Every CVE Search/ Get API key

CVE-2023-54354

Nokogiri before 1.14.3 (CRuby implementation only, when using the packaged libxml2) bundles...

8.7 HighFix availableRejected

This CVE ID has been rejected as a duplicate.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

What each source reports

GitHub Advisories Score usedGHSA-8rv6-h2q6-qfg5 8.7

Nokogiri before 1.14.3 (CRuby implementation only, when using the packaged libxml2) bundles...

Nokogiri before 1.14.3 (CRuby implementation only, when using the packaged libxml2) bundles libxml2 v2.10.3, which is vulnerable to NULL pointer dereferences in XML Schema processing (xmlSchemaFixupComplexType, CVE-2023-28484, and xmlSchemaCheckCOSSTDerivedOK). An attacker who supplies a crafted/malformed XML schema can cause libxml2 to dereference a NULL pointer and potentially segfault, resulting in a denial of service. Nokogiri 1.14.3 upgrades the packaged libxml2 to v2.10.4 to resolve these issues.

Record
GHSA-8rv6-h2q6-qfg5
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-476
Updated
2026-11-02
CVE List No score

This CVE ID has been rejected as a duplicate.

Record
CVE-2023-54354
Updated
2026-11-02
EUVDEUVD-2023-60605 8.7

This CVE ID has been rejected as a duplicate.

Record
EUVD-2023-60605
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-pxvg-2qj5-37jq No score

Nokogiri updates packaged libxml2 to v2.10.4 to resolve multiple CVEs

Summary

Nokogiri v1.14.3 upgrades the packaged version of its dependency libxml2 to v2.10.4 from v2.10.3.

libxml2 v2.10.4 addresses the following known vulnerabilities:

  • CVE-2023-29469: Hashing of empty dict strings isn't deterministic
  • CVE-2023-28484: Fix null deref in xmlSchemaFixupComplexType
  • Schemas: Fix null-pointer-deref in xmlSchemaCheckCOSSTDerivedOK

Please note that this advisory only applies to the CRuby implementation of Nokogiri < 1.14.3, and only if the packaged libraries are being used. If you've overridden defaults at installation time to use system libraries instead of packaged libraries, you should instead pay attention to your distro's libxml2 release announcements.

Mitigation

Upgrade to Nokogiri >= 1.14.3.

Users who are unable to upgrade Nokogiri may also choose a more complicated mitigation: compile and link Nokogiri against external libraries libxml2 >= 2.10.4 which will also address these same issues.

Impact

No public information has yet been published about the security-related issues other than the upstream commits. Examination of those changesets indicate that the more serious issues relate to libxml2 dereferencing NULL pointers and potentially segfaulting while parsing untrusted inputs.

The commits can be examined at:

Record
GHSA-pxvg-2qj5-37jq
Updated
2026-11-02
NVD No score

Rejected reason: This CVE ID has been rejected as a duplicate.

Record
CVE-2023-54354
Updated
2026-11-02
OSVBELL-CVE-2023-54354 7.5
Record
BELL-CVE-2023-54354
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSV 8.7

Nokogiri before 1.14.3 Null Pointer Dereference via libxml2

Nokogiri before 1.14.3 (CRuby implementation only, when using the packaged libxml2) bundles libxml2 v2.10.3, which is vulnerable to NULL pointer dereferences in XML Schema processing (xmlSchemaFixupComplexType, CVE-2023-28484, and xmlSchemaCheckCOSSTDerivedOK). An attacker who supplies a crafted/malformed XML schema can cause libxml2 to dereference a NULL pointer and potentially segfault, resulting in a denial of service. Nokogiri 1.14.3 upgrades the packaged libxml2 to v2.10.4 to resolve these issues.

Record
CVE-2023-54354
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-476
Updated
2026-11-02
OSVUBUNTU-CVE-2023-54354 8.7

Nokogiri before 1.14.3 (CRuby implementation only, when using the packaged libxml2) bundles libxml2 v2.10.3, which is vulnerable to NULL pointer dereferences in XML Schema processing (xmlSchemaFixupComplexType, CVE-2023-28484, and xmlSchemaCheckCOSSTDerivedOK). An attacker who supplies a crafted/malformed XML schema can cause libxml2 to dereference a NULL pointer and potentially segfault, resulting in a denial of service. Nokogiri 1.14.3 upgrades the packaged libxml2 to v2.10.4 to resolve these issues.

Record
UBUNTU-CVE-2023-54354
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVGHSA-pxvg-2qj5-37jq No score

Nokogiri updates packaged libxml2 to v2.10.4 to resolve multiple CVEs

Summary

Nokogiri v1.14.3 upgrades the packaged version of its dependency libxml2 to v2.10.4 from v2.10.3.

libxml2 v2.10.4 addresses the following known vulnerabilities:

  • CVE-2023-29469: Hashing of empty dict strings isn't deterministic
  • CVE-2023-28484: Fix null deref in xmlSchemaFixupComplexType
  • Schemas: Fix null-pointer-deref in xmlSchemaCheckCOSSTDerivedOK

Please note that this advisory only applies to the CRuby implementation of Nokogiri < 1.14.3, and only if the packaged libraries are being used. If you've overridden defaults at installation time to use system libraries instead of packaged libraries, you should instead pay attention to your distro's libxml2 release announcements.

Mitigation

Upgrade to Nokogiri >= 1.14.3.

Users who are unable to upgrade Nokogiri may also choose a more complicated mitigation: compile and link Nokogiri against external libraries libxml2 >= 2.10.4 which will also address these same issues.

Impact

No public information has yet been published about the security-related issues other than the upstream commits. Examination of those changesets indicate that the more serious issues relate to libxml2 dereferencing NULL pointers and potentially segfaulting while parsing untrusted inputs.

The commits can be examined at:

Record
GHSA-pxvg-2qj5-37jq
Updated
2026-11-02

Affected packages

Affected packages
PackageAffectedFixed
nokogiri
RubyGems
 before 1.14.3
1.14.3
ruby-nokogiri
Alpaquita:23
 1.13.9-r1 up to 1.16.7-r0
1.16.7-r0
ruby-nokogiri
Alpaquita:stream
 1.13.9-r1 up to 1.15.3-r0
1.15.3-r0
nokogiri
RubyGems
 before 1.14.3, plus listed versions
1.0.01.0.11.0.21.0.31.0.4
Show 45 moreShow less
1.0.51.0.61.0.71.1.01.1.11.10.01.10.0.rc11.10.11.10.101.10.21.10.31.10.41.10.51.10.61.10.71.10.81.10.91.11.01.11.0.rc11.11.0.rc21.11.0.rc31.11.0.rc41.11.11.11.21.11.31.11.41.11.51.11.61.11.71.12.01.12.0.rc11.12.11.12.21.12.31.12.41.12.51.13.01.13.11.13.101.13.21.13.31.13.41.13.51.13.61.13.7
1.14.3

History

History
RecordedChangedSources
affected
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-54354 has been rejected by its source and should not be treated as a live vulnerability, published April 11, 2023. Fixed in nokogiri 1.14.3.

References

Show 16 moreShow less
This page doesn't list everything

Left out here: 104 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open