CVE-2022-50999

Analyzed Analyzed - Analysis Complete

Integer Overflow in Nokogiri via libxml2 Buffer Handling

Publication date: 2026-08-25

Last updated on: 2026-09-08

Assigner: VulnCheck

Description

Rejected reason: This CVE ID has been rejected as a duplicate.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-25

Last Modified

2026-09-08

Generated

2026-09-14

AI Q&A

2026-08-25

EPSS Evaluated

2026-09-07

NVD

CVE-2022-50999

EUVD

EUVD-2022-56024

Affected Vendors & Products

Vendor	Product	Version / Range
nokogiri	nokogiri	to 1.13.5 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-119	The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Attack-Flow Graph

Executive Summary

This vulnerability is an integer overflow in Nokogiri versions before 1.13.5, specifically in bundled libxml2 buffer handling functions. Attackers can exploit it by creating multi-gigabyte XML files to trigger buffer overflows, leading to information disclosure, data modification, or denial of service.

Detection Guidance

To detect this vulnerability, check the installed Nokogiri version with 'gem list nokogiri'. If using CRuby with packaged libraries, verify if it is below 1.13.5. For libxml2, check version with 'xml2-config --version' and ensure it is 2.9.14 or higher.

Impact Analysis

If exploited, this vulnerability could allow attackers to read sensitive data, modify existing data, or crash systems by causing denial of service. It primarily affects systems processing large XML files using Nokogiri with bundled libxml2.

Compliance Impact

This vulnerability could lead to information disclosure, data modification, or denial of service, which may violate compliance requirements under GDPR (data protection) and HIPAA (patient data security). Unauthorized data access or modification could result in regulatory penalties or breaches of confidentiality obligations.

Mitigation Strategies

Upgrade Nokogiri to version 1.13.5 or later. If using CRuby with packaged libraries, recompile against external libxml2 version 2.9.14 or higher. Avoid processing untrusted large XML files until patched.

Hi! I’m here to help you understand CVE-2022-50999. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70