CVE-2022-50998

Analyzed Analyzed - Analysis Complete

Nokogiri libxml2 Memory Corruption Vulnerabilities

Publication date: 2026-08-25

Last updated on: 2026-09-08

Assigner: VulnCheck

Description

Rejected reason: This CVE ID has been rejected as a duplicate.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-25

Last Modified

2026-09-08

Generated

2026-09-14

AI Q&A

2026-08-25

EPSS Evaluated

2026-09-07

NVD

CVE-2022-50998

EUVD

EUVD-2022-56023

Affected Vendors & Products

Vendor	Product	Version / Range
nokogiri	nokogiri	to 1.13.9 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-476	The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

Executive Summary

This vulnerability affects Nokogiri before version 1.13.9, which bundles libxml2 v2.9.14. It includes issues like CVE-2022-40304 (data corruption from entity reference cycles) and CVE-2022-40303 (integer overflows with XML_PARSE_HUGE). Processing crafted XML may cause denial of service or memory corruption.

Detection Guidance

Check Nokogiri version with gem list nokogiri. If using CRuby with packaged libraries and version is below 1.13.9, the system is vulnerable. For libxml2, run xml2-config --version and verify it is below 2.10.3.

Impact Analysis

If you use Nokogiri versions below 1.13.9 with packaged libraries, an attacker could exploit this to crash your application or corrupt memory by sending specially crafted XML input.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA. The issue involves denial of service or memory corruption in XML processing, which could indirectly impact data integrity or availability. However, no specific compliance implications are mentioned in the provided context.

Mitigation Strategies

Upgrade Nokogiri to version 1.13.9 or later using gem install nokogiri -v 1.13.9. If using system libxml2, update it to version 2.10.3 or higher via your package manager.

Hi! I’m here to help you understand CVE-2022-50998. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70