfsg-1
1.13.10+dfsg-1
ruby-nokogiri
Debian:13
 before 1.13.10+dfsg-1
1.13.10+dfsg-1
ruby-nokogiri
Debian:14
 before 1.13.10+dfsg-1
1.13.10+dfsg-1
nokogiri
RubyGems
 1.13.8 up to 1.13.10, plus listed versions
1.13.9
1.13.10
ruby3.2-rubygem-nokogiri
openSUSE:Tumbleweed
 before 1.15.4-1.1
1.15.4-1.1
rubygem-nokogiri
openSUSE:Tumbleweed
 before 1.15.5-1.5
1.15.5-1.5
rubygem-nokogiri
openSUSE:Tumbleweed
 before 1.18.2-1.1
1.18.2-1.1
rubygem-nokogiri
openSUSE:Tumbleweed
 before 1.18.9-1.4
1.18.9-1.4

History

History
RecordedChangedSources
affected, aliases, referencesOSV
affected
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-23476 is a high vulnerability (CVSS 7.5) in Nokogiri, published December 8, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.82%, the 78th percentile. Fixed in nokogiri 1.13.10.

References

Show 52 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open