CVE-2022-50998
Received Received - Intake

Nokogiri libxml2 Memory Corruption Vulnerabilities

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: VulnCheck

Description
Nokogiri before 1.13.9 (CRuby implementation using packaged libraries) bundles libxml2 v2.9.14, which is affected by CVE-2022-40304 (data corruption / double-free from an entity reference cycle when entity content is allocated from a dict) and CVE-2022-40303 (integer overflows when parsing with XML_PARSE_HUGE). Nokogiri 1.13.9 upgrades the packaged libxml2 to v2.10.3 to address these issues. Processing crafted XML input may lead to denial of service or memory corruption. (The advisory also references CVE-2022-2309, a NULL pointer dereference via iterwalk/canonicalize, which maintainers determined does not affect Nokogiri users.)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-25
Last Modified
2026-08-25
Generated
2026-08-25
AI Q&A
2026-08-25
EPSS Evaluated
N/A
NVD
CVE-2022-50998
EUVD
EUVD-2022-56023

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
gnome libxml2 to 2.10.3 (exc)
sparklemotion nokogiri to 1.13.9 (exc)
nokogiri nokogiri to 1.13.9 (exc)
gnome libxml2 2.9.14
gnome libxml2 2.10.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-476 The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Nokogiri before version 1.13.9, which bundles libxml2 v2.9.14. It includes issues like CVE-2022-40304 (data corruption from entity reference cycles) and CVE-2022-40303 (integer overflows with XML_PARSE_HUGE). Processing crafted XML may cause denial of service or memory corruption.

Detection Guidance

Check Nokogiri version with gem list nokogiri. If using CRuby with packaged libraries and version is below 1.13.9, the system is vulnerable. For libxml2, run xml2-config --version and verify it is below 2.10.3.

Impact Analysis

If you use Nokogiri versions below 1.13.9 with packaged libraries, an attacker could exploit this to crash your application or corrupt memory by sending specially crafted XML input.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA. The issue involves denial of service or memory corruption in XML processing, which could indirectly impact data integrity or availability. However, no specific compliance implications are mentioned in the provided context.

Mitigation Strategies

Upgrade Nokogiri to version 1.13.9 or later using gem install nokogiri -v 1.13.9. If using system libxml2, update it to version 2.10.3 or higher via your package manager.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2022-50998. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart